Package Health/pop-cms-schema/taxonomyquery-wp

pop-cms-schema/taxonomyquery-wp

This is a healthy, actively maintained release with a strong publication history: 161 releases over roughly 5 years, 32 releases in the last 12 months, a stable non-prerelease version, and a repository that was pushed very recently. The package is clearly tied to its source repository, has a valid GPL license, tests, Composer-based build metadata, and no install-time lifecycle scripts. The main concerns are that all 14 recent commits came from one contributor, the repository has no security scanning or security policy, and the package has no changelog file despite referring to one in its README. These are meaningful transparency and continuity gaps, but organizational ownership and sustained release activity reduce the abandonment risk.

Latest 19.2.4

Packagist

82%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Package scaffolding

A substantial README and tests are present, and the README documents development, testing, issue reporting, security, and licensing. The absent changelog is a modest transparency gap because the README refers to a changelog that is not present in the collected repository data.

Repo bus factor

All 14 recent commits came from a single contributor, creating a genuine bus-factor risk. Organization ownership and the repository's active release cadence partly compensate, but they do not eliminate dependence on one observed contributor.

Repo popularity

The repository has only 2 stars, 0 forks, and 1 watcher, indicating limited external adoption or review. Low popularity is supporting caution rather than a health verdict, especially given the package's active release history.

Repo tooling

Composer build tooling is present, but no security scanning tools were detected. The missing scanning is a security-hygiene gap, though it is not evidence of maliciousness or abandonment by itself.

Security policy

The linked repository has no published security policy, leaving vulnerability-reporting and response expectations less transparent despite the README providing an email contact.