github / spec-kit
Repository health
Security, maintenance, dependencies and license for github/spec-kit.
Security
10 dependencies checked (10 direct), pypi, via deps.dev. Findings apply only to the packages and versions checked.
Security checks (RepoPilot estimate) · 8.4/10
OpenSSF has not scored this repository, so RepoPilot ran some of its checks from public GitHub data. Checks sorted from strongest to weakest.
- Recent activityLast commit 0d ago10/10
- License filePermissive license: MIT10/10
- Tests run on pull requestsCI configured + tests present10/10
- Security policySECURITY.md present10/10
- Static analysis on commitsCodeQL action detected in workflows10/10
- Least-privilege CI tokensWorkflows declare explicit, scoped permissions10/10
- Pinned dependenciesAll actions pinned to SHAs10/10
- Code review before merge12/20 recent PRs had requested reviewers6/10
- Automated dependency updatesNo Dependabot or Renovate config found0/10
- Branch protectionInsufficient permissions to read branch protectionnot scored
Maintenance
Outside contributions: 22 of 51 external pull requests merged (85% of those decided), median 2 days to merge.From the 70 most recently updated pull requests, bots excluded.
Pull requests
- Open
- 11
- 0 stale (60+ days, no update in 30)
- Merged
- 18
- of the 30 latest
- Median time to merge
- Same day
- From bots
- 2
- not listed below
Open
- #5065 fix(integrations): pass the Junie dispatch prompt via --taskRaycarlLei · opened today
- #5064 fix(workflows): handle undecodable shell output as a step failuregavenren · opened today
- #5032 fix: opt-in OpenCode discovery of hidden Spec Kit filesmvanhorn · opened 3 days ago
- #5044 fix(scripts): reject whitespace-only plansUddoo · opened 2 days ago
- #4827 fix: make bundle step refresh rollback transactionalmvanhorn · opened 20 days ago
Recently merged
- #4993 Add Entalpa to Community FriendsKhunjua · merged 22 Oct 2026
- #5063 chore: release 1.2.3, begin 1.2.4.dev0 developmentmnriem · merged 22 Oct 2026
- #5054 Feat/4913 workflow mcp inventoryn1shanthb · merged 22 Oct 2026
- #5059 docs: correct built-in workflow step source pathsWOLIKIMCHENG · merged 22 Oct 2026
- #5055 fix(events): preserve dispatcher ownership during cleanupmnriem · merged 21 Oct 2026
The 30 most recently updated pull requests.
Top contributors
- mnriem30 commits · 43%
- yxshee7 commits · 10%
- kartsan036 commits · 9%
- WOLIKIMCHENG4 commits · 6%
- KSchlobohm3 commits · 4%
Of the 69 most recent commits.
Issues
- Open
- 178
- issues and pull requests, as GitHub counts them
- Median time to close
- 1 day
- from 18 closed of the 34 latest
- Awaiting first reply
- 5
- of 16 open among the 34 latest
- Oldest open
- 1.1 years
Most wanted
- #620 How to keep specs consistent and up-to-date with spec-kit?12 reactions · 15 comments
- #5060 [Feature]: Replace hand-written workflow expression parser with a Lark LALR grammar1 reaction · 1 comment
Rates come from the 34 most recently updated issues; the open count and oldest issue cover the whole repository.
Dependencies
Checked packages and import counts
These are the packages checked for known security issues, which may not be all of them. External imports are counted from the source code.
Packages pulled in by these were not checked.
License compatibility
Repo license: MIT · 10 deps checked · 0 potential conflicts.