tobmoeller/laravel-mail-middleware

Dangerous workflowscaution

One of five workflows uses pull_request_target for Dependabot auto-merge, creating some CI trust-boundary risk, although no untrusted checkout or script-injection patterns were detected.

Maintainerscaution

Only one registry publishing account is listed. This is a resilience concern, though the linked repository is owned by the same individual, so there is no contradiction or unexplained ownership gap.

Project backingcaution

The package and repository are consistently backed by the same individual user account. This confirms ownership alignment but does not provide organizational redundancy.

Release historycaution

Only three releases have been published over 564 days, with one release in the last 12 months and a median interval of about 200 days, indicating a slow maintenance cadence.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months, a concrete sign that maintenance may currently be paused; the recent June push and April release provide only partial compensation.