divineomega/dates-timezone-conversion-trait

Registry deprecationdanger

Packagist marks the entire package as abandoned, with no distinct replacement package provided. This is a direct adoption and future-maintenance warning despite the recent release activity.

Maintainerscaution

Only one registry account has publish access. The matching user-owned repository provides some context, but there is still no observed publishing redundancy.

Repo bus factorcaution

All 3-month commit activity comes from one contributor, with one contributor making 100% of commits. That creates a meaningful continuity risk for a user-owned project.

Security policycaution

The repository has no security policy. For a small package this is a transparency gap rather than evidence of unsafe code, but it reduces clarity about vulnerability reporting and response.

Workflow auditcaution

The single workflow is fully analyzed, uses read-only permissions, and has no detected dangerous sinks or audit findings. However, both action references are unpinned, leaving a modest build-reproducibility and supply-chain hygiene gap.