pop-schema/categories

This is a healthy, actively maintained Composer package with a five-year history, 162 releases, 33 releases in the last 12 months, a stable non-prerelease version, current repository activity, clear licensing, tests, and no install-time lifecycle scripts. The main concerns are that all 15 commits in the last three months came from one contributor, the repository has no security scanning or security policy, and the package has very limited public popularity; however, it is backed by an organization-owned repository, matches its repository and README, and is not deprecated or archived. It appears reasonable to depend on, with normal resilience and security-process caveats.

Latest 19.2.4

Packagist

82%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Maintainers

Only one registry account has publish access, which is a resilience concern in isolation, but the linked repository is organization-owned and shows active commits, providing some project-level backing.

Repo bus factor

All 15 recent commits came from one contributor, creating a genuine continuity risk; organization ownership offers some ability to transfer maintenance, but no second active contributor is shown.

Repo popularity

The repository has only 1 star and no forks or watchers, indicating limited public adoption; popularity is supporting evidence rather than a decisive health criterion, especially given the strong release and commit history.

Repo tooling

Composer is used as a build tool, but no security scanning tools are detected, leaving a security-process gap despite the otherwise standard build setup.

Security policy

The repository has no SECURITY policy, reducing transparency about vulnerability reporting and response procedures.