tomatophp/filament-translations

Dangerous workflowscaution

One workflow uses pull_request_target for Dependabot auto-merge, but no untrusted checkouts or script-injection patterns were detected; the isolated use is a workflow risk worth noting rather than a severe package-health issue.

Dependency profilecaution

Eight runtime dependencies, including Filament, Laravel-related components, a translation loader, and Excel, create a meaningful compatibility surface but are expected for this feature-rich plugin.

Release historycaution

The package has 38 releases over about 3 years, but only one release in the last 12 months; this indicates established history with recently slower publishing.

Repo commit activitycaution

No commits and no active maintainers were recorded during the last three months. Although recent releases, pushes, and merged pull requests provide some compensation, the absence of direct commit activity is a meaningful maintenance concern.

Token permissionscaution

Two workflows declare write permissions and one tests workflow lacks top-level permissions, which is weaker permission hygiene than least-privilege defaults, though no direct exploit pattern was observed.