Package Health/otatechie/laravel-spotlight

otatechie/laravel-spotlight

Usable with caveats: the package is clearly backed by a matching repository with documentation, tests, releases, and sensible dependencies. However, it has had no commits or active maintainers for about five months, while workflow permissions and the lack of a security policy add maintenance and transparency concerns.

Latest v1.1.0

Packagist

62%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Dangerous workflows

One workflow uses pull_request_target for Dependabot auto-merge. No untrusted checkout or script injection was detected, but this privileged workflow deserves review before relying on the repository's automation.

Release history

All three releases occurred within about two days, and there has been no new registry release for roughly eight months. This shows an initial release burst but limited evidence of sustained release maintenance.

Repo commit activity

The repository recorded zero commits and zero active maintainers in the last three months, a significant warning for a diagnostics tool that may need updates as Laravel and security practices change.

Security policy

The repository has no security policy, leaving no documented process for reporting or handling vulnerabilities in a package that advertises security analysis.

Token permissions

Two workflows grant top-level write permissions and two omit top-level permission declarations, which is weaker least-privilege hygiene than expected for repository automation.