laravel/ranger
laravel/ranger v0.5.1 appears healthy and suitable for adoption, with 23 releases over 254 days, 22 releases in the last 12 months, recent repository activity, three active contributors, and a non-archived source repository owned by the Laravel organization. Licensing, repository linkage, tests, changelog coverage, security policy, dependency scanning, and package structure are strong. The main cautions are that the project is still on an unstable 0.x major version, commit activity is concentrated in one contributor, and several workflows have top-level write permissions with one pull_request_target workflow; these warrant review but do not outweigh the otherwise active and transparent maintenance profile.
88%
Total Score
90
100
94
80
Health Score Breakdown
One of seven workflows uses pull_request_target, which warrants review because that trigger can expose privileged automation to pull-request changes; no untrusted checkout or script-injection patterns were detected.
Three contributors are active, but the top contributor accounts for about 73% of recent commits, creating some concentration risk; the Laravel organization provides backing that partly mitigates handoff concerns.
All workflows declare permissions, but four of seven have top-level write permissions; explicit permissions are better than unspecified access, though broad write scope increases CI supply-chain exposure.
The release is not a prerelease, but the latest version remains below 1.0, so API stability and long-term maturity are not yet fully established.
Vulnerabilities
We didn't find any vulnerabilities for this package.
Package versions
Maintainers
 Taylor Otwell |
Direct Dependencies
| Dependency | Last Release | Score |
|---|---|---|
 laravel/pint Version ^1.22 | — | — |
laravel/surveyor Version ^0.3.0 | — | — |
nikic/php-parser Version ^5.4 | — | — |
illuminate/console Version ^11.0|^12.0|^13.0 | — | — |
illuminate/routing Version ^11.0|^12.0|^13.0 | — | — |
Weekly Downloads
Info
- Last Published
- 27 days ago
- Created
- 9 months ago
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.