Package Health/protonemedia/laravel-cross-eloquent-search

protonemedia/laravel-cross-eloquent-search

The package is clearly identified, licensed, and documented, with repository tests and release notes for this version. Its organization backing and small runtime dependency set are reassuring, but maintenance has recently gone quiet and CI needs tighter controls.

Latest 3.7.0

Packagist

65%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Release history

The package has existed for about 6 years with 44 releases, but only 1 release in the last 12 months; the current release and release notes provide some recent evidence of maintenance.

Repo commit activity

The repository recorded zero commits and zero active maintainers in the last 3 months. The recent release and release notes show earlier activity but do not offset the current maintenance pause completely.

Repo tooling

Composer build tooling is present, but no security scanning tools were detected. This is a modest transparency and maintenance gap rather than evidence of unsafe behavior.

Security policy

The repository has no published security policy, leaving vulnerability reporting expectations unclear for consumers and maintainers.

Workflow audit

All 10 analyzed action references are unpinned, and a high-confidence bot-conditions finding reports that actor context may be spoofable in the Dependabot auto-merge workflow. The pull_request_target workflow has no untrusted checkout or script-injection sink, limiting the severity.