laravel-notification-channels/webpush

This is a healthy, mature package to depend on: it has been maintained for roughly 10 years, has 31 releases including 7 in the last 12 months, a stable non-prerelease version, an active and non-archived organization-owned repository, recent commits from two active contributors, repository tests and changelog coverage, and no install-time lifecycle scripts. The main reservations are the absence of a security policy and dedicated security scanning, plus an undeclared top-level GitHub Actions token-permissions policy; these are transparency and CI-hardening gaps rather than evidence of abandonment. Registry maintainer access is limited to two accounts, but the organization-backed repository and active contributor activity provide meaningful continuity.

Latest 13.0.1Packagist

Health Score Breakdown

Repo toolingcaution

Composer build tooling is present, but no security-scanning tool was detected; this is a modest CI transparency gap for a package with external dependencies.

Security policycaution

The repository has no security policy, leaving vulnerability-reporting and response expectations undocumented.

Token permissionscaution

The only workflow lacks top-level token permissions, and no read-only permissions are declared; this weakens CI least-privilege documentation even though no write permissions were explicitly observed.

View all 20 health checks

Vulnerabilities

We didn't find any vulnerabilities for this package.

Maintainers

Cretu Eusebiu

Joost de Bruijn

Direct Dependencies

Dependency	Last Release	Score
guzzlehttp/psr7 Version ^2.0|^3.0	—	—
illuminate/http Version ^12.0|^13.13	—	—
illuminate/support Version ^12.0|^13.13	—	—
minishlink/web-push Version ^11.0	—	—
illuminate/notifications Version ^12.0|^13.13	—	—