address-rfc2822

Package scaffoldingdanger

The README prominently says the module is deprecated and directs new projects to @haraka/email-address; the exact release also includes a deprecation notice in its release notes. Tests, a changelog, and a usable README provide transparency but do not offset the replacement warning.

Release historycaution

The package has existed for over 13 years with 18 releases and one release in the last 12 months, showing some continued maintenance. The relatively sparse release history limits confidence that this older package remains the intended long-term dependency.

Repo commit activitycaution

No commits or active maintainers were recorded in the last three months, which is concerning for ongoing maintenance. The recent release and repository push provide some compensating evidence, but current activity is still absent.

Token permissionscaution

Both workflows lack top-level token permissions and rely on job-level permissions only. No top-level write permissions were observed, but the absence of explicit read-only defaults is a modest workflow-hygiene gap.