dunglas/json-ld-api-bundle

Registry deprecationdanger

Packagist marks the entire package abandoned and names dunglas/api-bundle as its replacement. This is a substantial adoption and maintenance risk despite the current release activity.

Repo package mentioncaution

The linked repository name does not match this package and its README does not mention the package. Although a monorepo can legitimately contain subpackages, this leaves uncertainty about the exact package-to-source relationship.

Workflow auditcaution

All five workflows were analyzed, but the audit found a high-confidence template-injection issue, archived actions, and ad hoc package installs; one workflow also grants top-level write permissions. The pull_request_target trigger has no untrusted checkout or script-injection sink, so these are hygiene and supply-chain concerns rather than a standalone critical verdict.