vicgutt/laravel-stubs

Release historycaution

The package has existed since August 2022 with nine releases, but it has had no release in the last 12 months; the latest release was about 17 months ago, indicating stalled maintenance.

Repo commit activitycaution

There were no commits and no active maintainers in the last three months. Combined with the absent recent releases, this raises abandonment risk for a pre-1.0 package.

Repo toolingcaution

Composer build tooling is present, but no security-scanning tool was detected, leaving a modest transparency and maintenance gap.

Security policycaution

The repository has no security policy, so consumers have no documented vulnerability-reporting path. This is a transparency gap, though not evidence that the release is unsafe.

Workflow auditcaution

All four workflows were analyzed without high- or medium-severity findings and no untrusted trigger or injection sink was found. However, all 11 action references are unpinned and one workflow grants top-level write access, creating preventable supply-chain hygiene risk.