Its GPL-3.0-or-later license, release notes, and repository/package match improve transparency. The workflow leaves both actions unpinned and the repository has no security scanning, so pin this version if maintenance needs are modest.
62%
Total Score
50
88
50
The package has 14 releases since July 2022, but none in the last 12 months and its latest release was 18 months ago, indicating a meaningful maintenance slowdown.
The repository recorded no commits and no active maintainers in the last three months, which raises the risk that fixes or compatibility updates may be delayed.
Composer is used as the build tool, but no security scanning tool was detected. This is a modest transparency and maintenance gap rather than a severe dependency risk.
The single workflow was fully analyzed without untrusted checkouts, script injection, or high-severity findings, but both action references are unpinned, weakening build reproducibility.
We didn't find any vulnerabilities for this package.
No maintainer information available.
| Dependency | Last Release | Score |
|---|---|---|
b13/container Version ^1.6 || ^2.0 || ^3.0 | — | — |
typo3/cms-core Version ^11.5 || ^12.4 || ^13.4 | — | — |
friendsoftypo3/headless Version ^3.0 || ^4.0 || dev-master | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.