joelwmale/laravel-cart

Registry deprecationdanger

Packagist marks the entire package as abandoned and names wearepixel/laravel-cart as its replacement. This is a severe adoption risk even though version 2.0.0 has a recent release.

Release historycaution

The package has 17 releases over about 671 days and one release in the last 12 months, including a release roughly six months before collection. This shows some release activity, but not enough to offset the abandonment status and recent lack of commits.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months. That recent inactivity weakens confidence that defects or compatibility issues will be addressed.

Security policycaution

The linked repository has no security policy. That leaves vulnerability-reporting expectations unclear, though it is a secondary transparency gap for this package.

Workflow auditcaution

Both workflows were analyzed, but all four action references are unpinned, and a high-confidence bot-conditions finding reports that actor context may be spoofable in the Dependabot auto-merge workflow. The pull_request_target trigger has no untrusted checkout or script-injection sink, so this is a hygiene concern rather than a standalone severe risk.