opengate/composer-merge-plugin

Release historycaution

This is the only release, published about 2 years and 3 months ago, with no releases in the last 12 months. That provides limited evidence of an established maintenance cycle.

Repo commit activitycaution

There were no commits and no active maintainers in the last 3 months. Combined with the single-release history, this is meaningful evidence of weak current maintenance.

Repo popularitycaution

The repository has zero stars, forks, and watchers. Popularity is only supporting evidence, but these counts provide no external sign of adoption or maintenance attention.

Security policycaution

The repository has no security policy. This is a transparency and reporting gap, although it is less serious than the lack of recent development activity.

Workflow auditcaution

The sole workflow is fully analyzed with no untrusted checkout or script-injection findings, but both action references are unpinned and a high-confidence unsound-condition finding reports a condition that always evaluates true. These are workflow hygiene concerns rather than a standalone dependency-blocking risk.