pocketmine/bedrock-item-upgrade-schema

Registry deprecationdanger

Packagist marks the entire package as abandoned, with no replacement specified. This outweighs the repository's recent activity and makes depending on this release a serious liability.

Repo commit activitycaution

There were no commits and no active maintainers in the preceding 3 months. The very recent push and release history provide some compensation, but this still indicates limited recent development activity.

Repo package mentioncaution

The repository name does not match the package name and its README does not mention the package. Although this can occur with organizational repositories, the lack of an explicit package reference weakens source-to-artifact transparency.

Workflow auditcaution

The single workflow was fully analyzed and has no untrusted checkouts or script injection, but both action references are unpinned and it installs a package outside a lockfile. The low-confidence audit finding is hygiene risk rather than a severe workflow threat.