lenorix/laravel-early-hints

Release historycaution

The package is only 29 days old, with five releases clustered over roughly five days. This shows active initial development but provides little evidence of long-term maintenance.

Repo bus factorcaution

One contributor made 23 of 24 recent commits, leaving maintenance highly concentrated despite a second active contributor. Organization backing provides some handoff capacity but does not remove the concentration concern.

Security policycaution

No repository security policy was found. This is a modest transparency gap for a package intended for application integration, but it is not evidence of abandonment by itself.

Version stabilitycaution

Version v0.4.0 is not a stable-major release, so compatibility expectations are lower. It is not marked as a prerelease, which partly offsets the concern.

Workflow auditcaution

All nine analyzed action references are unpinned, which weakens build reproducibility and supply-chain hygiene. The repository also has two workflows with top-level write permissions, but the pull_request_target workflow has no untrusted checkout or script-injection findings, so this is not a severe workflow risk.