pop-wp-schema/meta

This is a healthy, actively maintained release with a substantial history: 145 releases since January 2023, 33 releases in the last 12 months, and a stable non-prerelease version. It is licensed, non-deprecated, repository-backed by an organization, and has recent commit activity with matching package references and a coherent source tree. The main concerns are that all 15 recent commits came from one contributor, the repository has no security policy or security-scanning tooling, and neither the artifact nor repository provides a changelog; these are transparency and resilience gaps, but they do not outweigh the strong release cadence and active repository. The package appears reasonable to depend on, with normal supply-chain review still warranted.

Latest 19.2.4

Packagist

78%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Package scaffolding

A substantive README and tests are present, and the README documents installation, testing, standards, security reporting, and the monorepo location. A changelog is absent from both the package and repository, which is a minor transparency gap.

Repo bus factor

All 15 commits in the last 3 months came from one contributor, giving the package a concentrated maintenance base. Organization backing provides some handoff potential, but no second active contributor is shown, so this remains a resilience concern.

Repo tooling

Composer build tooling is present, but no security-scanning tools are configured. The build setup is appropriate, while the missing security automation is a modest process gap.

Security policy

The repository has no security policy, leaving vulnerability-reporting expectations less explicit despite the README providing a security contact email.