dominik-eller/laravel-qr-code

Maintainerscaution

Only one registry maintainer is listed, and project backing identifies a single individual rather than an organization. That leaves a thin publishing and succession base.

Release historycaution

The package has four releases over about two years, with one release in the last 12 months and a median interval of about five months. This is a slower cadence but not evidence of abandonment by itself.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months. Although it was pushed recently, the current short-term activity is weak and raises maintenance concerns.

Security policycaution

No security policy is present in the repository. This is a transparency gap, though it is less significant for a small QR-code utility than for security-sensitive infrastructure.

Workflow auditcaution

All 12 analyzed action references are unpinned, three workflows grant top-level write access, and a high-confidence bot-conditions finding affects the Dependabot auto-merge workflow. The pull_request_target trigger has no untrusted checkout or script-injection sink, so these are workflow hygiene and resilience concerns rather than an automatic severe risk.