tomatophp/filament-invoices

Dangerous workflowscaution

One workflow uses pull_request_target for Dependabot auto-merge. No untrusted checkout or script-injection patterns were detected, but this workflow type warrants review because it can operate with elevated repository context.

Release historycaution

The package has existed for about two years, with nine releases and two releases in the last 12 months; this indicates ongoing publication but a relatively modest recent cadence.

Repo commit activitycaution

The repository records zero commits and zero active maintainers in the last three months despite a recent push and release, leaving a meaningful concern about sustained maintenance capacity.

Token permissionscaution

Two of three workflows declare top-level write permissions, and one workflow lacks top-level permissions entirely. This is broader automation privilege than ideal and increases repository-maintenance risk.