jhayiwg/oauth2-server-lumen

Release historydanger

The package has made only two releases, both around its first publication, with no releases in the last 12 months. Its latest release is about 10 years old, which is strong evidence of abandonment risk.

Repo commit activitydanger

The repository recorded zero commits and zero active maintainers over the last three months, consistent with the roughly 10-year gap since its last release. The linked repository is correctly identified, so this inactivity is meaningful.

Licensecaution

Neither the package nor the linked repository declares or contains a recognized license. That leaves developers without clear permission to use, modify, or redistribute the code.

Repo toolingcaution

Composer is used for the build, but no security scanning tools are present. This is a modest hygiene concern and does not by itself establish that the release is unsafe.

Security policycaution

The repository has no security policy. For an old OAuth-related integration package, the absence of a documented vulnerability-reporting path reduces transparency, though it is less significant than the maintenance gap.