spryker-feature/wishlist

The package has a clear README, release notes, and an explicit license, with no install-time scripts. Its organization-backed repository is current, but recent commits come from one contributor and every workflow action is unpinned, leaving maintenance and build-integrity concerns.

Latest 202608.0

Packagist

70%

Total Score

Maintainer Stability

Maturity

Supply Chain

Health Score Breakdown

Repo bus factor

One contributor made 100% of the last 3 months' commits. Organization backing helps with handoff potential, but no second active contributor is shown, so the current bus factor remains a concern.

Repo commit activity

There were 4 commits in the last 3 months, showing recent activity, but all were produced by one active maintainer. That limits evidence of distributed maintenance capacity.

Repo tooling

Composer is used for builds, but no security scanning tools were detected. This is a hygiene gap rather than evidence that the release is unsafe.

Security policy

The repository has no security policy. That reduces disclosure transparency for a maintained package, although it does not by itself indicate abandonment.

Workflow audit

The single workflow was fully analyzed with no dangerous triggers, untrusted checkouts, or audit findings, but all 4 action references are unpinned. Unpinned actions weaken build reproducibility and supply-chain integrity.