getpop/user-roles

This release shows strong ongoing project activity and reasonable package hygiene: it has a long release history, frequent recent releases, a stable version, an explicit GPL license, tests in the artifact and repository, no install-time lifecycle scripts, and an active unarchived repository backed by an organization. However, the package is explicitly marked abandoned on Packagist and has a replacement package, which is a decisive adoption risk: developers should depend on pop-schema/user-roles instead. Maintenance is also concentrated entirely in one contributor, and the repository has no security scanning or security policy, adding secondary concerns despite recent activity.

Latest 19.2.4

Packagist

20%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Using this package? Scan for Free

Health Score Breakdown

Registry deprecation

Packagist marks the package as abandoned and identifies pop-schema/user-roles as its replacement. This is a severe adoption and maintenance risk for a new dependency, even though the repository remains active.

Repo bus factor

One contributor made all 15 commits in the last 3 months, giving the repository a 100% top-contributor share. Even with organization backing, no second active contributor is shown, so continuity depends heavily on one person.

Repo issue activity

There were no new issues or pull requests in the last month, and no pull requests were merged. With recent commits this is not evidence of abandonment, but it offers limited evidence of broader community activity.

Repo popularity

The repository has only 3 stars, 1 fork, and 1 watcher. Low popularity is supporting evidence rather than a verdict, but it provides little external resilience or adoption evidence.

Repo tooling

Composer is used as a build tool, but no security-scanning tools are present. Build tooling is appropriate, while the absence of security scanning is a hygiene gap.