foodieneers/seo

This release is actively maintained and has strong supporting evidence: 25 releases in the last 12 months, a stable v2.2 release, recent repository pushes, repository tests and changelog coverage, Composer tooling, Dependabot, and organization ownership. However, Packagist explicitly marks the package as abandoned and identifies foodineers/seo as the replacement, which is a decisive dependency-risk signal even though the linked repository remains active. Maintenance is also concentrated in one contributor, while workflow permissions and security-policy hygiene have gaps. Developers should migrate to the replacement package rather than adopt this abandoned package.

Latest v2.2

Packagist

20%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Using this package? Scan for Free

Health Score Breakdown

Registry deprecation

Packagist marks the package as abandoned and names foodineers/seo as its replacement. This is a severe dependency and maintenance risk despite the repository's current activity.

Dangerous workflows

One of four workflows uses pull_request_target, specifically the Dependabot auto-merge workflow. No untrusted checkout or script-injection findings were detected, so the workflow posture is a review concern rather than a severe finding.

Lifecycle scripts

The package declares a post-autoload-dump lifecycle script. This is an install-time execution surface that warrants review, although the signal alone does not establish that the script is unsafe.

Repo bus factor

All 9 commits in the last 3 months came from one contributor, producing a 100% top-contributor share. Organization ownership provides some handoff capacity, but the observed contributor concentration remains a maintenance-continuity concern.

Security policy

No repository security policy was found. This reduces vulnerability-reporting transparency, though it is a hygiene gap rather than evidence of abandonment.