finller/laravel-forex

Registry deprecationcaution

Packagist marks the package abandoned and points to elegantly/laravel-forex as the replacement. The active repository and current release activity reduce the abandonment concern, but the registry status still lowers confidence in adopting this package name.

Repo bus factorcaution

One contributor made 100% of the 7 commits during the last 3 months. Organization ownership provides some handoff capacity, but the observed contributor concentration remains a maintenance risk.

Security policycaution

The repository has no security policy. This is a transparency gap for reporting vulnerabilities, although active tooling and repository maintenance provide some compensating evidence.

Workflow auditcaution

All 8 analyzed action references are unpinned, and the audit found a high-confidence bot-condition issue in the Dependabot auto-merge workflow. The pull_request_target trigger has no untrusted checkout or script-injection sink, limiting the severity.