soap/laravel-shopping-cart

Release historycaution

The latest release was published about 15 months before collection, with no releases in the last 12 months. This indicates a meaningful maintenance slowdown despite 19 releases overall.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months. This raises abandonment risk, although the recent push recorded by repository metadata provides some contrary evidence.

Security policycaution

The repository has no security policy, leaving vulnerability-reporting expectations unclear. This is a transparency gap, but it is not by itself evidence that the release is unsafe.

Workflow auditcaution

All 17 analyzed action references are unpinned, four workflows grant top-level write permissions, and a high-confidence bot-conditions finding may allow actor context to be spoofed. No untrusted checkout or script-injection sink was found, so this is workflow hygiene risk rather than a severe standalone failure.