sfolador/laravel-eloquent-toggle

Release historycaution

The package has only one release, published about 3 years and 9 months ago, with no releases in the last 12 months. A recent repository push partly offsets this, but registry maintenance is still weak.

Repo commit activitycaution

The repository recorded 0 commits and 0 active maintainers in the last 3 months. This suggests current maintenance may be inactive despite the repository not being archived.

Security policycaution

The linked repository has no security policy. This reduces vulnerability-reporting transparency, though Dependabot provides some compensating security tooling.

Version stabilitycaution

Version 0.1 is not a stable major release, which signals limited maturity. It is not marked as a prerelease, so the concern is moderate rather than severe.

Workflow auditcaution

All 12 analyzed action references are unpinned, and the audit found a high-confidence bot-condition issue in the Dependabot auto-merge workflow. The pull request trigger has no untrusted checkout or script-injection sink, limiting the impact to workflow hygiene and maintenance risk.