slashequip/laravel-patchable

Dangerous workflowscaution

One workflow uses pull_request_target for Dependabot auto-merge. No untrusted checkout or script-injection pattern was detected, so this is a workflow caution rather than a severe health risk.

Lifecycle scriptscaution

The package runs a post-autoload-dump install-time script, which adds some installation complexity and trust exposure, though this alone is not evidence that the package is unsafe to depend on.

Maintainerscaution

Only one registry publishing account is listed, creating a narrow operational base if that maintainer becomes unavailable. The linked repository is user-owned rather than organization-owned, so there is no organization backing shown to offset this concern.

Project backingcaution

The registry namespace and repository owner match, but the owner is an individual user rather than an organization, so the evidence shows direct ownership without broader institutional backing.

Release historycaution

Only one release has been published, and it was approximately 17 months before collection, leaving little evidence of sustained release maintenance.