innocode-digital/wp-project-skeleton

Registry deprecationdanger

The package is explicitly marked abandoned on Packagist, with package-wide deprecation and no replacement that clearly redirects consumers to a maintained alternative. This is a severe adoption risk despite the repository remaining available.

Release historydanger

The package has 59 releases since April 2020, but none in the last 12 months and its latest release was in August 2023. That prolonged release gap strongly suggests the dependency is no longer being maintained.

Repo commit activitydanger

There were no commits and no active maintainers in the last three months. Combined with the old latest release, this supports a substantial abandonment concern.

Security policycaution

The repository has no security policy. For a WordPress project skeleton containing deployment and environment workflows, this leaves vulnerability-reporting expectations and response procedures unclear.

Workflow auditcaution

All 15 analyzed action references are unpinned, and six high-confidence template-injection findings were reported across three workflows. The workflows have no untrusted checkout or dangerous trigger counts, which limits the impact but does not remove the hygiene risk.