spatie/laravel-activitylog

This is a healthy, mature release with a long release history, frequent recent releases, stable versioning, an active and non-archived organization-backed repository, current commit activity from five contributors, strong documentation and source-tree hygiene, and no install-time lifecycle scripts. The main residual concerns are repository security hygiene: most workflows lack top-level token permissions, one workflow grants top-level write access and uses pull_request_target, and no security policy was found. These warrant review of the CI configuration but do not outweigh the package's strong maintenance, transparency, and project-backing evidence.

Latest 5.1.1Packagist

Health Score Breakdown

Dangerous workflowscaution

One of five workflows uses pull_request_target, which warrants review because it can expose privileged workflow context; however, no untrusted checkout or script-injection patterns were detected.

Security policycaution

No repository security policy was found, leaving vulnerability-reporting and response expectations less explicit.

Token permissionscaution

Four workflows lack top-level token permissions and one workflow grants top-level write access, creating avoidable CI privilege ambiguity; this is a security-hygiene concern rather than evidence of package abandonment.

View all 20 health checks

Vulnerabilities

We didn't find any vulnerabilities for this package.

Maintainers

Freek Van der Herten

Sebastian De Deyne

Tom Witkowski

Direct Dependencies

Dependency	Last Release	Score
illuminate/config Version ^12.0 || ^13.0	—	—
illuminate/support Version ^12.0 || ^13.0	—	—
illuminate/database Version ^12.0 || ^13.0	—	—
spatie/laravel-package-tools Version ^1.6.3	—	—