pop-schema/menus

This is a healthy, actively maintained release with a strong five-year history, 162 releases, 33 releases in the last 12 months, and a recent repository push. It has stable versioning, a non-deprecated registry entry, an explicit GPL license with a license file, tests in the artifact and repository, a matching repository with an organization owner, and no install-time lifecycle scripts. The main concerns are that all recent repository commits come from one contributor, no security policy or security-scanning tooling is present, and the package/repository lacks a changelog despite documenting one; these reduce resilience and transparency but do not outweigh the evidence of ongoing maintenance. Confidence is high but not maximal because several security, dependency, provenance, and activity signals were not collected.

Latest 19.2.4

Packagist

82%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Repo bus factor

All 15 commits in the last three months came from one contributor, creating a genuine continuity risk; organization ownership provides some potential handoff capacity but no second active contributor is evidenced.

Repo issue activity

There were no new issues or pull requests in the last month and no merged pull requests, which provides little evidence of community activity; however, this is partly offset by 15 recent commits and the absence of open pull requests.

Repo popularity

The repository has only 1 star and no forks, indicating limited public adoption; this is supporting evidence only and is outweighed by the package's strong release and commit activity.

Repo tooling

Composer is used as the build tool, but no security-scanning tools are present, leaving a security-hygiene gap that lowers transparency without indicating abandonment.

Security policy

The repository has no security policy, leaving vulnerability-reporting and response expectations undocumented.