Package Health/pop-schema/customposts-wp

pop-schema/customposts-wp

This is a mature and actively maintained Composer package: it has existed since 2021, has 162 releases including 33 in the last 12 months, releases approximately every 4 days, is on a stable major version, is not deprecated, and was pushed very recently. The package has a clear README, tests in both the artifact/repository context, a matching repository with an organizational owner, a license file, and no install-time lifecycle scripts. The main concerns are that all 14 recent commits came from one contributor, the repository has minimal popularity, and it lacks a formal security policy and security-scanning tooling. These are meaningful resilience and transparency gaps, but they are outweighed by the strong release cadence, current activity, project backing, and package hygiene.

Latest 19.2.4

Packagist

82%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Maintainers

Only one registry account has publish access, which is a resilience concern in isolation. However, the linked repository is organization-owned and shows current activity, so this is a caution rather than a severe risk.

Repo bus factor

One contributor made all 14 commits in the last 3 months, creating a genuine single-maintainer continuity risk. Organization backing provides some ability to hand off maintenance, but no second active contributor is evidenced.

Repo issue activity

There were no new or closed issues or pull requests in the last month, and no open pull requests. This provides little evidence of community support, but it does not contradict the observed release and commit activity.

Repo popularity

The repository has only 2 stars, 0 forks, and 1 watcher, so external adoption and independent visibility are limited. Popularity is supporting evidence only, and the package's release and maintenance activity compensate for much of this gap.

Repo tooling

Composer is used as a build tool, which is appropriate for this PHP package, but no security-scanning tools are configured, leaving a security-hygiene gap.