austintoddj/canvas

Dependency profilecaution

The package has 19 runtime dependencies, which is substantial for a Laravel publishing platform but consistent with its broad framework and feature surface.

Lifecycle scriptscaution

A post-autoload-dump install-time script runs during Composer installation, adding execution surface beyond ordinary dependency loading.

Project backingcaution

The package and repository are owned by the same individual account, so the project has direct ownership alignment but no organization-level maintenance backing.

Repo bus factorcaution

Recent activity is highly concentrated: the top contributor made 103 of 106 commits, or about 97%, leaving limited demonstrated redundancy.

Workflow auditcaution

The only workflow was fully analyzed, uses read-only permissions, and has no reported audit findings; however, all 25 action references are unpinned, which weakens build reproducibility and supply-chain hygiene.