overtrue/laravel-options

Lifecycle scriptscaution

The package runs post-install and post-update Composer scripts. These scripts deserve awareness because they execute during dependency operations, but this signal alone does not show harmful behavior.

Repo bus factorcaution

One contributor made all two commits in the last three months, giving the project a concentrated maintenance base. That increases continuity risk if the maintainer becomes unavailable.

Repo commit activitycaution

The repository had two commits in the last three months, so there is recent activity, but the volume is low. For a small stable package this is acceptable, though it provides limited evidence of sustained maintenance capacity.

Security policycaution

No repository security policy was found. This is a transparency gap for reporting vulnerabilities, though active security scanning provides partial operational compensation.

Workflow auditcaution

The single workflow was fully analyzed, uses read-only permissions, and has no untrusted checkout or script-injection findings. However, all four action references are unpinned, which weakens build reproducibility and supply-chain control.