badaso/sitemap-module

The source includes tests, release notes, and a clear README, while the repository remains available and organization-backed. Its long inactivity, unfinished release status, license mismatch, and high-confidence unpinned container image make long-term maintenance and build integrity concerns.

Latest 2.0.0-rc.1

Packagist

35%

Total Score

Maintainer Stability

Maturity

Supply Chain

Health Score Breakdown

Release history

The latest release was published about five years ago, with no releases in the last 12 months despite six releases overall. This is strong evidence of abandonment risk for a package intended to remain a maintained dependency.

Repo commit activity

There were no commits and no active maintainers in the last three months, consistent with the package having been effectively inactive for several years. The non-archived repository does not compensate for this lack of current development.

License

The manifest declares the package proprietary, while the repository license file is recognized as MIT. The repository license is compensating evidence, but the mismatch should be clarified before adoption.

Repo tooling

The repository uses Composer, but no security scanning tools were detected. This is a modest transparency and maintenance gap rather than evidence that the package is unsafe.

Security policy

The repository has no security policy, leaving vulnerability reporting and response expectations undocumented. This adds a transparency gap for a dependency with no recent maintenance.