moonlydays/laravel-mno

Release historycaution

The package is only about 5 months old and made 13 releases in roughly 15 days, with a median interval of about 3 hours. That shows active initial shipping but gives limited evidence of long-term stability.

Repo commit activitycaution

The repository recorded 0 commits and 0 active maintainers during the last 3 months, despite a last-pushed date in August. That leaves weak evidence of sustained maintenance after the initial release burst.

Security policycaution

The linked repository has no security policy. This is a transparency and vulnerability-reporting gap, though it does not by itself show abandonment.

Workflow auditcaution

Both workflows were analyzed without failures, but all 4 action references are unpinned. A high-confidence bot-conditions finding affects the Dependabot auto-merge workflow, while its pull-request trigger has no reported untrusted checkout or script-injection sink; the top-level write permission is therefore a hygiene concern rather than a standalone severe risk.