bartlett/php-compatinfo-db

Lifecycle scriptscaution

The package runs a post-autoload-dump script during installation. This is not inherently unsafe, but it adds installation behavior that consumers should understand.

Repo commit activitycaution

The repository recorded 0 commits and 0 active maintainers in the last 3 months, despite the latest registry release being about 4 months ago. This is a meaningful maintenance warning, though the long release history provides some compensation.

Repo toolingcaution

Composer and Box provide build tooling, but no security-scanning tool was detected. That is a modest transparency and maintenance gap, not evidence that the package is unsafe.

Security policycaution

The repository has no security policy. Consumers have less guidance for reporting vulnerabilities or understanding the project's security process.

Workflow auditcaution

All 23 analyzed action references are unpinned, and two release-related workflows have high-confidence template-injection findings; a low-confidence cache-poisoning finding was also reported. The audit was complete, but these workflow weaknesses reduce build transparency and reproducibility.