getpop/queriedobject

This release shows strong ongoing maintenance and reasonable package hygiene: it has a five-year history, 162 releases, 33 releases in the last 12 months, a stable non-prerelease version, current repository activity, tests, a README, an explicit GPL license, and no install-time lifecycle scripts. However, the package is explicitly marked abandoned on Packagist in favor of pop-schema/queriedobject, which is a major adoption concern even though the linked organization-owned repository is active. Maintenance is also concentrated entirely in one contributor, and the repository has no security policy or security-scanning tooling. Developers should prefer the replacement package unless compatibility requirements make this release necessary.

Latest 19.2.4

Packagist

48%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Registry deprecation

Packagist marks the package as abandoned and identifies pop-schema/queriedobject as its replacement. This is a severe dependency-lifecycle concern despite the package's recent activity.

Maintainers

Only one Packagist account has publish access. This is a mild concern, although the repository is backed by an organization and registry access does not measure actual maintenance capacity.

Repo bus factor

All 15 recent commits came from one contributor, creating a real continuity risk. Organization backing provides some compensation, but no second active contributor is shown.

Repo tooling

Composer is used as a build tool, but no security-scanning tools are configured. The missing scanning is a transparency and defense-in-depth gap, not evidence of maliciousness.

Security policy

The repository has no security policy, leaving vulnerability-reporting and response expectations undocumented.