bitbag/sylius-ing-plugin

Registry deprecationdanger

Packagist marks the entire package as abandoned and names bitbag/sylius-imoje-plugin as its replacement. This is a major adoption risk even though the linked repository is not archived.

Repo commit activitycaution

The repository recorded 0 commits and 0 active maintainers in the last three months. The recent release provides some evidence of activity, but current maintenance momentum is unclear.

Security policycaution

The linked repository has no security policy. This reduces disclosure transparency, although the organization backing and active release history partly compensate.

Workflow auditcaution

All 8 analyzed action references are unpinned, weakening build reproducibility; the cache-poisoning findings are low-confidence and therefore add no material risk on their own.