rikudou/unleash-sdk

Registry deprecationdanger

Packagist marks the entire package as abandoned and names unleash/client as its replacement. This is a direct warning against taking a new dependency on this package.

Release historydanger

The package has had no releases in the last 12 months, and its last release was about five years ago. That strongly indicates the release line is no longer maintained.

Repo commit activitydanger

The repository recorded zero commits and zero active maintainers in the last three months, consistent with the long release gap and leaving little evidence of ongoing maintenance.

Security policycaution

The repository has no published security policy. This is a transparency gap, especially for a package that handles feature-flag client behavior, though it is secondary to the abandonment evidence.

Workflow auditcaution

All 20 analyzed GitHub Actions references are unpinned, which weakens build reproducibility. The audit found no untrusted checkouts, injection sinks, high-confidence findings, or wide top-level write permissions, so this is a hygiene caution rather than a severe workflow risk.