Package Health/r0hitch0pra/laravel-purchases

r0hitch0pra/laravel-purchases

The package has useful documentation, repository tests, a changelog, and static analysis tooling. However, it has had no release or commit activity for about five years, and its CI uses an unpinned container image; the license declaration also conflicts with the detected license.

Latest 0.10.3

Packagist

42%

Total Score

Maintainer Stability

Maturity

Supply Chain

Health Score Breakdown

Release history

The package has made no releases in the last 12 months, and its latest release was about five years ago. This is strong evidence of abandonment for a package handling payment integrations.

Repo commit activity

The repository recorded zero commits and zero active maintainers in the last three months, consistent with the long gap since the last release. The repository is not archived, but there is no observed recent maintenance to offset the inactivity.

License

The artifact contains a license file, so the release is licensed, but the manifest declares MIT while the detected file license is BSD-3-Clause. That mismatch reduces transparency about the terms consumers receive.

Workflow audit

All five analyzed action references are unpinned, and the audit found a high-confidence, high-severity unpinned container image. The workflows were fully analyzed and had no untrusted checkout or script-injection findings, but the release-build hygiene remains a concern.