yiyon/laravel-permission-merchant

Release historydanger

The package has 139 releases but none in the last 12 months; its latest release was over five years ago. The historical release count shows prior activity but does not offset the prolonged pause.

Repo commit activitydanger

The repository recorded zero commits and zero active maintainers in the last three months, consistent with no observed development since November 2020. This is a substantial abandonment concern for a framework integration package.

Repo popularitycaution

The repository has 0 stars, forks, and watchers. Popularity is only supporting evidence, but these counters provide no community signal to compensate for the inactive maintenance record.

Security policycaution

The linked repository has no security policy or documented security contact. This is a transparency gap, particularly for a package that manages application authorization, though it is less severe than the maintenance lapse.

Workflow auditcaution

All 8 action references are unpinned, and the audit found a high-confidence, high-severity unpinned container image in the PHP-CS-Fixer workflow. There were no untrusted checkouts or script-injection findings, but the release workflow still has avoidable supply-chain hygiene risk.