bernskiold/laravel-record-merge

Dangerous workflowscaution

One of five workflows uses pull_request_target for Dependabot auto-merge, which warrants review because that workflow class can run with elevated repository context; no untrusted checkouts or script injections were detected.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers over the last three months. Although a release was published recently, the lack of current development activity raises maintenance risk.

Repo issue activitycaution

Two issues were opened in the last month and none were closed, indicating some user activity but also unresolved maintenance work.

Token permissionscaution

Four workflows omit top-level token permissions and one workflow grants top-level write access. This is weaker workflow hardening than least-privilege configuration and increases repository automation exposure.

Version stabilitycaution

Version 0.2.1 is not a prerelease, but the 0.x major version indicates the public API may still change and the package is not yet mature.