setono/sylius-wishlist-plugin

Release historycaution

The package has only 2 releases across roughly 20 months, with about 504 days between releases and 1 release in the last 12 months. This suggests slow maintenance, though the latest release is recent and the repository remains active.

Repo bus factorcaution

All recent commits came from one contributor. Organization ownership provides some handoff capacity, but no second active contributor is shown to demonstrate that resilience.

Repo commit activitycaution

Only 3 commits from 1 active maintainer were recorded in the last 3 months, indicating limited recent maintenance activity. The repository was pushed recently, so this is slowing activity rather than clear abandonment.

Security policycaution

The linked repository has no published security policy. This reduces transparency for reporting and handling vulnerabilities, although it does not by itself indicate an unsafe release.

Workflow auditcaution

The single workflow was fully analyzed with no dangerous audit findings or untrusted execution paths, but all 22 action references are unpinned. The absent top-level permissions block is acceptable on its own; unpinned actions remain a supply-chain hygiene gap.