spatie/laravel-query-builder

This is a healthy, mature release with a long release history, a recent release, stable versioning, active repository maintenance, organizational backing, multiple active contributors, and strong package/repository documentation and test coverage. The package is not deprecated or archived, has a clear MIT license, no install-time lifecycle scripts, and uses Dependabot security tooling. The main reservations are the absence of a repository security policy and inconsistent GitHub Actions token-permission declarations, including write permissions in two workflows; these are repository hygiene concerns but do not outweigh the substantial evidence of active maintenance and transparency.

Latest 7.3.5Packagist

Health Score Breakdown

Dangerous workflowscaution

One of five workflows uses pull_request_target, which warrants review because that trigger can elevate workflow privileges; however, no untrusted checkouts or script-injection patterns were detected.

Security policycaution

No repository security policy was found, leaving vulnerability-reporting and response expectations undocumented.

Token permissionscaution

Three workflows lack top-level permission declarations and two declare write permissions, so the repository has weaker-than-ideal least-privilege workflow hygiene despite otherwise active maintenance.

View all 20 health checks

Vulnerabilities

We didn't find any vulnerabilities for this package.

Maintainers

Alex Vanderbist

Direct Dependencies

Dependency	Last Release	Score
illuminate/http Version ^12.0|^13.0	—	—
illuminate/support Version ^12.0|^13.0	—	—
illuminate/database Version ^12.0|^13.0	—	—
spatie/laravel-package-tools Version ^1.11	—	—