cashbox/tinkoff-auth

Registry deprecationdanger

Packagist marks the entire package as abandoned, with no replacement package specified. This is a direct warning against taking a new dependency on the release.

Release historydanger

The package has 20 releases, but its latest release was about 3 years and 2 months before collection and it had no releases in the preceding 12 months. That strongly indicates abandonment despite its earlier release activity.

Repo commit activitydanger

The repository had no commits and no active maintainers in the last 3 months. This confirms that the abandonment concern is reflected in actual project activity, not just registry metadata.

Repository archiveddanger

The linked repository is archived, so it is no longer maintained through the normal source workflow. Its last push was about 2 years and 10 months before collection, leaving little prospect of fixes or compatibility updates.

Workflow auditcaution

The single workflow has no untrusted checkout or script-injection findings, but it uses a top-level write token and its one action reference is unpinned. These are hygiene concerns, not the main reason to reject the release.