graycore/magento2-graph-ql-cache

Lifecycle scriptscaution

Post-install and post-update Composer scripts execute during dependency operations, adding operational complexity and a larger installation surface than a package without lifecycle hooks.

Repo bus factorcaution

One contributor made all eight commits in the last three months, creating a concentrated maintenance dependency even though the repository is organization-owned.

Security policycaution

No repository security policy was found, leaving vulnerability reporting guidance undocumented; this is a transparency gap rather than evidence of unsafe code.

Version stabilitycaution

Version 0.0.5 is not a prerelease, but the package remains below a stable 1.0 major version, so its public API may still change.

Workflow auditcaution

All three workflows were analyzed without findings, and no untrusted checkout or script injection was detected. However, all three action references are unpinned, weakening build reproducibility and supply-chain control.