setono/sylius-callout-plugin

Release historycaution

The package has 19 releases since September 2019, but none in the last 12 months; the latest release was about 13 months ago. This weakens confidence in ongoing maintenance.

Repo commit activitycaution

There were zero commits and zero active maintainers in the last three months, consistent with the absence of releases in the last year. This is a meaningful maintenance concern for an alpha package.

Security policycaution

The repository has no security policy, leaving vulnerability-reporting and response expectations undocumented. This is a transparency gap, though it is not evidence of unsafe code.

Version stabilitycaution

The assessed release is explicitly an alpha version, so compatibility and behavior may still change despite the package having a stable major version designation.

Workflow auditcaution

All 20 analyzed action references are unpinned, and the audit found a high-confidence template-injection issue. The workflows had no untrusted checkout or dangerous trigger, so this is workflow hygiene and supply-chain caution rather than a standalone severe verdict.