pop-schema/taxonomymeta

This is a healthy, actively maintained Composer package with a five-year history, 162 releases, 33 releases in the last 12 months, a stable non-prerelease version, and a repository that is current and backed by an organization. It has clear licensing, tests in both the artifact and repository, build tooling, no install-time lifecycle scripts, and a repository that matches and documents the package. The main concerns are that all 15 commits in the last three months came from one contributor, the repository has little measured popularity, and it lacks a security policy and security-scanning tools; the missing changelog is also a modest transparency gap. These concerns warrant routine dependency monitoring but do not make the release unsuitable to depend on.

Latest 19.2.4

Packagist

82%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Repo bus factor

One contributor made all 15 recent commits, creating a genuine single-maintainer continuity risk. Organization ownership provides some potential handoff capacity, but no second active contributor is shown.

Repo issue activity

There were no new or closed issues and no pull-request activity in the last month; this provides little evidence of community maintenance, though the null open-issue count limits interpretation.

Repo popularity

The repository has only 2 stars, 0 forks, and 1 watcher. This is weak supporting adoption evidence, but popularity is not decisive and is outweighed by the strong release and commit activity.

Repo tooling

Composer is used as a build tool, but no security-scanning tools are detected. The build tooling is appropriate, while the security-tooling gap modestly reduces assurance.

Security policy

The repository has no security policy, leaving vulnerability-reporting and response expectations undocumented.