tvdijen/simplesamlphp-module-cmdotcom

Registry deprecationdanger

Packagist marks the entire package as abandoned, with no replacement specified. This is a direct warning against taking a new dependency on the package.

Repository archiveddanger

The linked repository is archived, so its source is no longer actively maintained; it was last pushed over two years ago. This makes fixes and compatibility updates unlikely.

Release historycaution

The package has had no release in over three years, despite 13 releases since February 2022. That inactivity reinforces the abandonment evidence from the archived repository.

Security policycaution

The repository has no security policy, leaving the process for reporting and handling vulnerabilities undocumented. Existing security scanning helps, but does not replace a disclosure process.

Workflow auditcaution

All 23 analyzed action references are unpinned, creating avoidable build reproducibility and dependency-substitution risk. The audit found no untrusted checkouts, script injection, or high-severity findings, which limits the impact to caution.