automattic/wp-feature-api

Registry deprecationdanger

Packagist marks the entire package as abandoned, with no replacement named. This is a severe adoption risk because future maintenance is not expected.

Repo commit activitydanger

The repository recorded zero commits and zero active maintainers over the last three months, providing strong evidence that active development has stopped.

Repository archiveddanger

The linked source repository is archived, and it was last pushed over a year ago. An archived project is generally unfit for a new dependency without a compelling migration plan.

Workflow auditdanger

The sole workflow is fully analyzed and scopes permissions at job level, but it has five unpinned action references and high-confidence template-injection findings. The audit also flags trusted publishing and archived actions, creating meaningful release-workflow risk.

Release historycaution

The package has eight releases, but its latest release was over a year ago and it has had no releases in the last 12 months, indicating a stalled release line.