getpop/taxonomymeta

This release shows strong ongoing maintenance and reasonable package hygiene, with 162 releases over approximately 5 years, 33 releases in the last 12 months, a stable non-prerelease version, recent repository activity, tests, licensing, and organization-backed source ownership. However, Packagist explicitly marks the package as abandoned and identifies pop-schema/taxonomymeta as its replacement; that registry-level deprecation is a severe adoption risk because future fixes and releases should be expected under the replacement package instead. The single-contributor activity and absent security policy add secondary concerns, so developers should migrate to the replacement rather than take a new dependency on this package.

Latest 19.2.4

Packagist

22%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Registry deprecation

Packagist marks the package as abandoned and names pop-schema/taxonomymeta as the replacement. This is a severe supply-chain health concern for new dependents even though other signals show the code is still being maintained.

Repo bus factor

One contributor made all 15 commits in the last 3 months, producing a 100% top-contributor share. Organizational ownership provides some context, but no second active contributor is shown, leaving a genuine continuity risk.

Repo tooling

Composer is used as a build tool, but no security scanning tools are present. The build setup is appropriate, while the absence of scanning is a modest transparency and assurance gap.

Security policy

The repository has no security policy. This leaves vulnerability-reporting and response expectations less transparent, creating a genuine but secondary maintenance concern.