iamgerwin/filament-flexible-content

Release historycaution

Only two releases were published, both within a single day, despite the package being about 363 days old. This limited history provides little evidence of an established release cadence.

Repo commit activitycaution

The repository recorded no commits and no active maintainers in the last three months, which is a meaningful maintenance concern for a relatively new package.

Security policycaution

The repository has no security policy, leaving vulnerability reporting and response expectations undocumented. Dependabot provides some compensating security tooling but does not replace a policy.

Workflow auditcaution

All 16 analyzed action references are unpinned, and the audit found a high-confidence bot-condition issue in the Dependabot auto-merge workflow. The pull_request_target trigger has no untrusted checkout or script-injection sink, so this is a hygiene concern rather than a severe workflow risk.