pop-schema/user-state

This is a healthy, mature release with a five-year history, 162 releases, 33 releases in the last 12 months, a stable non-prerelease version, and recent repository activity. The package is licensed, has a README and tests, uses Composer without install-time lifecycle scripts, and its repository is active, unarchived, organization-owned, and clearly matches the package. The main concerns are that all 15 recent commits came from one contributor, there is no repository security policy or security-scanning tooling, and repository issue activity is currently absent; these reduce resilience and transparency but do not outweigh the strong release and maintenance evidence.

Latest 19.2.4

Packagist

82%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Repo bus factor

One contributor made 100% of the 15 commits in the last three months, creating a meaningful continuity risk. Organization ownership provides some handoff potential, but no second active contributor is shown.

Repo issue activity

There were no new or closed issues or pull requests in the last month, and open-issue count is unavailable. This is a limited activity signal and warrants some caution, although recent commits and releases provide stronger maintenance evidence.

Repo tooling

Composer build tooling is present, but no security-scanning tools are reported. The missing scanning is a transparency and preventive-hygiene gap, not evidence of maliciousness.

Security policy

The repository has no SECURITY.md or other detected security policy, leaving vulnerability reporting and response expectations less explicit. The README does provide a security contact, which partially compensates but does not fully replace a policy.