deployecommerce/magento-community-patches

Release historycaution

This is the package's first release, published less than a day ago, so there is no track record for maintenance or release reliability yet.

Repo commit activitycaution

No commits or active maintainers were recorded in the last three months. Because the package itself is less than a day old, this is limited evidence of abandonment but still leaves maintenance capacity unproven.

Repo toolingcaution

Composer build tooling is present, but no security scanning tools were detected, leaving an avoidable security-process gap for a package that distributes security patches.

Security policycaution

The repository has no security policy, which reduces transparency for reporting vulnerabilities in a security-focused plugin.

Workflow auditcaution

All 18 workflow action references are unpinned, three workflows grant top-level write permissions, and a medium-confidence template-injection finding was reported. The audit found no untrusted checkout or script-injection path, which limits the severity but does not remove the workflow hygiene concern.