mafrasil/cashier-polar

All nine workflow references are unpinned, and a high-confidence bot-condition finding affects the auto-merge workflow. Documentation, tests, release notes, licensing, and Dependabot provide useful support, but the missing security policy adds a transparency gap.

Latest v0.4.6

Packagist

58%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Repo commit activity

The repository recorded zero commits and zero active maintainers in the last three months. That recent inactivity weakens confidence in prompt maintenance despite the recent release and push.

Security policy

The repository has no security policy, leaving vulnerability reporting and response expectations undocumented for a package handling billing credentials and webhooks.

Version stability

Version v0.4.6 is not a prerelease, but the package remains below 1.0, so compatibility expectations are less established than for a stable-major release.

Workflow audit

All 9 of 9 action references are unpinned, and three workflows grant top-level write access. The audit also found a high-confidence bot-condition issue in the Dependabot auto-merge workflow; there is no untrusted checkout or script injection, so this is a significant hygiene concern rather than a standalone disqualifier.

Vulnerabilities

We didn't find any vulnerabilities for this package.

Package versions

Maintainers

mafrasil

Direct Dependencies

Dependency	Last Release	Score
guzzlehttp/guzzle Version ^7.8	—	—
illuminate/contracts Version ^10.0\|\|^11.0\|\|^12.0	—	—
spatie/laravel-package-tools Version ^1.16	—	—
spatie/laravel-webhook-client Version ^3.4	—	—