flow-php/flow

Dangerous workflowscaution

One of 21 workflows uses pull_request_target, which warrants review because that trigger can increase CI exposure. No untrusted checkouts or script-injection patterns were detected, keeping this from being a severe concern.

Dependency profilecaution

The release declares 40 runtime dependencies and 37 development dependencies, creating a relatively broad integration and update surface for consumers. This is a real complexity caveat, but the active project and extensive tooling provide some compensation.

Lifecycle scriptscaution

The package uses post-install, post-update, and pre-autoload-dump scripts. These add install-time behavior that should be reviewed before adoption, although their presence alone does not show that the release is unsafe or unmaintained.

Token permissionscaution

Twelve workflows declare read-only permissions, but eight omit top-level permissions and one declares top-level write access. This is a CI hardening gap, though it is partly offset by the otherwise documented permission configuration.

Version stabilitycaution

Version 0.44.1 is not a stable-major release, so compatibility guarantees may be weaker than for a 1.x package. It is not a prerelease and recent releases show an established development cadence, partly offsetting that concern.