bolt/core

Dependency profilecaution

The package declares 82 runtime dependencies, creating substantial transitive maintenance and upgrade exposure for adopters.

Lifecycle scriptscaution

post-install-cmd and post-update-cmd run during Composer operations, adding execution during installation and updates. This is a genuine supply-chain hygiene concern for a dependency with a large runtime footprint.

Repo toolingcaution

The project uses Composer and Make, but no security-scanning tool was detected. That is a modest transparency and hygiene gap rather than evidence of abandonment.

Version stabilitycaution

This release is a beta while the latest version is a stable 6.1.8, so the assessed target is less settled than the current stable line.

Workflow auditcaution

All 43 action references are unpinned, which weakens build reproducibility and supply-chain control. The audit also found high-confidence template-injection patterns in the release workflow, but no untrusted checkout or script-injection trigger was reported, so those findings remain hygiene concerns rather than standalone severe risk.