honed/chart

Lifecycle scriptscaution

The package runs a post-autoload-dump install-time script. Composer lifecycle execution is not inherently unsafe, but it adds an execution step that deserves review when installing the dependency.

Repo bus factorcaution

All three recent commits came from one contributor. The organization-owned project provides some handoff capacity, but no second recent contributor is shown to reduce dependence on that person.

Repo commit activitycaution

The repository recorded three commits in the last three months, showing recent activity, but the pace is modest for an actively evolving library.

Security policycaution

The repository has no published security policy. This is a transparency gap for reporting and handling vulnerabilities, though it does not by itself show abandonment.

Version stabilitycaution

This is a non-prerelease v0.5.0, which is more stable than an explicitly pre-release version, but the package has not reached a stable major version.