rpungello/laravel-labels

Project backingcaution

The package and repository are owned by the same individual account. That is consistent ownership, but it also indicates a small backing base with limited organizational redundancy.

Release historycaution

The package has 21 releases over about four years, but none in the last 12 months; its latest release was about 18 months ago. This is a meaningful maintenance slowdown.

Repo commit activitycaution

There were zero commits and zero active maintainers in the last three months. The recent repository push is a compensating sign of availability, but not of ongoing development.

Security policycaution

The repository has no security policy. This is a transparency gap for a package intended to be integrated into applications, though it does not by itself show abandonment.

Workflow auditcaution

All eight analyzed action references are unpinned, and the audit found high-confidence bot-condition and unpinned-container-image issues. The pull_request_target workflow has no untrusted checkout or script-injection sink, so these are workflow hygiene risks rather than a severe dependency verdict.