rectitude-open/filament-photos

Lifecycle scriptscaution

The package uses a post-autoload-dump lifecycle script, which adds install-time execution surface and warrants some caution even though this is a conventional Composer hook.

Release historycaution

The package has had no release for about 13 months despite 16 releases in its first month, which is a meaningful maintenance concern for a young package.

Repo commit activitycaution

There were no commits and no active maintainers in the last three months, weakening the evidence of ongoing maintenance even though the repository is not archived.

Workflow auditcaution

All four workflows were analyzed, but every one of seven action references is unpinned and a high-confidence bot-condition finding affects the Dependabot auto-merge workflow. The pull_request_target trigger is not itself a problem because no untrusted checkout or script injection was found.