getpop/tags-wp

This release shows strong ongoing activity and reasonable package hygiene, but it is explicitly abandoned on Packagist and has a replacement package, making continued dependency adoption a liability despite the linked repository remaining active. The package has a long release history, a stable version, recent releases, tests, a license, and no install-time scripts or dangerous workflows; however, all recent repository commits come from one contributor, and the repository lacks a security policy. Prefer the stated replacement package rather than introducing a new dependency on this abandoned package.

Latest 19.2.4

Packagist

42%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Registry deprecation

Packagist marks the package as abandoned and names pop-schema/tags-wp as its replacement. This is a severe adoption and maintenance risk even though other signals show that the source repository is still active.

Maintainers

Only one registry account has publish access. This is a limited publishing base, but the organization-owned repository and sustained release activity provide some compensation.

Repo bus factor

One contributor made 100% of the 15 recent commits. Because the repository is organization-owned, concentrated activity is less concerning than for an individual project, but the absence of a second active contributor still creates continuity risk.

Repo issue activity

There were no new or closed issues or pull requests in the last month, and the open issue count is unknown. This provides little evidence about community support, but it is not independently a severe concern.

Repo tooling

Composer is used as a build tool, which fits the package ecosystem, but no security scanning tools are reported. The absence of scanning is a hygiene gap rather than evidence of an unsafe release.