getpop/queriedobject-wp

This release shows strong ongoing activity and reasonable package hygiene: it has 161 releases over roughly 5 years, 33 releases in the last 12 months, a stable non-prerelease version, an active non-archived repository, tests, a README, a license file, and no install-time lifecycle scripts. However, Packagist explicitly marks the package as abandoned and provides `pop-schema/queriedobject-wp` as a replacement, which is a severe dependency-safety concern despite the recent release activity. Maintenance is also concentrated in one contributor, and the repository lacks a security policy and changelog. Developers should prefer the stated replacement unless they have a specific compatibility reason to use this abandoned package.

Latest 19.2.4

Packagist

35%

Total Score

Maintainer Stability

Maturity

Supply Chain

Health Score Breakdown

Registry deprecation

Packagist marks the package as abandoned and names `pop-schema/queriedobject-wp` as the replacement. This is a severe signal that new dependencies should not be taken on this package even though releases continue.

Repo bus factor

All 14 commits in the last 3 months came from one contributor, giving the repository a complete short-term contributor concentration. Organization ownership provides some ability to hand maintenance off, but no second active contributor is shown, so this remains a maintenance risk.

Repo tooling

The repository uses Composer for builds, but no security-scanning tools are reported. Composer support is appropriate for the ecosystem; the missing scanning tooling is a modest supply-chain hygiene gap rather than a standalone severe risk.

Security policy

No repository security policy was found. The README supplies an email contact for security issues, which is useful compensating evidence, so the absence is a limited concern.