roots/wordpress-packager

The repository has tests, release notes, dependency scanning, and recent pull-request activity. However, zero commits in the last three months, no security policy, and permissive workflow settings add maintenance and transparency concerns.

Latest v1.4.1

Packagist

45%

Total Score

Maintainer Stability

Dependencies

Maturity

Supply Chain

Health Score Breakdown

Name lookalike

The package borrows the identity of roots/wordpress-no-content, which has far more downloads and releases; despite low artifact overlap, this is strong evidence that consumers could mistake this package for the established one.

Dangerous workflows

One pull_request_target workflow is present, creating elevated automation exposure, although no untrusted checkout or script-injection pattern was detected.

Dependency profile

Nine runtime dependencies create meaningful dependency surface for a command-line package, though the profile is explicit and does not by itself indicate abandonment or unsafe packaging.

Release history

The package has only seven releases and none in the last 12 months, with the latest release on March 25, 2024; this weakens confidence in ongoing maintenance.

Repo commit activity

There were zero commits and zero active maintainers in the last three months, a material warning about current maintenance capacity; recent merged pull requests partly compensate but do not remove it.

Vulnerabilities

We didn't find any vulnerabilities for this package.

Package versions

Maintainers

Austin Pray

Léo Colombaro

Direct Dependencies

Dependency	Last Release	Score
composer/semver Version ^3.2	—	—
symfony/console Version ^6.0	—	—
composer/composer Version ^2.2	—	—
czproject/git-php Version ^4.0	—	—
illuminate/support Version ^10.0	—	—