flickphp/migrate

Release historycaution

The package is only 30 days old with two releases, so its maintenance record is still short. The roughly 1.7-day median release interval shows an active initial development phase but not long-term stability.

Repo bus factorcaution

All 15 recent commits came from one contributor, creating concentration risk. Organization backing provides some handoff capacity, but no second active contributor is shown.

Repo toolingcaution

Composer build tooling is present, but no security scanning tools were detected, leaving a modest transparency and defense-in-depth gap.

Workflow auditcaution

All four workflows were analyzed with no untrusted checkout or script-injection findings, but all eight action references are unpinned. The high-confidence bot-conditions finding and one workflow with top-level write permissions add workflow hygiene risk; the pull_request_target trigger has no reported untrusted sink.