jaocero/filachat

Lifecycle scriptscaution

The package runs a post-autoload-dump install-time script. This is common in Composer packages but adds installation behavior that consumers should understand before adoption.

Release historycaution

The package is about 2 years old with 10 releases, but it has had no registry release in the last 12 months and its latest release was in December 2024. That prolonged release gap lowers confidence in continued maintenance.

Repo commit activitycaution

There were zero commits and zero active maintainers in the last 3 months. Combined with no registry releases in the last 12 months, this is meaningful evidence of currently inactive maintenance.

Version stabilitycaution

The assessed version is a prerelease, and all recent releases are prereleases. This signals an immature API and greater risk of breaking changes than a stable release.

Workflow auditcaution

All four workflows were analyzed, but all 9 action references are unpinned and three workflows grant top-level write permissions. The audit also found a high-confidence bot-condition issue; although no untrusted checkout or script injection was found, these workflow controls remain a supply-chain hygiene concern.