hasyirin/laravel-actor

Clear documentation, repository tests, release notes, and a matching source tree support adoption. Maintenance has gone quiet for three months, while workflow permissions, unpinned actions, and a high-confidence bot check reduce confidence in the project’s upkeep.

Latest v1.1.0

Packagist

55%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Project backing

The registry namespace and repository are owned by the same individual user, so the project has no visible organizational backing to compensate for its single-owner maintenance model.

Release history

Three releases arrived over about nine days, but the package is 134 days old and its latest registry release was about four months ago, leaving limited evidence of sustained maintenance.

Repo commit activity

The repository recorded zero commits and zero active maintainers in the last three months, a concrete sign that maintenance may have stalled after the initial releases.

Security policy

No security policy is present in the repository, reducing transparency about how vulnerabilities should be reported; this is a moderate hygiene gap rather than evidence of abandonment by itself.

Workflow audit

All 12 analyzed action references are unpinned, three of five workflows grant top-level write permissions, and a high-confidence bot-conditions finding affects the Dependabot auto-merge workflow. The pull_request_target trigger has no untrusted checkout or script-injection sink, so these are workflow hygiene and maintenance risks rather than a severe standalone failure.