Package Health/graphql-by-pop/graphql-server

graphql-by-pop/graphql-server

This is a mature, actively released package with 162 releases since 2021, 33 releases in the last 12 months, a stable non-prerelease version, an active and non-archived repository, clear licensing, tests, substantial source contents, and no install-time lifecycle scripts. The main concerns are that all 16 commits in the last 3 months came from one contributor, the repository has no security policy or security-scanning tooling, and issue activity is absent or largely unknown; these reduce resilience and transparency but do not outweigh the strong release and repository evidence. It appears reasonable to depend on, with normal operational attention to maintainer concentration and security response risk.

Latest 19.2.4

Packagist

82%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Maintainers

Only one registry account has publish access, which is a resilience concern, although the linked repository is owned by an organization and the package has strong recent release activity.

Repo bus factor

One contributor made 100% of the 3-month commits, creating a clear continuity risk; organization ownership provides some potential handoff capacity but does not demonstrate a second active maintainer.

Repo commit activity

The repository recorded 16 commits in the last 3 months, showing recent activity, but all were produced by one active maintainer.

Repo issue activity

There were no new or closed issues or pull requests in the last month, and the open-issues count is unknown. This provides little evidence of community or review activity, though it is not itself evidence of abandonment.

Repo tooling

Composer build tooling is present, but no security-scanning tools are configured. The build evidence is positive while the missing security automation is a genuine hygiene gap.