pop-schema/user-avatars

This is a generally healthy, mature release: it has been maintained since 2021 with 154 releases, 33 releases in the last 12 months, a stable non-prerelease version, active recent repository pushes, tests, a matching and package-referencing repository, and no deprecation or install-time lifecycle scripts. The main risks are concentrated maintenance in one recent contributor and limited explicit security governance, since no security scanning tools or security policy were detected; however, organization ownership, ongoing release activity, and repository tests provide meaningful compensation. It appears reasonable to depend on, with normal supply-chain and maintainer-continuity precautions.

Latest 19.2.4

Packagist

82%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Maintainers

Only one registry publisher account is listed, which is a concentration concern, though this is partly compensated by the organization-owned source repository and strong release activity.

Repo bus factor

All 15 recent commits came from one contributor, creating maintainer-continuity risk. Organization ownership provides some ability to hand maintenance off, so this is a caution rather than a severe risk.

Repo issue activity

There are no open issues or pull requests and no issue or pull-request activity in the last month; for this small package this is not by itself an abandonment verdict, but it provides little evidence of community support.

Repo tooling

Composer build tooling is present, but no security scanning tools were detected, leaving a security-process gap in the repository.

Security policy

The repository has no declared security policy, reducing transparency about vulnerability reporting and response procedures.