thejano/laravel-domain-driven-design

Release historycaution

The package has existed for about 3.5 years but has only four releases, with one release in the last 12 months and a median interval of about 13 months. This indicates a slow maintenance cadence.

Repo bus factorcaution

All recent commits came from one contributor, giving a complete concentration of recent activity. Organization ownership provides some handoff capacity, but no second active contributor is shown.

Repo commit activitycaution

Only one commit was recorded in the last three months, from one active maintainer. The recent activity is limited, despite the repository having a current release.

Security policycaution

The repository has no security policy. This is a transparency gap for reporting and handling vulnerabilities, though it does not by itself indicate abandonment.

Workflow auditcaution

All three workflows were analyzed, but four of five action references are unpinned and the Dependabot auto-merge workflow has a high-confidence bot-conditions finding; it also grants top-level write permissions. The pull_request_target trigger has no untrusted checkout or script-injection sink, limiting the severity.