getpop/post-tags

This release has strong evidence of ongoing development and reasonable package hygiene: it has 161 releases over roughly 5 years, 33 releases in the last 12 months, a stable non-prerelease version, a linked non-archived organizational repository, recent commits, a license file, tests, and no install-time lifecycle scripts. However, the package is explicitly marked abandoned on Packagist with a replacement package, which is a major dependency risk even though the repository remains active; maintenance is concentrated entirely in one contributor, and the repository has no security scanning or security policy. Prefer the replacement package unless compatibility requirements require this package and you have verified its migration path.

Latest 19.2.4

Packagist

38%

Total Score

Maintainer Stability

Maturity

Supply Chain

Health Score Breakdown

Registry deprecation

Packagist marks the package as abandoned and names pop-schema/post-tags/ as its replacement. This is a major adoption and continuity risk despite the absence of repository archival.

Repo bus factor

All 15 recent commits came from one contributor, producing a complete single-contributor concentration. Organizational ownership provides some maintenance context, but there is still a meaningful continuity risk.

Repo popularity

The repository has only 1 star and no forks, indicating limited public adoption. Popularity is supporting evidence rather than decisive, so this is a caution rather than a severe finding.

Repo tooling

Composer build tooling is present, but no security scanning tools are detected. The build setup is appropriate for the package, while the missing security automation lowers transparency somewhat.

Security policy

The repository has no security policy. The README provides an email-based security reporting path, which partially compensates for the missing SECURITY.md but leaves formal disclosure guidance limited.