pop-cms-schema/post-tags

This is a mature, actively released, non-deprecated package with 161 releases over approximately 5 years and 33 releases in the last 12 months, including a stable current version. The package is licensed, has a matching and clearly identified organization-owned repository, includes tests and a coherent source tree, and has no install-time lifecycle scripts or dangerous workflows. The main concerns are that all 15 recent commits came from one contributor, the repository has no security scanning or security policy, repository issue and pull-request activity is absent, and no changelog is present. Overall, the strong release cadence and active repository make it a reasonable dependency, but its maintenance resilience and security-process transparency are limited.

Latest 19.2.4

Packagist

78%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Package scaffolding

The artifact has a substantial README and tests, and the repository also has tests; the missing changelog is a modest transparency gap because the README refers to a changelog that is not present in the collected tree.

Repo bus factor

One contributor made all 15 recent commits, creating a genuine continuity risk. Organization ownership provides some potential handoff capacity, but no second active contributor is shown by this signal.

Repo issue activity

There were no new or closed issues or pull requests in the last month, and no pull requests were open; this provides little evidence of broader community activity, although commit activity remains present.

Repo tooling

Composer is used as a build tool, but no security scanning tools are configured, leaving a security-process hygiene gap rather than evidence of an unsafe package.

Security policy

The repository has no SECURITY.md or other detected security policy, reducing transparency for vulnerability reporting and response.