pop-schema/comments

This is a healthy, actively maintained release with a strong release history, stable versioning, current repository activity, clear licensing, a package structure that matches its documented monorepo component, and no install-time scripts or registry deprecation. The main concerns are that all recent commits come from one contributor, the repository has no security policy or security-scanning tooling, and neither the artifact nor repository provides a changelog; these are meaningful transparency and resilience gaps, though the organization-owned repository and frequent releases reduce abandonment risk. The low popularity is not itself concerning for a focused component package.

Latest 19.2.4

Packagist

82%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

100

Health Score Breakdown

Package scaffolding

The artifact includes a substantial README and tests, and the README documents installation, development, testing, analysis, contribution, and security reporting. A changelog is absent both from the package and repository, which is a transparency gap, although the frequent release history partly offsets the concern.

Repo bus factor

One contributor made 100% of the 15 commits in the last 3 months, creating a genuine concentration risk. The organization-owned repository provides some ability to hand maintenance off, but no second active contributor is shown in this signal.

Repo issue activity

There were no new or closed issues and no pull requests in the last month, while the open issue count is unknown. This limits evidence from issue handling, but does not outweigh the package's active release and commit history.

Repo tooling

Composer build tooling is present, but no security-scanning tools are reported. The missing scanning coverage is a security-process gap, though it is not evidence of maliciousness or an immediate health verdict.