skyscanner/jsonpath

Registry deprecationdanger

Packagist marks the entire package as abandoned and points to galbar/jsonpath as the replacement. Package-level deprecation is a serious adoption risk even though other project evidence is positive.

Release historycaution

The package has 16 releases since September 2015, but its latest registry release was on March 5, 2023, with no releases in the last 12 months. This indicates materially stale publishing activity.

Repo commit activitycaution

The repository recorded no commits and no active maintainers in the last three months. This weakens the evidence of ongoing maintenance, although the repository was pushed more recently than the latest package release.

Security policycaution

The linked repository has no security policy. For a maintained library this is a transparency gap, though it is less severe than the package's registry deprecation and stale release activity.

Workflow auditcaution

The single workflow was fully analyzed, uses read-only permissions, and has no untrusted checkout or script-injection findings. However, all 3 of 3 action references are unpinned, leaving a moderate reproducibility and dependency-hygiene concern.