permafrost-dev/laravel-str-extras

Release historycaution

Only two releases have appeared since May 2023, with no releases in the last 12 months. This indicates limited ongoing maintenance for a dependency consumers may need to support over time.

Repo commit activitycaution

There were no commits and no active maintainers in the last three months, consistent with the broader inactivity since 2023 and raising abandonment risk.

Security policycaution

The repository has no security policy. This is a transparency gap for reporting vulnerabilities, though the package is small and other repository documentation is present.

Workflow auditcaution

All nine analyzed action references are unpinned, and three workflows grant top-level write permissions. The audit also found a high-confidence bot-condition issue in the Dependabot auto-merge workflow; the pull-request target trigger has no untrusted checkout or script-injection sink, so this remains a workflow-hygiene concern rather than a severe risk.