smart-dato/dpd-sdk

Lifecycle scriptscaution

The package runs a post-autoload-dump install-time script. This is common Composer behavior, but it adds execution during installation and warrants awareness when adopting the dependency.

Repo bus factorcaution

All recent commits came from one contributor, creating concentrated maintenance risk. Organization ownership provides some handoff capacity but does not demonstrate a second active contributor.

Repo commit activitycaution

Only 1 commit was recorded in the last 3 months, indicating thin recent development activity, although the repository also shows 4 merged pull requests in the last month.

Version stabilitycaution

Version 0.0.8 is not a stable major release, so its API may still change even though it is not marked as a prerelease.

Workflow auditcaution

All 5 workflows were analyzed and all 11 action references are pinned, but a high-confidence bot-conditions finding affects the Dependabot auto-merge workflow; two workflows also grant top-level write permissions.