Package Health/graphql-by-pop/graphql-voyager

graphql-by-pop/graphql-voyager

This release appears dependable for adoption: it has a coherent package artifact, MIT licensing, no deprecation notice, no install-time lifecycle scripts, a stable release line, and strong recent release activity with 33 releases in the last 12 months. The linked repository is active, correctly associated with the package, organization-backed, and has 13 commits in the last 3 months, but maintenance is concentrated in one contributor, the repository has very little visible popularity, and it lacks tests, a changelog, a security policy, and security-scanning tooling. Overall, the package is usable and actively maintained, but its limited contributor diversity and engineering/security transparency justify moderate caution.

Latest 19.2.4

Packagist

78%

Total Score

Maintainer Stability

Maturity

Supply Chain

Health Score Breakdown

Package scaffolding

A substantial README is present, but both the artifact and repository report no tests or changelog. For a small static client this is a hygiene gap rather than a severe adoption blocker, but there is no provided test or changelog evidence to compensate for it.

Repo bus factor

All 13 recent commits came from one contributor, creating meaningful continuity risk; organization ownership provides some potential handoff capacity, but no second active contributor is shown.

Repo popularity

The repository has only 2 stars, 0 forks, and 1 watcher. Popularity is supporting evidence rather than a verdict, but these low figures provide little external validation or community resilience.

Repo tooling

Composer build tooling is present, but no security-scanning tools are reported. The missing scanning coverage lowers security transparency, although it is not evidence that the package is malicious.

Security policy

The repository has no SECURITY.md or other detected security policy, leaving vulnerability reporting and response expectations less transparent.