spatie/laravel-schemaless-attributes

Repo commit activitycaution

There were no commits and no active maintainers in the three months before collection. The recent release and June push partly compensate, but the short-term activity gap modestly raises maintenance risk.

Repo toolingcaution

Composer build tooling is present, but no security scanning tools were detected. This is a transparency and hygiene gap rather than evidence that the package is unsafe.

Security policycaution

The repository has no published security policy. That weakens vulnerability-reporting transparency, though it does not by itself indicate abandonment.

Workflow auditcaution

All three workflows were analyzed with no untrusted checkouts or script injection, but all seven action references are unpinned and a high-confidence audit found an unpinned container image. This creates a real, limited workflow supply-chain hygiene concern.