hpbxxtr/composer-upgrade-interactive

Project backingcaution

The registry and repository are owned by the same individual account, so the single-maintainer concentration is not offset by organizational backing.

Repo bus factorcaution

One contributor made all six commits in the last three months, leaving no demonstrated handoff capacity and increasing abandonment risk if that maintainer becomes unavailable.

Security policycaution

The repository has no security policy, a transparency gap for a package that performs dependency upgrades, though automated security scanning partly compensates.

Version stabilitycaution

Version 0.4.1 is not a stable-major release, but it is a normal release rather than a prerelease and recent releases contain no prereleases.

Workflow auditcaution

All 15 action references are unpinned, and a high-confidence audit found an unpinned container image; the separate low-confidence cache-poisoning finding is only a hygiene concern. Three workflows also grant top-level write permissions, without untrusted checkout or script-injection paths.