jpmmartin/sylius-shipping-carriers-plugin

Project backingcaution

The repository is owned by the individual user jpmmartin rather than an organization, so the small two-person contributor base represents the project's actual visible maintenance capacity.

Release historycaution

The package is only 1 day old with two releases, so its maintenance pattern and compatibility over time are not yet demonstrated. The 158 recent repository commits provide useful activity but cannot replace a longer release history.

Security policycaution

The repository has no security policy, leaving vulnerability-reporting expectations and response procedures undocumented. Composer auditing partly compensates for this operational gap but does not replace a policy.

Workflow auditcaution

Both workflows were analyzed successfully with no untrusted checkouts or script injection, and the cache-poisoning findings are low-confidence hygiene warnings. However, all 13 action references are unpinned, which weakens build reproducibility and supply-chain integrity.