spatie/pest-expectations

Name lookalikedanger

The package is reported to borrow the identity of spatie/robots-txt, which has far more downloads, and the signal marks it as not being a transparent fork. This is serious confusion and supply-chain risk even though artifact overlap is zero.

Release historycaution

The package has existed for about 3 years and 8 months with 22 releases, but only one release in the last 12 months. That suggests a slower maintenance cadence for a package consumers may rely on.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months. The June repository push and February release provide some evidence of recent activity, but the observed short-term gap still raises maintenance concern.

Security policycaution

No security policy was found in the repository, leaving vulnerability-reporting expectations undocumented. Dependabot provides some compensating security tooling but does not replace a reporting policy.

Workflow auditcaution

All 9 analyzed action references are unpinned, which weakens build reproducibility. The pull_request_target workflow has no untrusted checkout or script-injection sink, so it is not an acute workflow compromise by itself.