c6digital/filament-og-manager

Lifecycle scriptscaution

The package runs a post-autoload-dump script during installation. This is an extra install-time behavior that deserves review, but the signal alone does not show harmful or unusual activity.

Release historycaution

The package is about 717 days old with only three releases, all clustered within roughly 49 minutes, and has had no release in the last 12 months. This substantially raises maintenance uncertainty, although the repository is not archived.

Repo commit activitycaution

There were zero commits and zero active maintainers in the last three months. Combined with no registry releases in the last year, this is meaningful evidence of slowing or paused maintenance.

Version stabilitycaution

Version v0.1.2 is not a prerelease, but it remains below a stable major version. That signals a less mature API rather than an immediate health problem.

Workflow auditcaution

All five workflows were analyzed, but all 12 action references are unpinned, three workflows grant top-level write permissions, and a high-confidence bot-conditions finding affects the Dependabot auto-merge workflow. The pull_request_target trigger has no untrusted checkout or script-injection sink, so it is not independently dangerous.