arnoson/kirby-forms

Registry deprecationdanger

Packagist marks the entire package abandoned and explicitly identifies arnoson/kirby-form-builder as its replacement. That makes this release unsuitable for a new dependency despite the source project remaining active.

Repo commit activitycaution

There were no commits and no active maintainers in the repository during the last 3 months. The recent release limits the concern, but the lack of current commit activity weakens maintenance confidence.

Security policycaution

The linked repository has no security policy. This is a transparency gap for a form-handling package, though it is secondary to the package being abandoned and does not itself establish unsafe code.

Workflow auditcaution

Both workflows were analyzed successfully, with no untrusted checkouts or script injection. However, all 4 action references are unpinned and the audit found a high-severity but low-confidence cache-poisoning pattern plus a high-confidence adhoc package install, so workflow hygiene is below ideal.