getpop/user-roles-wp

This release shows strong evidence of active maintenance and maturity: it has 162 releases over roughly 5 years, 33 releases in the last 12 months, a stable non-prerelease version, current repository activity, tests, a README, a declared GPL license with a license file, and no install-time lifecycle scripts. However, the package is explicitly marked abandoned on Packagist with a replacement package, which is a major dependency-health concern even though development continues. Maintenance is also concentrated in one contributor, and the repository has no security scanning or security policy. Developers should prefer the specified replacement package unless compatibility requirements make this package unavoidable.

Latest 19.2.4

Packagist

38%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Registry deprecation

Packagist marks the package as abandoned and identifies pop-schema/user-roles-wp as its replacement. This is a severe transparency and future-maintenance concern, despite the package continuing to receive releases.

Repo bus factor

One contributor made all 15 commits in the last 3 months, creating a significant concentration and continuity risk. Organization backing provides some mitigation, but no second active contributor is shown.

Repo popularity

The repository has only 3 stars, 0 forks, and 1 watcher. Low popularity is supporting caution about external adoption and resilience, but it is not decisive because the package has active release and commit histories.

Repo tooling

Composer build tooling is present, but no security-scanning tools are reported. The missing scanning coverage is a hygiene gap, though it is not evidence of maliciousness.

Security policy

No repository security policy was found, reducing the transparency of vulnerability reporting and response expectations.