mirmuxsin/laravel-midtrans

Release historydanger

Only two releases were published, both on October 18, 2022, with no releases in the last 12 months. This prolonged release gap is a substantial maintenance concern.

Repo commit activitydanger

The repository recorded zero commits and zero active maintainers in the last 3 months, consistent with the package's nearly four-year release hiatus and indicating strong abandonment risk.

Dangerous workflowscaution

One of five workflows uses pull_request_target, which deserves review because that trigger can expose privileged workflow behavior to pull requests. No untrusted checkouts or script-injection patterns were detected, limiting the concern.

Repo popularitycaution

The repository has zero stars, forks, and watchers, providing no community-use evidence to compensate for its long inactivity. Popularity is supporting evidence rather than decisive on its own.

Token permissionscaution

Four workflows lack top-level token permissions, and the Dependabot auto-merge workflow grants top-level write access. This is weaker than least-privilege workflow hygiene, although no broader workflow exploit was observed.