creativecrafts/laravel-openid-connect

Dangerous workflowscaution

One of six workflows uses pull_request_target, which can be risky when handling untrusted pull requests. No untrusted checkout or script injection was detected, so this is a workflow-hardening concern rather than a severe finding on its own.

Lifecycle scriptscaution

The package runs a post-autoload-dump install-time script. This deserves review because dependency installation executes package-controlled behavior, although the signal does not show a destructive or otherwise dangerous action.

Release historycaution

There have been 10 releases since October 2024, but none in the 12 months before collection; the latest release was over a year ago. This indicates a meaningful maintenance slowdown despite the previously regular short release intervals.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the three months before collection. This is a concrete abandonment or delayed-maintenance concern, partially offset by the more recent repository push.

Repo issue activitycaution

There are no open issues, but three pull requests remain open and none were merged in the last month. The small backlog does not demonstrate active review or release work.