indexzer0/eloquent-filtering

Lifecycle scriptscaution

A post-autoload-dump install-time script is configured. This is a modest supply-chain and installation-complexity concern, although only one script is reported and its behavior is not shown here.

Maintainerscaution

One registry maintainer is listed, and the repository is owned by the corresponding individual account. This creates a thin maintainer base and limited visible succession capacity.

Repo commit activitycaution

There were 0 commits and 0 active maintainers in the last 3 months. That is a meaningful maintenance warning despite the recent release and repository push evidence.

Security policycaution

The repository has no security policy. This weakens vulnerability-reporting transparency, though it does not by itself show abandonment.

Workflow auditcaution

All 10 analyzed action uses are unpinned, two workflows grant top-level write access, and a high-confidence bot-conditions finding affects the Dependabot auto-merge workflow. The pull_request_target trigger has no untrusted checkout or script-injection sink, so this is workflow weakness rather than a severe standalone risk.