Package Health/pop-schema/postmedia-mutations

pop-schema/postmedia-mutations

This is a healthy, actively maintained release with a long history of 146 releases since 2021, 33 releases in the last 12 months, and a stable non-prerelease version. The repository is active, unarchived, correctly associated with the package, backed by an organization, and the package includes a README, tests, a license, and no install-time lifecycle scripts. The main concerns are that all 15 recent commits came from one contributor, the repository has no security scanning or published security policy, and the package has low visible popularity; these are meaningful resilience and transparency limitations but do not outweigh the strong release and maintenance evidence.

Latest 19.2.4

Packagist

82%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Maintainers

Only one registry account has publish access, which is a resilience limitation. However, the repository is organization-owned and recent release activity is strong, so this is caution rather than a severe concern.

Repo bus factor

All 15 recent commits came from one contributor, creating a concentrated maintenance dependency. Organization ownership partially mitigates handoff risk, but no second active contributor is shown.

Repo tooling

Composer build tooling is present, but no security scanning tools are configured. The missing scanning is a transparency and defense-in-depth gap, not evidence of unsafe behavior on its own.

Security policy

The linked repository has no published security policy, leaving vulnerability-reporting expectations less explicit. The README does provide a security contact, which partially compensates for this gap.