hardimpactdev/librarian

Workflow auditdanger

All 14 analyzed action references are unpinned, and the audit found a high-confidence bot-conditions issue in the Dependabot auto-merge workflow. Three workflows also grant top-level write access, increasing CI hygiene and supply-chain risk.

Lifecycle scriptscaution

A post-autoload-dump script runs during installation, adding execution at install time; this is a manageable caution for a Composer package rather than a severe concern.

Release historycaution

The package is 129 days old with three releases, including one released recently; this shows early activity but not yet a mature history.

Repo commit activitycaution

There were no commits and no active maintainers in the last three months, which is a meaningful maintenance concern despite the recent release.

Repo popularitycaution

The repository has zero stars, forks, and watchers. Popularity is only supporting evidence, but these counts provide no external maturity signal for this young package.