pop-wp-schema/comments

This is a healthy, actively maintained release with a strong release track record: the package is over four years old, has 146 releases, 33 releases in the last 12 months, and was published very recently. It is stable, not deprecated, licensed, has a matching source repository, includes tests and build configuration, and has no install-time lifecycle scripts. The main concerns are that all recent commits come from one contributor, the repository has minimal public adoption, and it lacks a repository security policy and security-scanning tooling. Those concerns are moderated by the organization-owned repository and sustained recent activity, so the package appears reasonable to depend on, with normal supply-chain review still advisable.

Latest 19.2.4

Packagist

78%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Repo bus factor

One contributor made 100% of the 15 commits in the last three months, creating a real continuity risk. The organization-owned repository partially compensates because maintenance can potentially be handed off within the organization.

Repo popularity

The repository has only 1 star, 0 forks, and 1 watcher. Popularity is supporting evidence rather than a verdict, but these values provide little external validation and modestly lower confidence.

Repo tooling

Composer is used as a build tool, but no security-scanning tools are configured. The build tooling is appropriate, while the missing security automation is a hygiene gap rather than a standalone severe risk.

Security policy

The repository has no security policy. This weakens vulnerability-reporting transparency, although the README provides a security contact path, which partially compensates for the missing formal policy.