pop-schema/user-roles

This is a mature, actively released package with clear licensing, a matching organization-owned repository, tests, a modest dependency footprint, and recent commit activity. The main concerns are that all recent repository commits come from one contributor, the repository has no security policy or security-scanning tooling, and no changelog was found; these are meaningful transparency and continuity gaps, but they are offset by the package’s long release history, ongoing releases, non-archived repository, and stable versioning. It appears reasonable to depend on, with normal supply-chain and maintainer-continuity review advised.

Latest 19.2.4

Packagist

78%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Repo bus factor

One contributor made all 15 commits in the last 3 months, creating a genuine maintainer-continuity risk. Organization backing provides some potential handoff capacity, but no second active contributor is shown by this signal.

Repo issue activity

There were no new issues or pull requests in the last month and no merged pull requests; this provides little evidence of an active external feedback process, although the null open-issue count limits the conclusion.

Repo popularity

The repository has 3 stars, 1 fork, and 1 watcher. This is limited adoption evidence, but popularity is supporting evidence rather than a health verdict and does not outweigh the strong release and commit history.

Repo tooling

Composer build tooling is present, but no security-scanning tools are detected. This is a hygiene gap rather than a severe risk, especially because the repository is actively maintained.

Security policy

No repository security policy was found. The README gives a security contact address, which is useful compensating evidence, but the absence of a formal policy remains a modest transparency gap.