tomatophp/filament-wave

Dependency profilecaution

The package declares 25 runtime dependencies, including several application-level integrations, which increases upgrade and compatibility risk compared with a narrowly scoped library.

Release historycaution

Only two releases were published, with no releases in the last 12 months. That is a meaningful sign of limited ongoing maintenance for a package released about 18 months ago.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months, despite not being archived. This weakens confidence that defects and compatibility changes will be addressed promptly.

Repo issue activitycaution

There are four open pull requests but no new or merged pull requests in the last month, suggesting pending work without recent resolution.

Workflow auditcaution

All seven action references are unpinned, two workflows grant top-level write permissions, and a high-confidence bot-conditions finding flags spoofable actor checks in the Dependabot auto-merge workflow. The pull_request_target trigger has no untrusted checkout or script-injection sink, so these are workflow hygiene and supply-chain concerns rather than a standalone critical verdict.