Package Health/connorhowell/laravel-git-version

connorhowell/laravel-git-version

Its documentation, licensing, release notes, and repository match are reassuring. The small project has little adoption, no recent commit activity, and workflow safeguards need attention, so pinning this release carries meaningful maintenance risk.

Latest v1.0.1

Packagist

47%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Workflow audit

The audit found a high-confidence, high-severity bot-condition issue, all 12 action references are unpinned, and three workflows grant top-level write access. There is no untrusted checkout or script injection, but the automation still has materially weak safeguards.

Lifecycle scripts

The package uses a post-autoload-dump install-time script. That is a meaningful execution surface for consumers, although this signal does not show that the script is unsafe.

Maintainers

One registry maintainer is responsible for publishing the package, leaving limited publishing capacity. The repository is user-owned, so the short maintainer list is less easily explained by organization backing.

Project backing

The package and repository are both owned by the same individual account, with no organization backing shown. This is consistent and transparent, but it confirms reliance on a single project owner.

Release history

Only two releases were published, both about 455 days ago, with no releases in the last 12 months. This leaves the package's ongoing maintenance uncertain despite its stable v1.0.1 version.