pop-api/api-rest

This release appears suitable for dependency use: it has a five-year maintenance history with 162 releases, 33 releases in the last 12 months, a current stable version, recent repository activity, an unarchived matching source repository, tests, a clear GPL-2.0-or-later license, and a small runtime dependency footprint. The main concerns are that all 15 recent commits came from one contributor, the repository has very low popularity, and no security policy or security-scanning tooling was detected; organization backing partially offsets the contributor-concentration risk, but these gaps warrant normal dependency monitoring.

Latest 19.2.4

Packagist

82%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Repo bus factor

One contributor made all 15 commits in the last 3 months, indicating a concentrated bus factor. The organization-owned repository provides some handoff capacity, but no second active contributor is evidenced.

Repo commit activity

The repository recorded 15 commits in the last 3 months, showing current activity. However, all activity came from one active maintainer, so maintenance continuity depends heavily on that person.

Repo popularity

The repository has only 2 stars, 0 forks, and 1 watcher. Popularity is limited, which modestly reduces external validation, but it is not decisive given the strong release and commit activity.

Repo tooling

Composer build tooling is present, but no security-scanning tools were detected. The missing scanning layer is a security-hygiene gap, though it does not by itself indicate an unhealthy package.

Security policy

The repository has no security policy. This weakens vulnerability-reporting transparency and is a genuine hygiene concern for a dependency.