picqer/bol-retailer-php-client

Repo commit activitycaution

The repository recorded 0 commits and 0 active maintainers in the last 3 months. A recent release and two releases in the last 12 months provide some compensation, but current maintenance activity remains a concern.

Security policycaution

The repository has no security policy, which weakens vulnerability-reporting transparency. The package is organization-backed and uses a matching repository, providing some compensating project context.

Workflow auditcaution

All 3 referenced actions are unpinned, reducing build reproducibility. The single workflow was fully analyzed and has no untrusted checkouts, script injection, or write-wide token permissions, so this is a hygiene concern rather than a severe risk.