envor/laravel-datastore

Release historycaution

The package has 24 releases, but its latest registry release was in December 2024 and there were no releases in the following 12 months, indicating a meaningful maintenance pause.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months. A recent repository push provides some context, but does not offset the lack of recent commit activity.

Security policycaution

The repository has no published security policy, leaving vulnerability-reporting and response expectations undocumented. This is a transparency gap, though the project does use Dependabot scanning.

Workflow auditcaution

All 12 analyzed action references are unpinned, and the high-confidence bot-conditions finding in the Dependabot auto-merge workflow warrants workflow hygiene attention. The pull_request_target trigger has no untrusted checkout or script-injection sink, limiting the risk.