marshmallow/blogs

Dependency profilecaution

Eleven runtime dependencies create substantial coupling and increase maintenance exposure, although the dependencies are explicit and relevant to the package's Laravel Nova functionality.

Release historycaution

The package has released seven times since May 2021, but has had no registry release in the last 12 months; this points to slowing maintenance despite a previously active cadence.

Repo bus factorcaution

All recent commits come from one contributor, leaving maintenance dependent on a single active individual. Organization ownership provides some handoff capacity but does not remove the present concentration.

Security policycaution

The repository has no SECURITY.md policy. This is a transparency gap for reporting and handling security issues, though the README provides an email contact.

Workflow auditcaution

The sole workflow was fully analyzed with no dangerous audit findings or untrusted execution paths. However, both referenced actions are unpinned, which weakens build reproducibility and supply-chain hygiene.