Package Health/pop-cms-schema/customposts-wp

pop-cms-schema/customposts-wp

This release appears healthy and suitable for dependency use: it has a long release history, frequent recent releases, stable versioning, an active and non-archived source repository, explicit GPL licensing, tests, and clear package-to-repository alignment. The main risks are concentration of recent development in one contributor, lack of repository security scanning and a security policy, and very low repository popularity; these warrant normal maintenance and supply-chain review but do not outweigh the strong evidence of ongoing maintenance and organizational backing.

Latest 19.2.4

Packagist

84%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Maintainers

Only one registry account has publish access, which is a resilience concern in isolation. However, the linked repository is owned by an organization and the release history shows sustained activity, partially compensating for the narrow registry access base.

Repo bus factor

One contributor made all 14 commits in the last 3 months, creating a clear contributor-concentration risk. Organizational ownership provides some ability to hand maintenance off, but no second active contributor is shown.

Repo issue activity

There were no new or merged pull requests and no issue activity in the last month, although the absence of open pull requests is not itself negative. This is a limited maintenance signal rather than strong evidence of abandonment.

Repo popularity

The repository has only 2 stars, 0 forks, and 1 watcher. Popularity is supporting evidence rather than a verdict, but these low levels provide little external validation.

Repo tooling

Composer is used as a build tool, supporting reproducible project structure, but no security scanning tools are configured. The missing scanning reduces assurance without indicating unfitness on its own.