pollsockets/pollsockets-laravel

Lifecycle scriptscaution

The package runs a post-autoload-dump Composer lifecycle script during installation. Install-time execution adds some supply-chain exposure, but this single script is not evidence of unsafe behavior by itself.

Release historycaution

The package has only 4 releases over about 3.5 years, with 1 release in the last 12 months and a median interval of about 10 months. This indicates a slow maintenance cadence, though the May 2026 release shows the project is not abandoned.

Repo commit activitycaution

The repository recorded 0 commits and 0 active maintainers in the last 3 months. With only one recent release, this is evidence of limited current maintenance capacity.

Security policycaution

The repository has no security policy. This is a transparency and vulnerability-reporting gap, although the project does use Dependabot for dependency scanning.

Workflow auditcaution

All 12 analyzed action references are unpinned, and a high-confidence bot-conditions finding affects the pull-request-target Dependabot auto-merge workflow. No untrusted checkout or script-injection sink was found, but the automation still warrants caution.