mgcodeur/laravel-currency-converter

Maintainerscaution

Only one registry account has publish access. The matching user-owned repository provides some backing, but the narrow publishing base leaves limited visible redundancy.

Release historycaution

The package is about 2 years and 5 months old with five releases, but only one release in the last 12 months and a median interval of about 180 days indicate a slow cadence.

Repo commit activitycaution

There were zero commits and zero active maintainers in the last three months, a meaningful sign that development activity has stalled despite the recent release.

Security policycaution

The repository has no security policy, which reduces transparency for reporting and handling vulnerabilities in a package used inside applications.

Workflow auditcaution

All 14 analyzed action references are unpinned, and three workflows grant top-level write access. A high-confidence bot-condition finding affects the Dependabot auto-merge workflow, while the pull-request trigger and write access increase the workflow risk.