cloudcreativity/laravel-json-api

Package scaffoldingdanger

The README explicitly calls this package legacy, says not to use it for new projects, and directs users to laravel-json-api/laravel. Repository tests and a changelog provide some compensating transparency, but the package is no longer developed for new features.

Repo commit activitycaution

The repository has 0 commits and 0 active maintainers in the last 3 months. The recent release and stated bug-fix-only maintenance soften this as abandonment evidence, but do not remove the concern for a new dependency.

Repo issue activitycaution

There were no new or closed issues or pull requests in the last month, with 27 open issues and no open pull requests. This supports the picture of limited ongoing development.

Security policycaution

The linked repository has no security policy, leaving vulnerability-reporting and response expectations undocumented. The package's clear license and repository documentation compensate for general transparency but not this security-process gap.

Workflow auditcaution

The single workflow was fully analyzed with no dangerous triggers, sinks, or audit findings, but all 3 action references are unpinned. That is a supply-chain hygiene weakness rather than a severe workflow risk.