pop-schema/commentmeta

This is a generally healthy and actively maintained release: it has over five years of history, 162 releases, 33 releases in the last 12 months, a stable non-prerelease version, current repository activity, and no deprecation or archival indicators. The package is clearly tied to its source repository, includes a README, license, Composer build metadata, and repository tests, while its organization-owned backing provides some continuity. The main concerns are that all 15 commits in the last three months came from one contributor, the repository has no security scanning or security policy, and the repository has no workflow automation; these reduce resilience and transparency but do not outweigh the strong release and maintenance record.

Latest 19.2.4

Packagist

82%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Repo bus factor

One contributor made all 15 recent commits, creating a genuine concentration and continuity risk. Organization ownership provides some possible handoff capacity, but no second active contributor is shown.

Repo tooling

Composer is used as a build tool, but no security scanning tools are reported. The build tooling is appropriate, while the absent scanning is a modest transparency and security-hygiene gap.

Security policy

The repository has no SECURITY.md or other detected security policy, leaving vulnerability-reporting expectations less explicit despite the README providing an email contact.