faraztanveer/laravel-chat

Maintainerscaution

One registry account publishes the package, and the repository is owned by the same individual. This is consistent ownership but leaves little maintainer redundancy if that person becomes unavailable.

Release historycaution

Only five releases exist, all concentrated around the initial June 2025 launch, with no releases in the last 12 months. This indicates a young project with limited evidence of ongoing maintenance.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last 3 months. Although it was pushed more recently than the last registry release, the current activity does not demonstrate sustained maintenance.

Security policycaution

The repository has no security policy. That reduces transparency for reporting and handling vulnerabilities in a package that provides application-facing chat functionality.

Workflow auditcaution

All 12 analyzed action references are unpinned, and three workflows grant top-level write permissions. The audit also found a high-confidence bot-condition issue in the Dependabot auto-merge workflow; the pull_request_target trigger has no untrusted checkout or script-injection sink, so this is a significant hygiene concern rather than a standalone critical risk.