zephir/luya

Registry deprecationdanger

Packagist marks the package as abandoned at package scope and names luyadev/luya-core as its replacement. This is a direct adoption warning even though the linked project itself is not archived.

Repo commit activitydanger

The linked repository recorded 0 commits and 0 active maintainers in the last 3 months. A repository push in November 2025 and the non-archived status provide some context, but do not show ongoing maintenance of this release line.

Release historycaution

The package has 61 releases since April 2016, but its latest registry release was 7 February 2024 and it had no releases in the last 12 months. The long historical cadence does not compensate for the current registry inactivity.

Repo toolingcaution

The project uses Composer build tooling, but no security-scanning tools were detected. This is a modest transparency and maintenance gap, not evidence that the package is unsafe by itself.

Workflow auditcaution

All workflows were analyzed successfully with no reported findings, dangerous trigger sinks, or broad top-level write permissions. However, all 10 action references are unpinned, which is a supply-chain hygiene weakness.