mongodb/laravel-mongodb

Version 5.11.0 appears to be a healthy dependency: the package has a long release history, frequent recent releases, stable-version status, active maintenance, and strong organization backing from MongoDB. The linked repository is not archived, matches the package, includes tests and extensive CI/tooling, and shows recent activity from five contributors with no severe concentration risk. The main reservations are the absence of a repository security policy, incomplete top-level GitHub Actions permission declarations, and a pull_request_target workflow; these are transparency and workflow-hygiene concerns rather than evidence of abandonment. The artifact itself omits a README and tests, but repository tests and GitHub Releases compensate for that packaging gap.

Latest 5.11.0Packagist

Health Score Breakdown

Dangerous workflowscaution

One of eight workflows uses pull_request_target, which warrants review because that trigger can expose elevated repository context, although there are no detected untrusted checkouts or script-injection patterns.

Security policycaution

No SECURITY.md or equivalent security policy was found, reducing vulnerability-reporting transparency for a widely used dependency.

Token permissionscaution

Seven of eight workflows lack top-level permissions declarations, although no workflow has top-level write permissions and some jobs use explicit or read-only permissions; the incomplete least-privilege declaration remains a hygiene gap.

View all 20 health checks

Maintainers

Andreas Braun

Pauline Vos

Jérôme Tamarelle

Jeremy Mikola

Jens Segers

Direct Dependencies

Dependency	Last Release	Score
mongodb/mongodb Version ^1.21|^2	—	—
illuminate/cache Version ^12|^13.0	—	—
illuminate/events Version ^12|^13.0	—	—
illuminate/support Version ^12|^13.0	—	—
illuminate/database Version ^12.51|^13.0	—	—

View All 7 Dependencies