rokde/laravel-starter-kit

Release historycaution

The package has had no releases in the past 12 months, despite being about 16 months old, which raises maintenance concerns for a starter kit. Four total releases provide some history but do not offset the long recent gap.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the past three months, indicating a recent pause in development. This is a meaningful abandonment risk, although the repository is not archived.

Workflow auditcaution

All 9 analyzed action references are unpinned, and a high-confidence bot-conditions finding may allow actor context to be spoofed in the Dependabot auto-merge workflow. The pull_request_target trigger has no untrusted checkout or script-injection sink, so this is a hygiene and workflow-integrity concern rather than a severe standalone risk.