getpop/customposts

This release shows strong ongoing activity and reasonable package hygiene: it has 161 releases since 2021, 33 releases in the last 12 months, a stable non-prerelease version, a current non-archived repository, tests, a README, an explicit GPL license, and no install-time lifecycle scripts. However, Packagist marks the package as abandoned and points to pop-schema/customposts as its replacement, which is a major adoption and continuity risk even though the repository was recently updated. Recent development is also concentrated entirely in one contributor, and the repository has very little external adoption, so this dependency should generally be replaced with the declared successor unless compatibility requirements prevent that.

Latest 19.2.4

Packagist

35%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Registry deprecation

Packagist explicitly marks the package as abandoned and supplies pop-schema/customposts as a replacement. This is a severe continuity and adoption concern despite the package's recent releases.

Repo bus factor

One contributor made all 16 commits in the last 3 months, creating a materially low bus factor. The organization-owned repository provides some handoff context, but no second active contributor is evidenced.

Repo popularity

The repository has only 2 stars, 0 forks, and 1 watcher, providing little evidence of broad external adoption. Low popularity is supporting caution rather than a decisive health verdict.

Repo tooling

Composer build tooling is present, but no security scanning tools are reported. This is a hygiene gap, partially offset by the absence of workflows and the package's active release history.

Security policy

No repository security policy was found. The README provides an email-based security reporting route, which offers some compensating disclosure guidance but is less transparent than a formal policy.