There have been no commits in the last three months, and the registry shows no releases in the last year. The package has tests, documentation, and a matching source repository, but those strengths do not offset its lack of active maintenance.
12%
Total Score
50
57
50
Packagist marks the entire package as abandoned, with no replacement package specified. This is a direct warning against taking a new dependency on the package.
The package has only six releases and none in the last 12 months; the latest release was on March 14, 2024. This supports a substantial abandonment concern.
The linked repository is archived, which indicates the project is no longer intended for normal ongoing maintenance. Its last push was on March 10, 2025, and the archived state outweighs the otherwise matching repository evidence.
The repository recorded zero commits and zero active maintainers in the last three months. That provides no evidence of current maintenance capacity.
All 13 workflow action references are unpinned, and the audit found a high-confidence bot-conditions issue in the Dependabot auto-merge workflow. These are supply-chain hygiene weaknesses, though secondary to the package's abandoned status.
We didn't find any vulnerabilities for this package.
| Dependency | Last Release | Score |
|---|---|---|
guzzlehttp/guzzle Version ^7.7 | — | — |
illuminate/contracts Version 10.*|11.* | — | — |
league/glide-symfony Version ^2.0 | — | — |
ueberdosis/tiptap-php Version ^1.3 | — | — |
spatie/laravel-package-tools Version ^1.14.0 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.