clevyr/laravel-twilio-channel

Release historycaution

The package has six releases since August 2022, but none in roughly 20 months, which is a meaningful maintenance concern for a dependency.

Repo commit activitycaution

The repository recorded no commits and no active maintainers in the last three months, weakening evidence of current maintenance.

Repo issue activitycaution

There were no new or closed issues or merged pull requests in the last month, although two pull requests remain open; this supports the concern about limited recent activity.

Security policycaution

The repository has no security policy, leaving vulnerability-reporting expectations undocumented; this is a transparency gap but not a severe dependency risk by itself.

Workflow auditcaution

All 12 analyzed action references are unpinned, and the audit found a high-confidence bot-conditions issue in the Dependabot auto-merge workflow. The pull_request_target trigger has no untrusted checkout or script-injection sink, so this remains a hygiene concern rather than a severe risk.