Package Health/hotwired-laravel/turbo-laravel

hotwired-laravel/turbo-laravel

Documentation, licensing, release notes, and repository ownership provide a solid maintenance foundation. Recent repository activity is quiet, and one workflow grants broader write access than necessary, so ongoing care should be watched.

Latest 2.6.0

Packagist

68%

Total Score

Maintainer Stability

Maturity

100

Supply Chain

Health Score Breakdown

Lifecycle scripts

The package defines a post-autoload-dump install-time script, so dependency installation can execute package-provided behavior. This is a real supply-chain surface, but the signal does not show that the script is malicious or unusually risky.

Repo commit activity

The repository recorded 0 commits and 0 active maintainers in the last 3 months, indicating a current maintenance pause. The recent 2.6.0 release and May repository push provide some compensating evidence, so this is a caution rather than a severe abandonment signal.

Repo issue activity

There were no new or closed issues or pull requests in the last month, with only 2 open issues and no open pull requests. This reinforces the quiet recent development picture, although the low issue count is not itself a major concern.

Workflow audit

Both workflows were analyzed successfully, all four action references are pinned, and no untrusted checkout, script injection, or audit findings were reported. One workflow has top-level write permissions, which is a mild hygiene concern without an untrusted trigger or sink.