laravel/boost
Healthy and suitable to depend on. It has frequent releases, very active and broadly distributed maintenance, strong Laravel organization backing, and clear release documentation; the only notable caution is that some CI workflows have write access and one uses pull_request_target.
94%
Total Score
100
100
100
75
Health Score Breakdown
One of eight workflows uses pull_request_target, which can require extra review, but there are no untrusted checkouts or detected script-injection patterns.
All workflows declare permissions, but four grant top-level write access; this is a modest CI hardening concern despite the absence of missing permission declarations.
Vulnerabilities
| Title | Versions | Severity |
|---|---|---|
AIKIDO-2026-10298 Pre-CVE Found by Aikido Intel before public disclosure or CVE publication. laravel/boost is vulnerable to Incorrect Authorization in versions 1.0.0 - 2.1.7. | 1.0.0 - 2.1.7 | High |
Package versions
Maintainers
No maintainer information available.
Direct Dependencies
| Dependency | Last Release | Score |
|---|---|---|
 laravel/mcp Version ^0.7.1|^0.8.0|^0.9.0|^1.0 | — | — |
laravel/roster Version ^1.0.0 | — | — |
laravel/prompts Version ^0.3.10 | — | — |
guzzlehttp/guzzle Version ^7.9|^8.0 | — | — |
illuminate/console Version ^11.45.3|^12.41.1|^13.0 | — | — |
Weekly Downloads
Info
- Last Published
- 6 days ago
- Created
- 1 year ago
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.