nova-kit/nova-on-vapor

Lifecycle scriptscaution

A post-autoload-dump install-time script runs during Composer installation, adding operational complexity that consumers should understand before adoption.

Release historycaution

The package has 10 releases since July 2022, but none in the last 12 months, making registry maintenance look stalled despite its established history.

Repo commit activitycaution

No commits or active maintainers were recorded in the last three months, which weakens evidence of ongoing maintenance despite the recent repository push.

Security policycaution

The repository has no security policy, leaving vulnerability reporting and response expectations undocumented.

Workflow auditcaution

All three workflows were analyzed successfully with no high-confidence audit findings or untrusted checkout sinks, but all 15 action references are unpinned, reducing build reproducibility and update control.