milwad/laravel-attributes

Release historycaution

The package has 15 releases and two releases in the last 12 months, showing continued publishing but a slower recent cadence than its historical median interval of about four days.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months, a meaningful sign of currently quiet maintenance despite a recent push outside that window.

Security policycaution

The repository has no security policy, which is a transparency gap for reporting and handling vulnerabilities, though it is not by itself evidence of abandonment.

Workflow auditcaution

Both workflows were analyzed successfully, but all three action references are unpinned and a high-confidence bot-conditions finding reports that actor context may be spoofable in the Dependabot auto-merge workflow. The pull_request_target trigger has no untrusted checkout or script-injection sink, so this remains a workflow hygiene concern rather than a standalone critical risk.