prestashop/autoupgrade

Lifecycle scriptscaution

The package runs post-install-cmd and post-update-cmd scripts. These scripts can complicate reproducible or restricted installations, although their presence alone does not establish a severe dependency risk.

Security policycaution

No SECURITY.md or equivalent security policy was found. For a project that performs store upgrades and has an active public repository, this is a transparency gap.

Version stabilitycaution

This release is a beta despite being on a stable major line, so it carries more compatibility risk than a stable release. Recent prereleases account for 30% of releases, indicating that beta usage is part of the project's normal process but remains a caveat.

Workflow auditcaution

All 15 workflows were analyzed, but all 72 action references are unpinned and the audit reports high-confidence template-injection findings in publish and upgrade workflows, plus an artipacked finding. The pull_request_target workflow has no untrusted checkout or script-injection finding, so these are workflow-hygiene concerns rather than a standalone severe verdict.