dachcom-digital/news

Package scaffoldingcaution

The artifact includes a substantial README and changelog, while the absence of packaged tests is normal for a source-oriented Composer bundle. The README explicitly states that the extension is end of life and will receive only compatibility updates, which is a maintenance concern.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months. Combined with the README's compatibility-only statement, this materially raises the risk that defects will not receive substantive fixes.

Repo toolingcaution

Composer build tooling is present, but no security scanning tools were detected. The missing scanning is a hygiene gap rather than evidence that the release is unsafe.

Security policycaution

The repository has no security policy, leaving no documented process for reporting or handling vulnerabilities.

Workflow auditcaution

All four analyzed action references are unpinned, and the audit found one high-confidence medium-severity use of an archived action. A pull_request_target workflow has top-level write permission, but no untrusted checkout or script injection was found, so this is a workflow hygiene concern rather than a severe risk.