cors/data-definitions

Usable with caveats: the release is actively developed, documented, licensed, and backed by an organization, but it is only one day old and maintenance is concentrated in one contributor. Review its pull-request workflows before adopting it, since two use elevated pull-request triggers and one checks out untrusted code.

Latest 2026.1.1

Packagist

68%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Dangerous workflows

Two workflows use pull_request_target and one checks out untrusted code, creating avoidable CI exposure. No script injection was detected, but these workflow patterns still warrant review before trusting the repository's automation.

Release history

The package is only 1 day old with two releases, so there is not yet enough history to demonstrate long-term maintenance or release stability.

Repo bus factor

Two contributors were active, but one produced 86.7% of the last three months' commits. Organization backing provides some handoff capacity, yet practical maintenance remains concentrated.

Repo tooling

The repository uses Composer build tooling, but no security-scanning tool was detected. The build setup is present, while security-process transparency is limited.

Security policy

No repository security policy was found, leaving vulnerability-reporting and response expectations undocumented.

Vulnerabilities

We didn't find any vulnerabilities for this package.

Package versions

Maintainers

CORS GmbH

Direct Dependencies

Dependency	Last Release	Score
league/csv Version ^9.7	—	—
nyholm/psr7 Version ^1.5	—	—
jms/serializer Version ^3.17	—	—
pimcore/pimcore Version ^2026.2	—	—
openspout/openspout Version ^4.23	—	—