Package Health/asseco-voice/laravel-attachments

asseco-voice/laravel-attachments

The small repository has had no commits in the last three months, and it lacks a security policy or scanning tools. Regular releases, an organization-backed repository, tests, clear licensing, and a matching source tree provide useful safeguards; workflow action pinning remains weak.

Latest v2.17.2

Packagist

68%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Repo commit activity

There were zero commits and zero active maintainers in the last three months. This is a meaningful maintenance concern, although the recent push and continuing registry releases partly offset abandonment risk.

Repo issue activity

There are no new or closed issues in the last month and no merged pull requests, while three pull requests remain open; this supports the recent maintenance slowdown but is not severe on its own.

Repo tooling

Composer build tooling is present, but no security scanning tools were detected. For a package handling uploaded attachments, that is a genuine repository hygiene gap.

Security policy

The repository has no security policy. This weakens transparency for reporting and handling vulnerabilities, though it does not by itself show that the release is unsafe.

Workflow audit

Both workflows were analyzed without high-confidence findings, dangerous triggers, or untrusted checkouts, and neither grants top-level write access. However, all 6 action references are unpinned, leaving a supply-chain hygiene gap.