astrotomic/laravel-webmentions

Maintainerscaution

Only one registry account has publish access, but the repository is organization-owned, which provides some backing beyond the registry access list.

Release historycaution

The package has seven releases since February 2021 and a release in August 2026, showing ongoing publication, though the median interval of about 321 days is slow.

Repo bus factorcaution

All 11 recent commits came from one contributor, creating concentration risk; organization ownership partly reduces the risk because maintenance can potentially be handed off.

Repo toolingcaution

Composer build tooling is present, but no security scanning tools were detected, leaving a modest maintenance and assurance gap.

Workflow auditcaution

The only workflow was fully analyzed with no untrusted checkout, injection, or high-severity findings. However, both action references are unpinned, which weakens build reproducibility; missing top-level permissions is not a concern on its own.