sfolador/measures-for-laravel

Release historycaution

The package has had no registry releases in roughly 22 months, despite being established for over three years. Its 10-release history and recent GitHub release notes provide some evidence of prior maintenance, but the current release cadence is weak.

Repo commit activitycaution

There were no commits and no active maintainers in the last three months. This is a meaningful maintenance warning, although the repository had a later push recorded in April 2026.

Security policycaution

The repository has no security policy. That is a modest transparency gap for a package used in application code, though it is not evidence of abandonment by itself.

Version stabilitycaution

Version 0.1.9 is not yet at a stable major version, which signals a potentially changing API. The release is not marked as a prerelease, partly offsetting that concern.

Workflow auditcaution

All 12 analyzed action references are unpinned, leaving workflow dependencies exposed to reference changes. The audit also found a high-confidence bot-conditions issue in a pull_request_target workflow; no untrusted checkout or script-injection sink was found, so this is a hygiene concern rather than a severe workflow risk.