nihilsen/laravel-join-using

Release historycaution

This is the package's only release, published nearly four years ago, with no releases in the last 12 months. That materially raises abandonment and compatibility risk.

Repo commit activitycaution

The repository recorded no commits and no active maintainers in the last three months, consistent with a project that has seen little recent maintenance.

Security policycaution

No security policy is present. This is a transparency gap, but it is a secondary concern for a small package and does not outweigh the maintenance evidence.

Version stabilitycaution

Version 0.1.0 is not a stable major release, so compatibility expectations are limited, although it is not marked as a prerelease.

Workflow auditcaution

All 9 analyzed action references are unpinned, and the audit found a high-confidence bot-condition issue in the Dependabot auto-merge workflow. The pull_request_target trigger has no untrusted checkout or script-injection sink, so this is a hygiene and automation risk rather than a severe standalone failure.