spatie/url

Release historycaution

The package has 26 releases since 2016, but no releases in the last 12 months and its latest release was about two years and six months ago. This lowers confidence that fixes and improvements are arriving regularly.

Repo commit activitycaution

The repository had zero commits and zero active maintainers in the last three months, which is a meaningful sign of currently stalled maintenance despite the recent repository push.

Repo toolingcaution

Composer build tooling is present, but no security scanning tool is reported. This is a modest transparency and hygiene gap rather than evidence of abandonment.

Security policycaution

The repository has no security policy, leaving vulnerability reporting and response expectations unspecified.

Workflow auditcaution

All three workflows were analyzed with no untrusted checkout or script-injection findings, but the high-confidence unpinned-images finding means a CI container image is not fixed to a known version. All seven action references are also unpinned, weakening build reproducibility.