moneroo/moneroo-laravel

Release historycaution

The package has four releases over about 2 years and 6 months, with only one release in the last 12 months and a median interval of about 298 days. This indicates a slow release cadence and increases the risk of delayed fixes.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers during the last three months. That recent lack of development activity is a meaningful maintenance and abandonment concern.

Security policycaution

No repository security policy was found. This is a transparency gap for a package handling payment-related API integration, though Dependabot and documented security-related release notes provide some compensation.

Version stabilitycaution

Version v0.2.0 is not on a stable major version, although it is not marked as a prerelease. The early major version adds some maturity uncertainty for a Laravel integration.

Workflow auditcaution

All four workflows were analyzed, but all eight action references are unpinned and a high-confidence bot-conditions finding affects the Dependabot auto-merge workflow. Its pull_request_target trigger has no untrusted checkout or script-injection sink, so this is a hygiene and workflow-risk concern rather than a severe standalone risk.