getpop/usermeta

This release shows strong ongoing maintenance and reasonable package hygiene: it has 162 releases over roughly 5 years, 33 releases in the last 12 months, a stable non-prerelease version, recent repository activity, tests, a license file, and no install-time lifecycle scripts or dangerous workflows. However, the package is explicitly marked abandoned on Packagist and has a replacement package, which is a major dependency risk even though the linked organization-owned repository remains active. Developers should prefer pop-schema/usermeta unless compatibility requirements make this release necessary.

Latest 19.2.4

Packagist

48%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Registry deprecation

Packagist marks the package as abandoned and identifies pop-schema/usermeta as the replacement. This is a severe adoption and continuity concern despite the release being recent.

Repo bus factor

All 15 recent commits came from one contributor, creating a genuine continuity risk; the organization-owned repository provides some institutional backing but does not remove the concentration concern.

Repo issue activity

There were no new issues or pull requests in the last month and no merged pull requests, but the null open-issues value limits interpretation; recent commits still show activity.

Repo popularity

The repository has only 1 star and no forks, indicating limited visible adoption. Popularity is supporting evidence only, so this is a caution rather than a decisive health failure.

Repo tooling

Composer is used as a build tool, but no security scanning tools are reported. This is a modest transparency and assurance gap rather than evidence of unfitness on its own.