fond-of-oryx/company-product-list-connector-gui

Release historycaution

Only two releases exist, with none in the last 12 months and the latest published in January 2023; this indicates a meaningful maintenance slowdown for a dependency.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months, despite not being archived and having a push in January 2025. That recent inactivity lowers confidence in ongoing maintenance.

Repo toolingcaution

The project uses Make and Composer, providing build structure, but no security-scanning tooling was detected. That is a modest transparency and hygiene gap rather than a severe risk.

Security policycaution

The linked repository has no security policy, leaving vulnerability-reporting and response expectations undocumented. Organization backing partially offsets the concern but does not remove it.

Workflow auditcaution

The single workflow was fully analyzed with no dangerous triggers, untrusted checkouts, or audit findings, but all three action references are unpinned. The missing top-level permissions block is acceptable on its own; unpinned actions remain a supply-chain hygiene concern.