codeigniter4/settings

Lifecycle scriptscaution

A post-update-cmd lifecycle script runs during Composer updates, adding install-time behavior that deserves caution even though no more severe behavior is shown.

Repo bus factorcaution

One contributor made all commits in the last three months. Organization backing provides some handoff capacity, but no second recently active contributor is shown.

Repo commit activitycaution

Only one commit was recorded in the last three months, which indicates limited recent maintenance despite the recent release.

Workflow auditcaution

All 11 action references are unpinned, and the docs workflow has four high-confidence template-injection findings plus top-level write permissions. No untrusted checkout or script-injection trigger was found, so this is a serious hygiene concern rather than an automatic severe risk.