getpop/root-wp

This is a healthy, actively maintained release with a strong publication history: 145 releases over more than three years, 33 releases in the last 12 months, and a current stable version. The repository is active, unarchived, correctly associated with the package, backed by an organization, and includes tests, licensing, and Composer build tooling. The main concerns are that all 14 recent commits came from one contributor and the repository has no security scanning or security policy, while its very low popularity provides little external validation; however, organizational backing and frequent releases reduce the abandonment risk. It appears reasonable to depend on, with normal diligence around security review and maintainer continuity.

Latest 19.2.4

Packagist

82%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Repo bus factor

One contributor authored 100% of the 14 commits in the last three months, which creates continuity risk. The organization-owned repository provides some compensation because maintenance can potentially be handed off within the organization.

Repo popularity

The repository has only 1 star, 0 forks, and 1 watcher, providing little external adoption or review evidence. Popularity is supporting evidence rather than a verdict, so this modestly lowers confidence more than it lowers the health assessment.

Repo tooling

Composer is used as a build tool, which is appropriate for a Packagist PHP package. No security scanning tools are configured, leaving a modest supply-chain hygiene gap.

Security policy

The repository has no security policy. For a maintained package this is a transparency and vulnerability-reporting gap, although the README provides a security contact email.