Its long release history, current stable version, complete documentation, and passing repository test evidence support adoption. Recent repository activity is quiet, while workflow actions are unpinned and several workflows grant broad write access.
70%
Total Score
67
100
50
The repository recorded zero commits and zero active maintainers in the last three months. This is a meaningful maintenance concern, although the recent release history shows the project has not been abandoned outright.
No issues or pull requests were opened, closed, or merged in the last month. Combined with zero recent commits, this suggests a current lull in project activity.
The repository has no published security policy. That limits the transparency of vulnerability reporting for a package used in web and API middleware.
All 10 analyzed action references are unpinned, and three workflows use top-level write permissions; the audit also found a high-confidence bot-conditions issue in auto-merge.yml. No untrusted checkout or script-injection sink was found, so this is workflow hygiene risk rather than a severe standalone risk.
We didn't find any vulnerabilities for this package.
| Dependency | Last Release | Score |
|---|---|---|
illuminate/support Version ^10.0 || ^11.0 || ^12.0 || ^13.0 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.