mattitjaab/laravel-cision-feed

Dangerous workflowscaution

One workflow uses pull_request_target for Dependabot auto-merge, which warrants care because that workflow class can expose elevated repository context. No untrusted checkouts or script-injection patterns were detected, limiting the concern.

Release historycaution

The package has five releases since September 2022, but no release in the last 12 months and the latest release was about 14 months ago. That materially raises maintenance and abandonment concerns.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months. Combined with the absent registry releases over the last year, this is the main reason to treat the package cautiously.

Repo issue activitycaution

There are no open issues and four open pull requests, but none were opened or merged in the last month. The lack of issue backlog is positive, while the inactive pull requests suggest limited recent project movement.

Repo popularitycaution

The repository has zero stars and forks and one watcher. Popularity is only supporting evidence, so this does not make the package unfit, but it provides little independent evidence of broad community support.