cleaniquecoders/laravel-expiry

Release historycaution

The package is about two and a half years old with nine releases, but only one release in the last 12 months. The recent 2.3.0 release provides some evidence of ongoing maintenance, so this is a moderate concern rather than abandonment.

Repo commit activitycaution

The repository recorded no commits and no active maintainers in the last three months. Although a recent release exists, the current lack of development activity weakens confidence in continued maintenance.

Security policycaution

The linked repository has no security policy. This reduces disclosure transparency, though it is partly offset by the presence of Dependabot and active project tooling.

Workflow auditcaution

All 12 analyzed action references are unpinned, and the audit found a high-confidence bot-condition issue in the Dependabot auto-merge workflow. The pull-request trigger has no untrusted checkout or script-injection sink, so this is workflow hygiene risk rather than a severe release risk.