smskin/laravel-saga

Project backingcaution

The package and repository are owned by the same individual account, so the source appears directly connected rather than backed by a larger organization. This leaves a relatively narrow maintenance base but is not independently severe.

Release historycaution

Only one release exists, and it was published about 2 years and 4 months ago, with no releases in the last 12 months. This is a meaningful maintenance and freshness concern despite the repository being recently pushed.

Repo commit activitycaution

There were no commits and no active maintainers in the last 3 months, indicating that development activity has currently stalled. The later repository push date is some compensating evidence but does not remove the recent inactivity concern.

Security policycaution

The repository has no published security policy. This is a transparency gap for a library that may be used in application infrastructure, though it is not evidence of an active security problem.

Workflow auditcaution

All four workflows were analyzed successfully with no high-confidence audit findings, no untrusted checkouts, and no script injection. However, all 9 action references are unpinned, which weakens build reproducibility and supply-chain hygiene; the absence of top-level permissions is acceptable on its own.