mikespub/react-http-middleware-session

Lifecycle scriptscaution

The package runs post-install and post-update Composer scripts, adding install-time execution that consumers must account for.

Release historycaution

The package is only 94 days old, despite 10 releases in that period; this shows active delivery but provides limited evidence of long-term maintenance.

Repo toolingcaution

The project uses Composer and Make, but no security scanning tools were detected, leaving a modest security-process gap.

Security policycaution

The repository has no security policy, reducing transparency for reporting and handling vulnerabilities.

Workflow auditcaution

Both workflows grant top-level write permissions and both action references are unpinned. The audit found no untrusted checkout, script injection, or other concrete workflow findings, so this is a hygiene caution rather than a severe risk.