larva/laravel-octane

Lifecycle scriptscaution

The package runs a post-autoload-dump install-time script. A lifecycle script adds execution during installation, so it is a supply-chain hygiene concern, although this signal does not show that the script is unsafe.

Repo commit activitycaution

The repository recorded 0 commits and 0 active maintainers in the last three months. That is a meaningful maintenance concern, though 8 registry releases in the last 12 months provide partial compensating evidence.

Repo issue activitycaution

No new issues or pull requests were recorded in the last month, and there were no merged pull requests. This is a weak maintenance signal, but it is less concerning alongside the continuing release history.

Repo toolingcaution

Composer is used for builds, but no security scanning tools were detected. The missing scanning is a hygiene gap rather than evidence of abandonment, especially with a repository security policy present.

Workflow auditcaution

All 5 workflows were analyzed without audit findings or untrusted-checkout and script-injection sinks. However, all 6 analyzed action uses are unpinned and 2 workflows grant top-level write permissions, creating moderate workflow hygiene concerns.