getpop/usermeta-wp

This release shows strong ongoing maintenance and maturity signals: it has 162 releases over approximately 5 years, 33 releases in the last 12 months, a stable version, recent repository activity, tests, a clear license, and organization-backed source ownership. However, Packagist marks the package as abandoned and provides a replacement package, which is a major adoption concern even though the repository remains active. Maintenance is also concentrated entirely in one contributor, and the repository has no security scanning or security policy. Developers should prefer the stated replacement package unless compatibility requirements specifically require this abandoned package.

Latest 19.2.4

Packagist

42%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Registry deprecation

Packagist marks the package as abandoned and identifies pop-schema/usermeta-wp as its replacement. This is a severe dependency-lifecycle concern despite the repository's continued activity.

Repo bus factor

One contributor made all 16 commits in the last 3 months, creating a significant continuity and handoff risk. Organization backing provides some mitigation, but no second active contributor is shown.

Repo tooling

Composer build tooling is present, but no security scanning tools are configured. The build setup is appropriate, while the missing security automation is a hygiene gap.

Security policy

The repository has no security policy. The README provides an email reporting route, but the repository-level absence still reduces security-process transparency.