hyperlink/laravel-json-structure

Lifecycle scriptscaution

A post-autoload-dump install-time script is present, so installation performs lifecycle work beyond ordinary file extraction and merits review before use.

Release historycaution

Only two releases were published, with none in the last 12 months; the latest registry release was in January 2023, indicating a long release gap.

Repo commit activitycaution

No commits were recorded in the last three months, which weakens evidence of ongoing maintenance even though recent pull requests were merged.

Security policycaution

The repository has no security policy, leaving vulnerability reporting guidance unspecified; this is a transparency gap for a package intended for application development.

Workflow auditcaution

All nine analyzed action references are unpinned, and a high-confidence bot-conditions finding affects the Dependabot auto-merge workflow. The pull_request_target trigger has no untrusted checkout or script-injection sink, so this is caution rather than a severe risk.