rector/rector-laravel

Registry deprecationdanger

Packagist marks the package as abandoned at package scope and names the same package as its replacement, creating a significant publishing and continuity concern despite the absence of a clear replacement.

Project backingcaution

The registry namespace is rector while the repository is owned by the driftingly user account, so the package does not show organization-owned repository backing; this makes the abandonment flag more consequential.

Security policycaution

The repository has no security policy, leaving reporting and response expectations undocumented; active maintenance and Dependabot provide some compensating hygiene but do not replace a policy.

Token permissionscaution

All three workflows omit top-level token permissions declarations. No workflow declares top-level write access, but explicit least-privilege configuration is still missing.