tomatophp/filament-accounts-auth

Dangerous workflowscaution

One workflow uses pull_request_target for Dependabot auto-merge, which requires care because it runs in a privileged event context; no untrusted checkout or script-injection patterns were detected, limiting the risk.

Dependency profilecaution

The package has 13 runtime dependencies spanning Filament, Laravel, Livewire, authentication, and QR-code functionality; this is a substantial integration surface and adds maintenance exposure, but it is consistent with the package's authentication role.

Release historycaution

Only two releases have appeared across about 17 months, with one release in the last 12 months and a median interval of about 535 days; this indicates limited release cadence despite the recent 5.0.0 publication.

Repo commit activitycaution

The repository shows zero commits and zero active maintainers in the last three months, a meaningful maintenance warning; however, the repository was recently pushed and merged two pull requests in the last month, partly offsetting the concern.

Token permissionscaution

Two workflows declare top-level write permissions and one workflow lacks top-level permissions, which is broader than ideal for CI; this is a repository hygiene concern rather than evidence that the package is unfit on its own.