prestashop/ps_categorytree

Release historycaution

The package has existed since 2016, but only one release was published in the last 12 months and releases have typically been about a year apart. The recent release and active repository partly offset the slow cadence.

Security policycaution

No repository security policy was found, leaving vulnerability reporting expectations undocumented. Dependabot provides some compensating security tooling but does not replace a policy.

Workflow auditcaution

All 19 analyzed action references are unpinned, which weakens build reproducibility. The audit also found high-confidence template-injection patterns, but no untrusted checkout or script-injection sink and no dangerous trigger, so this is workflow hygiene rather than a severe standalone risk.