hybridgram/tgbot-laravel

Lifecycle scriptscaution

A post-autoload-dump install script is present. This is a limited supply-chain consideration, but the signal does not show that the script performs a dangerous action.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months. For a package released only months earlier, that is a meaningful maintenance warning.

Security policycaution

No security policy is present. This weakens vulnerability-reporting transparency, though it is a hygiene gap rather than evidence of abandonment on its own.

Version stabilitycaution

Version 0.2.0 is not a stable-major release, although it is not marked prerelease. Consumers should expect a less mature compatibility surface.

Workflow auditcaution

All four workflows were analyzed, but two high-confidence template-injection findings and two script-injection counts require workflow review; 9 of 10 action references are unpinned. No untrusted checkout or write-token trigger was reported, so these remain hygiene and reproducibility concerns rather than an independent severe verdict.