getpop/taxonomyquery

This release shows strong ongoing maintenance and maturity signals: it has 162 releases over more than five years, 33 releases in the last 12 months, a stable non-prerelease version, recent repository activity, an organization-owned and correctly linked repository, licensing, tests, and no install-time scripts or dangerous workflows. However, the package is explicitly marked abandoned on Packagist with a named replacement, which is the main adoption concern; the repository also has very low popularity, all recent commits come from one contributor, and no security policy or security-scanning tooling was observed. Dependents should prefer pop-schema/taxonomyquery unless compatibility requirements require this package.

Latest 19.2.4

Packagist

52%

Total Score

Maintainer Stability

Maturity

Supply Chain

Health Score Breakdown

Registry deprecation

Packagist marks the package as abandoned and identifies pop-schema/taxonomyquery as its replacement. This is a severe dependency-maintenance concern even though recent releases and repository activity show that the project is not otherwise inactive.

Repo bus factor

All 14 recent commits came from one contributor, creating a meaningful continuity risk. Organization ownership provides some compensation, but no second active contributor is shown.

Repo popularity

The repository has only 1 star, 0 forks, and 1 watcher, indicating limited external adoption or review. Popularity is supporting evidence rather than decisive, so this is a caution rather than a severe risk.

Repo tooling

Composer build tooling is present, but no security-scanning tools are reported. The missing security tooling is a transparency and assurance gap, though not by itself evidence of abandonment.

Security policy

No repository security policy was found. This weakens vulnerability-reporting transparency, although the README provides a security contact, which partially compensates.