replworks/laravel-imageforge

Release historycaution

The package is less than a day old with 3 releases, including this version, so there is little evidence yet of sustained maintenance. The rapid initial release activity is a modest compensating signal, not proof of long-term stability.

Repo commit activitycaution

The repository reports 0 commits and 0 active maintainers over the last 3 months, but the package itself is newly created, so this is limited evidence of abandonment rather than a strong negative conclusion.

Repo toolingcaution

Composer build tooling is present, but no security-scanning tools were detected. That leaves a gap in the project's visible security hygiene.

Security policycaution

No security policy was found in the repository. This reduces vulnerability-reporting transparency, although it does not by itself indicate unsafe code.

Workflow auditcaution

All 9 of 9 action references are unpinned, and the audit found a high-confidence template-injection issue in update-changelog.yml. No untrusted checkout or script-injection path was reported, so this is a meaningful hygiene concern rather than a severe standalone dependency risk.