bitbag/wishlist-plugin

The seven-month release gap and no commits in three months reduce confidence in ongoing maintenance. The package is well documented, tested, licensed, and backed by an organization, but all four workflow actions are unpinned and the audit was incomplete.

Latest v4.5.0

Packagist

68%

Total Score

Maintainer Stability

Maturity

Supply Chain

Health Score Breakdown

Release history

The package has 65 releases over more than eight years, but none in the last 12 months; the latest release was seven months ago. This is a meaningful maintenance slowdown despite a historically regular release cadence.

Repo commit activity

The repository recorded no commits and no active maintainers in the last three months. That weakens evidence of current maintenance, although the package had a recent release and the repository is not archived.

Security policy

The repository has no security policy, reducing transparency for reporting and handling vulnerabilities. This is a modest concern because the project is organization-backed and otherwise has a complete repository with tests and documentation.

Workflow audit

All four analyzed action references are unpinned, and one low-confidence cache-poisoning finding was reported; one workflow file also failed auditing. There are no untrusted checkouts or script-injection findings, so this is workflow hygiene rather than a severe dependency risk.