mis3085/turso-laravel

Lifecycle scriptscaution

A post-autoload-dump lifecycle script is present. This is a normal Composer integration point, but it adds install-time behavior that deserves ordinary review.

Release historycaution

The package is only 29 days old with two releases and a median interval of about 30 days, so its maintenance record is still limited rather than established.

Repo bus factorcaution

One contributor made all five recent commits, concentrating maintenance knowledge and increasing continuity risk for a user-owned project.

Repo commit activitycaution

Five commits occurred in the last three months, showing recent activity, but the volume is modest and comes from only one active maintainer.

Workflow auditcaution

All six workflows were analyzed, but all 14 action references are unpinned, and a high-confidence bot-conditions finding affects the Dependabot auto-merge workflow. The pull_request_target trigger has no untrusted checkout or script-injection sink, so this is workflow hygiene risk rather than a severe standalone concern.