c6digital/laravel-orderable

Release historycaution

Only two releases have been published over about 2.5 years, with one release in the last 12 months and a median interval of about 23 months, indicating slow maintenance.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers during the last three months, which weakens evidence of ongoing maintenance despite the recent push timestamp.

Security policycaution

The repository has no security policy, leaving vulnerability-reporting expectations undocumented and creating a modest transparency gap.

Workflow auditcaution

All five workflows were analyzed, but all 12 action references are unpinned, three workflows grant top-level write permissions, and a high-confidence bot-conditions finding affects the Dependabot auto-merge workflow. The pull_request_target trigger has no untrusted checkout or script-injection sink, so this is a hygiene concern rather than a severe workflow risk.