bear/defer

Lifecycle scriptscaution

The package runs post-install and post-update Composer scripts, adding installation-time behavior that deserves scrutiny beyond a package with no lifecycle scripts.

Release historycaution

This is a young package, 88 days old, with only one release and no established release cadence, so its maintenance maturity is not yet demonstrated.

Security policycaution

The repository has no security policy, leaving vulnerability reporting and response expectations undocumented.

Version stabilitycaution

Version 0.1.0 is not a stable major release, which signals an early API and maintenance stage despite it not being marked prerelease.

Workflow auditcaution

All four workflows were analyzed without trigger or injection findings, but all 20 action references are unpinned, which weakens build reproducibility and supply-chain control.