bernskiold/laravel-currency-converter

Release historycaution

This is a young package, 107 days old, with only one release and no established release cadence. That limits evidence of long-term maintenance but does not indicate abandonment by itself.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months, which is a meaningful maintenance concern for a package with only one release.

Workflow auditcaution

All 11 action references are unpinned, and the audit found a high-confidence bot-condition issue in the Dependabot auto-merge workflow. The pull_request_target trigger has no untrusted checkout or script-injection sink, so this is a hygiene concern rather than a severe workflow risk.