rembon/laravel-auditor

Repo commit activitydanger

There were zero commits and zero active maintainers in the last three months. This is a direct sign of stalled maintenance, despite the recent repository push and open pull requests.

Release historycaution

The package is 838 days old but has only three releases, with one release in the last 12 months and a median interval of about 419 days. This indicates a slow, limited release track.

Repo issue activitycaution

Five pull requests were opened in the last month but none were merged, while no new issues were opened or closed. This shows incoming activity without evidence of completed maintenance work.

Version stabilitycaution

The assessed release is v3.0.0-beta.1, so its API and behavior are not yet fully stable for production dependents. The release notes say the public API is frozen until 3.0.0, which provides some reassurance but does not remove beta risk.

Workflow auditcaution

All seven workflows were analyzed without high-confidence audit findings or untrusted checkout and script-injection patterns. However, all 29 action references are unpinned, and two workflows grant top-level write permissions; without an untrusted trigger this is a hygiene concern rather than a severe risk.