Package Health/pop-cms-schema/user-avatars-wp

pop-cms-schema/user-avatars-wp

This is a mature, actively released package with 154 releases over more than five years, 33 releases in the last 12 months, a stable non-prerelease version, an intact organizational repository, matching package references, tests, and clear licensing. The main concern is concentration of maintenance: all 14 commits in the last three months came from one contributor, despite organization ownership, and the repository has no security scanning or formal security policy. These are meaningful transparency and resilience gaps, but they are outweighed by the strong release cadence, recent repository activity, non-archived status, and coherent package structure; it appears reasonable to depend on with normal dependency monitoring.

Latest 19.2.4

Packagist

82%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Repo bus factor

One contributor made 100% of the 14 commits in the last three months. Organization ownership offers some handoff potential, but no second active contributor is shown, so maintainer concentration remains a genuine resilience concern.

Repo issue activity

There are no open issues or pull requests and no recent issue or pull-request activity. This is not inherently unhealthy, but it provides little evidence of a broader maintenance or review community.

Repo popularity

The repository has only 1 star, 0 forks, and 1 watcher. This is weak supporting evidence, but popularity is not decisive for a small, actively maintained package.

Repo tooling

Composer build tooling is present, but no security scanning tools are reported. The missing scanning lowers assurance, though it is not by itself evidence of unsafe code.

Security policy

The repository has no formal security policy, while the package README provides an email-based security reporting instruction. The documented contact partly compensates, but the repository-level policy gap remains.