recca0120/laravel-erd

Lifecycle scriptscaution

The package runs a post-autoload-dump install-time script. Composer lifecycle scripts are common for framework packages, but they add installation behavior that consumers should account for.

Repo commit activitycaution

There were zero commits and zero active maintainers in the last three months. The recent release offsets this somewhat, but the lack of ongoing repository activity is a real maintenance concern.

Repo toolingcaution

Composer build tooling is present, but no security scanning tools were detected. For a small PHP package this is a hygiene gap rather than evidence that the release is unsafe.

Security policycaution

The repository has no security policy. This reduces transparency for reporting vulnerabilities, though it does not by itself indicate abandonment.

Workflow auditcaution

The only workflow was fully analyzed with no audit findings or untrusted-input sinks, and it avoids broad top-level write permissions. However, all three referenced actions are unpinned, leaving the workflow exposed to upstream action changes.