pop-wp-schema/usermeta

This is a generally healthy and actively maintained release: it has 145 releases over roughly 3 years, 33 releases in the last 12 months, a stable non-prerelease version, an active non-archived repository, and recent commits. The organization-owned repository and matching package references provide credible project backing, while the license, tests, Composer build tooling, and absence of install-time scripts support reasonable transparency and operational safety. The main concerns are complete concentration of recent commits in one contributor, no security policy, no security-scanning tooling, and no changelog despite the package documentation referring to one; these are meaningful but do not outweigh the strong release and maintenance history.

Latest 19.2.4

Packagist

78%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Package scaffolding

The artifact includes a README and the repository has tests, compensating for the absence of packaged test coverage; however, neither artifact nor repository has a changelog, leaving a modest transparency gap.

Repo bus factor

All 14 recent commits came from one contributor, creating a real single-maintainer continuity risk. The organization-owned repository provides some potential handoff capacity, but no second active contributor is evidenced.

Repo popularity

The repository has zero stars and forks and one watcher, indicating limited external adoption; this is supporting evidence only and is outweighed by the strong release and commit activity.

Repo tooling

Composer build tooling is present, but no security-scanning tools were detected; the missing scanning coverage is a modest supply-chain hygiene gap.

Security policy

The repository has no security policy, leaving vulnerability-reporting and response expectations undocumented despite the README providing an email contact.