daycry/doctrine

Lifecycle scriptscaution

The package declares a post-update Composer lifecycle script. This is a supply-chain-sensitive behavior that deserves review, although the signal alone does not show that the script is unsafe.

Maintainerscaution

Only one registry account, daycry, has publishing access. That creates a thin release bus factor, although the release history shows that this maintainer has continued publishing regularly.

Repo commit activitycaution

There were no commits and no active maintainers in the last 3 months. This is a recent maintenance gap, partly offset by seven registry releases in the last 12 months and a push accompanying the assessed release.

Security policycaution

No repository security policy was found. This is a transparency and vulnerability-reporting gap, but it is not severe enough to make the release unfit on its own.

Workflow auditcaution

All 6 workflows were analyzed with no reported audit findings or untrusted-trigger sinks, but all 21 action references are unpinned and one workflow has top-level write permissions. The broad permissions are limited in concern because no untrusted workflow path was found.