spatie/laravel-permission
Healthy and suitable to depend on. It has a long release history, frequent recent releases, active repository maintenance, and organizational backing; the main caveats are missing security-policy documentation and broad workflow permission declarations.
90%
Total Score
100
100
100
63
Health Score Breakdown
One workflow uses pull_request_target for Dependabot auto-merge, which warrants review because that trigger can be sensitive, but no untrusted checkouts or script-injection patterns were detected.
The repository has no security policy, leaving vulnerability-reporting and response expectations undocumented despite otherwise active maintenance.
Five of six workflows lack top-level token permissions, and the Dependabot auto-merge workflow grants top-level write access; this is weaker workflow hardening than ideal.
Vulnerabilities
| Title | Versions | Severity |
|---|---|---|
AIKIDO-2025-10764 Pre-CVE Found by Aikido Intel before public disclosure or CVE publication. spatie/laravel-permission is vulnerable to Race Condition in versions 0.0.1 - 6.21.0. | 0.0.1 - 6.21.0 | Low |
Package versions
Maintainers
 Freek Van der Herten |
Direct Dependencies
| Dependency | Last Release | Score |
|---|---|---|
 illuminate/auth Version ^12.0|^13.0 | — | — |
illuminate/database Version ^12.0|^13.0 | — | — |
illuminate/container Version ^12.0|^13.0 | — | — |
illuminate/contracts Version ^12.0|^13.0 | — | — |
spatie/laravel-package-tools Version ^1.0 | — | — |
Weekly Downloads
Info
- Last Published
- 2 months ago
- Created
- 11 years ago
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.