pop-schema/tags

This release appears healthy and suitable for dependency use: it has a five-year history, 162 releases including 33 in the last 12 months, a stable non-prerelease version, active recent commits, an unarchived matching repository, explicit licensing, tests, and no install-time lifecycle scripts. The main concerns are that all 15 recent commits came from one contributor, the repository has very little public popularity, and no security policy or security-scanning tooling was detected. These reduce resilience and transparency but are outweighed by the strong release cadence, organization-owned project backing, and current repository activity.

Latest 19.2.4

Packagist

82%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Repo bus factor

One contributor made all 15 commits during the last 3 months, creating a genuine continuity and bus-factor concern. The organization-owned repository provides some backing and potential handoff capacity, but no second active contributor is shown.

Repo popularity

The repository has 1 star, 0 forks, and 0 watchers. This is weak supporting evidence of adoption, but popularity alone is not decisive and does not outweigh the package's release and commit activity.

Repo tooling

Composer build tooling is present, but no security-scanning tools were detected. The missing scanning is a security-hygiene gap, though it is not evidence that the package is malicious.

Security policy

No repository security policy was found, leaving vulnerability-reporting and response expectations less transparent. The README does provide an email contact for security issues, which partially compensates for the repository-level gap.