pop-schema/taxonomies-wp

This is a healthy, actively maintained release with a strong release history: it has existed for over five years, has 162 releases, and published 33 releases in the last 12 months. The package is stable, licensed, non-deprecated, directly backed by an organization-owned repository, and its latest repository push closely matches the release date. Composer build tooling, repository tests, package identity matching, and the absence of install-time scripts provide useful transparency and reduce operational risk. The main concerns are a single active contributor, no security scanning or security policy, no changelog in either artifact or repository, and minimal repository popularity; these are meaningful hygiene and continuity limitations but are partly offset by the organization's backing and sustained release activity.

Latest 19.2.4

Packagist

82%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Package file tree

The artifact and repository have matching, non-truncated trees with source, configuration, licensing, documentation, and tests, indicating a coherent package layout. The only test file is named ModuleTestDisabled.php, so the apparent test presence offers less assurance than an active test suite would.

Package scaffolding

A substantial README and tests are present, and the README documents development, testing, contribution, and security-reporting paths. However, neither the artifact nor repository has a changelog; the README points to a changelog that is not present in the collected evidence, creating a modest transparency gap.

Repo bus factor

All 15 commits in the last 3 months came from one contributor, creating continuity risk. The organization-owned repository provides some capacity for handoff, but no second active contributor is evidenced.

Repo popularity

The repository has only 1 star, 0 forks, and 1 watcher, indicating limited visible adoption. Popularity is supporting evidence rather than a decisive health measure, so this is a minor concern only.

Repo tooling

Composer build tooling is present, but no security-scanning tools were detected. The missing scanning is a supply-chain hygiene gap, though it is not evidence of malicious behavior.