pop-schema/user-roles-wp

This is a healthy, actively maintained release with a long history since 2021, 162 releases, 33 releases in the last 12 months, a stable non-prerelease version, current repository activity, explicit GPL licensing, tests, and no install-time lifecycle scripts. The main concern is concentration of recent development in one contributor, despite the repository being organization-owned, along with limited repository security-process evidence and low popularity; these are meaningful resilience and transparency gaps but do not outweigh the strong release and maintenance record.

Latest 19.2.4

Packagist

82%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Maintainers

Only one registry account has publish access. This is a modest publishing-resilience concern, although the source project is backed by an organization and recent release activity is strong.

Repo bus factor

One contributor made all 15 commits in the last 3 months, creating a genuine continuity risk. Organization ownership provides some potential handoff capacity, but no second active contributor is evidenced.

Repo popularity

The repository has only 3 stars, 0 forks, and 1 watcher. Low popularity is supporting evidence rather than a health verdict, but it provides little external validation or community resilience.

Repo tooling

Composer is used as a build tool, but no security-scanning tools were detected. The missing scanning layer is a transparency and assurance gap, not evidence of unsafe behavior by itself.

Security policy

The linked repository has no security policy. The package README provides a security contact, which partly compensates for the missing repository policy, but formal vulnerability-reporting guidance remains limited.