byjg/resttemplate

Registry deprecationdanger

Packagist marks the entire package as abandoned and names byjg/rest-reference-architecture as its replacement. This is a direct warning against taking a new dependency on this package.

Repo package mentiondanger

The linked repository is php-gluo, does not match the package name, and does not mention the package in its README. That weakens source provenance and makes the repository's maintenance evidence unreliable for this release.

Repo bus factorcaution

All 44 commits in the last 3 months came from one contributor, leaving no demonstrated contributor redundancy. The repository owner is an individual rather than an organization, so there is no provided backing evidence to offset this concentration.

Workflow auditcaution

All three workflows were analyzed without untrusted checkouts or script injection. All 14 action references are unpinned, and the low-confidence cache-poisoning finding is hygiene-level rather than a standalone severe risk.