Package Health/finller/laravel-conversations

finller/laravel-conversations

This release shows strong signs of active development and reasonable project hygiene: it has 40 releases over nearly four years, 10 releases in the last 12 months, a stable major version, a non-archived organization-owned repository, repository tests and changelog coverage, dependency scanning, and a matching repository. However, the registry explicitly marks this package as abandoned and identifies elegantly/laravel-conversations as its replacement. That deprecation is a decisive adoption risk: although the underlying project appears active, developers should depend on the replacement package rather than this abandoned registry identity.

Latest v2.3.2

Packagist

40%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Registry deprecation

Packagist marks the package as abandoned via packagist_abandoned and names elegantly/laravel-conversations as the replacement. This is a severe adoption and continuity risk even though other signals show the project is still being maintained.

Dangerous workflows

One of four workflows uses pull_request_target for Dependabot auto-merge, which requires elevated trust and careful review. No untrusted checkouts or script-injection patterns were detected, so the workflow profile is a limited caution rather than a severe finding.

Lifecycle scripts

The package declares a post-autoload-dump lifecycle script. This warrants awareness because installation-time scripts can affect consumers, but the signal does not establish harmful behavior or otherwise show a health problem on its own.

Repo bus factor

All four commits in the last three months came from one contributor. Because the repository is organization-owned, this concentration is less concerning than for an individual project, but it still indicates limited observed contributor diversity.

Repo issue activity

There are no open issues or pull requests and no issue or pull-request activity in the last month. The clean queue is positive, but the absence of recent collaboration provides little additional evidence of community support.