njxqlus/filament-progressbar

Lifecycle scriptscaution

The package uses a post-autoload-dump install-time script. This is a review point for Composer consumers, but the signal alone does not show harmful behavior or unusual installation risk.

Project backingcaution

The package and repository are owned by the same individual account rather than an organization. That is consistent ownership, but it provides a thinner maintenance base than organization backing.

Release historycaution

The package has four releases over about three years, with one release in the last 12 months and a median interval of about 212 days. This indicates a small, deliberate release cadence but limited ongoing delivery.

Repo commit activitycaution

There were no commits and no active maintainers in the three months measured. Combined with only one release in the prior year, this points to limited recent maintenance capacity.

Workflow auditcaution

All five workflows were analyzed, but all 12 action references are unpinned, three workflows grant top-level write permissions, and a high-confidence bot-conditions warning affects the Dependabot auto-merge workflow. The pull_request_target trigger has no untrusted checkout or script-injection sink, so this is workflow hygiene concern rather than a severe standalone risk.