illuma-law/laravel-semantic-deduper

Release historycaution

Five releases arrived within a very short initial burst, but the latest release was about 4 months and 3 weeks ago, so the history shows limited sustained maintenance.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers over the last 3 months, leaving a meaningful abandonment concern despite its recent launch.

Security policycaution

The linked repository has no security policy, reducing transparency about how users should report vulnerabilities; this is a hygiene gap rather than evidence of an unsafe release.

Version stabilitycaution

Version v0.1.4 is not a stable major release, which signals an immature API and greater compatibility risk for dependents.

Workflow auditcaution

All 12 action references are unpinned, three workflows grant top-level write permissions, and a high-confidence bot-conditions finding affects the Dependabot auto-merge workflow. The pull_request_target trigger has no untrusted checkout or script-injection sink, so this remains a caution rather than a severe standalone risk.