robertmarney/lara-hierarchial-collections

Project backingcaution

The package and repository are owned by the same individual, so ownership is clear, but there is no organizational backing shown to compensate for the thin maintainer base.

Release historycaution

The package has 10 releases since September 2022, but no releases in the last 12 months; the latest release was in March 2025, indicating a meaningful maintenance slowdown.

Repo commit activitycaution

There were zero commits and zero active maintainers in the three months measured, which is a concrete sign of currently weak maintenance activity.

Security policycaution

No security policy was found, leaving vulnerability-reporting expectations unclear; this is a modest transparency gap rather than evidence of abandonment by itself.

Workflow auditcaution

All 12 analyzed action references are unpinned, and the audit found a high-confidence bot-condition issue in the Dependabot auto-merge workflow. The pull_request_target workflow has no untrusted checkout or script-injection sink, so the result is caution rather than a severe workflow risk.