@hapi/joi

Registry deprecationdanger

The registry marks the entire package as deprecated and directs users to install joi instead, making this release unsuitable for a new dependency despite other healthy project signals.

Release historycaution

The package has had no registry release in more than six years, with zero releases in the last 12 months. Active repository work partly offsets the age of the published release but not the stale distribution.

Repo bus factorcaution

All 14 recent commits came from one contributor, creating concentration risk. Organization ownership provides some handoff capacity, but no second active contributor is shown.

Workflow auditcaution

The workflow audit completed cleanly, with read-only permissions and no untrusted checkout or script-injection findings. Its only action reference is unpinned, which is a minor reproducibility weakness.