shawnveltman/laravel-minifier

Workflow auditdanger

The audit found a high-confidence, high-severity bot-condition issue in the Dependabot auto-merge workflow, and all 12 analyzed action references are unpinned. Three workflows also grant top-level write permissions, increasing workflow supply-chain exposure.

Lifecycle scriptscaution

The package declares a post-autoload-dump install-time script. Composer lifecycle scripts deserve attention because they execute during installation, although this signal alone does not show that the script is unsafe.

Project backingcaution

The registry namespace and repository are owned by the same individual account, so the package has identifiable ownership but no organization backing shown by this signal. This provides limited continuity assurance.

Release historycaution

The package has had no release in about two years: its latest release was April 4, 2024, with zero releases in the last 12 months. This is strong evidence of reduced maintenance for a package still presented as a stable release.

Repo commit activitycaution

There were zero commits and zero active maintainers in the last three months. Combined with no registry releases in the last year, this indicates materially reduced maintenance capacity.