sterner-stuff/bedrock

This release is established and actively published, with 169 releases since 2013, 18 releases in the last 12 months, a stable non-prerelease version, and no registry deprecation. The linked repository is active, matches the package, has tests, CI workflows, a clear MIT license, and is organization-owned, which provides useful project backing. However, recent repository activity is very thin—only one commit from one contributor in the last 3 months—and the repository has no security scanning, security policy, or top-level workflow token-permission declarations. The package is therefore usable and reasonably transparent, but its current maintenance depth and repository security hygiene warrant caution before adopting it as a critical dependency.

Latest 1.31.4.1

Packagist

72%

Total Score

Maintainer Stability

Dependencies

Maturity

Supply Chain

Health Score Breakdown

Dependency profile

The package declares 20 runtime and 4 development dependencies, which is substantial but consistent with a WordPress boilerplate that assembles core, plugins, configuration, and deployment tooling; this still creates a broad transitive maintenance surface.

Repo bus factor

All recent repository commits came from one contributor, creating concentration risk; the organization-owned project provides some ability to hand maintenance off, so this is a caution rather than a severe standalone risk.

Repo commit activity

Only one commit was recorded in the last 3 months from one active maintainer, showing very low recent development activity despite the strong registry release history.

Repo issue activity

There were no new or closed issues or pull requests in the last month and no open pull requests. This indicates limited recent collaboration, although the null open-issue count prevents a stronger conclusion.

Repo popularity

The repository has zero stars and forks and one watcher, indicating limited visible adoption; popularity is supporting evidence only, so this lowers confidence in community depth rather than making the package unfit.

Vulnerabilities

We didn't find any vulnerabilities for this package.

Package versions

Maintainers

Scott Walkinshaw

Ben Word

Direct Dependencies

Dependency	Last Release	Score
oscarotero/env Version ^2.1.1	—	—
roots/wordpress Version ^7.1	—	—
roots/wp-config Version ^1.0.0	—	—
vlucas/phpdotenv Version ^5.6.3	—	—
wp-plugin/stream Version >=4.2.0	—	—