aenzenith/laravel-dev-mesh

Maintainerscaution

Only one account has registry publish access, which creates a thin publishing base. The matching user-owned repository and visible project tooling provide some compensation, but long-term bus-factor risk remains.

Project backingcaution

The registry namespace and repository owner match, and the repository is user-owned rather than organization-owned. This supports package identity but does not provide organizational backing or redundancy.

Release historycaution

This is a very new package with only two releases, published within about one hour. The rapid initial releases show active launch activity, but there is not enough history to establish dependable maintenance.

Repo commit activitycaution

There are no commits recorded in the last three months and no active maintainers in that window. The recent repository push and two merged pull requests partly offset this because the project appears newly created, but sustained maintenance is unproven.

Token permissionscaution

One read-only workflow is present, while the release workflow has top-level write permissions. Write access is understandable for publishing releases but broadens automation privileges and warrants review.