momentohq/laravel-cache

Documentation, tests, licensing, and a focused dependency set support straightforward adoption. The organization-backed repository remains active and matches the package, but CI credential scope and reference pinning need attention.

Latest v1.1.4

Packagist

60%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Release history

The package has had no registry release in the last 12 months, and v1.1.4 was published on April 26, 2024, indicating a prolonged release gap despite 18 total releases.

Repo bus factor

All recent commits came from one contributor. Organization backing provides some handoff capacity, but no second active contributor is shown in the collected period.

Repo commit activity

The repository recorded one commit in the last three months from one active maintainer, showing some current activity but a very light maintenance pace.

Security policy

The repository has no security policy, leaving vulnerability reporting and response expectations undocumented.

Workflow audit

Both workflows were analyzed, but all 9 action references are unpinned. One push workflow grants broad app-token permissions with high-confidence findings, and one workflow has top-level write access, creating avoidable CI supply-chain exposure.