giacomomasseron/filament-async-column

Dangerous workflowscaution

One of six workflows uses pull_request_target for Dependabot auto-merge, which warrants review because that trigger can carry elevated workflow risk. No untrusted checkout or script-injection findings were detected.

Release historycaution

The package is young at 44 days, with three releases and a median interval of about 22 days. That limits evidence of long-term stability, but the recent release cadence is active rather than stalled.

Repo bus factorcaution

Two contributors were active, but the leading contributor made about 76% of recent commits. This is a modest concentration risk, partially offset by the second contributor's 13 commits.

Repo popularitycaution

The repository has only five stars and no forks or watchers, so there is little community adoption evidence. Popularity is supporting evidence, however, and does not outweigh the active maintenance signals.

Token permissionscaution

Three workflows lack top-level token permissions and three declare write access, while none declare read-only permissions. This is a workflow-hardening gap, though it does not by itself indicate package abandonment.