spatie/period

The package has clear documentation, tests in its repository, an MIT license, and a matching source project. Its release activity has stopped since February 2023, recent commits are absent, and workflow hygiene needs attention.

Latest 2.4.0

Packagist

42%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Name lookalike

The package is reported to borrow the identity of spatie/invade, a much more downloaded package, even though artifact overlap is zero and the README does not identify it as a fork. Consumers most likely wanted spatie/invade instead.

Release history

The package has 43 releases and historically released about every 10 days, but its latest release was on February 20, 2023, with no releases in the last 12 months. That is a substantial maintenance concern.

Repo commit activity

The repository recorded zero commits and zero active maintainers in the last 3 months. This weakens evidence of active maintenance despite the repository being present and unarchived.

Security policy

The repository has no security policy. This is a transparency and vulnerability-reporting gap, although Dependabot is enabled as compensating security tooling.

Workflow audit

All 9 action references are unpinned, and the audit found a high-confidence, high-severity unpinned container image. A pull_request_target workflow has no untrusted checkout or script-injection finding, which limits the immediate risk.