Package Health/aliasproject/laravel-echo-api-gateway

aliasproject/laravel-echo-api-gateway

Unpinned workflow actions and a high-confidence template-injection finding add release risk. The package has tests and an MIT license, but its README says it is not maintained and recommends an alternative.

Latest v0.5.0

Packagist

32%

Total Score

Maintainer Stability

Maturity

Supply Chain

Health Score Breakdown

Release history

The latest registry release was in August 2024, with no releases in the last 12 months, indicating the package is no longer receiving regular release maintenance.

Repo commit activity

The repository recorded zero commits and zero active maintainers in the last three months, consistent with the README's explicit statement that the project is not maintained.

Workflow audit

All 13 analyzed action references are unpinned, and the release workflow has a high-confidence template-injection finding. The low-confidence cache-poisoning finding is only a hygiene concern, while trusted publishing is reported but not a severe issue by itself.

Security policy

The repository has no security policy, leaving vulnerability-reporting guidance unclear; this adds a transparency gap alongside the stronger maintenance concerns.

Version stability

This is a pre-1.0 release and the stability profile is not a stable major, so its API and production suitability carry additional uncertainty.

Vulnerabilities

We didn't find any vulnerabilities for this package.

Package versions

Maintainers

Michael Aguiar

Direct Dependencies

Dependency	Last Release	Score
bref/bref Version ^2.1	—	—
aws/aws-sdk-php Version ^3.294	—	—
guzzlehttp/guzzle Version ^6.3\|^7.0	—	—
laravel/framework Version ^8.0\|^9.0\|^10.0	—	—