getpop/users

This release shows strong ongoing activity and reasonable package maturity: it has been published for over five years, has 162 releases including 33 in the last 12 months, is on a stable major version, is backed by an organization-owned repository, and was pushed recently. The decisive concern is that Packagist marks the package as abandoned and identifies pop-schema/users as its replacement, making continued dependency on this package a significant adoption and continuity risk despite the active repository. Maintenance is also concentrated in one contributor, and the repository has no security policy or security-scanning tooling. Prefer the replacement package unless compatibility requirements require this exact release.

Latest 19.2.4

Packagist

35%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Registry deprecation

Packagist marks the package as abandoned and names pop-schema/users as the replacement. This is a severe dependency-continuity warning even though other signals show the repository is still active.

Repo bus factor

One contributor made all 15 commits in the last 3 months, creating a concentrated bus factor. Organization ownership provides some potential handoff capacity, but no second active contributor is evidenced.

Repo issue activity

There were no new or merged pull requests and no new or closed issues in the last month. With active commits present, this is a limited collaboration signal rather than evidence of complete abandonment.

Repo popularity

The repository has only 1 star, 0 forks, and 1 watcher, indicating limited external adoption or visibility. Low popularity is supporting caution rather than a verdict by itself.

Repo tooling

Composer is used as a build tool, but no security-scanning tools are configured. The missing security scanning is a hygiene gap, though it is not by itself evidence that the package is unsafe.