spryker/b2c-demo-shop

The project is actively maintained with six contributors and 61 commits in three months. Workflow dependencies are mostly unpinned, including a high-confidence unpinned container image, and reusable workflows inherit secrets; the missing security policy is a smaller transparency gap.

Latest 202608.0

Packagist

78%

Total Score

Maintainer Stability

100

Dependencies

Maturity

100

Supply Chain

Health Score Breakdown

Dependency profile

This demo-shop application declares 239 runtime dependencies, which is substantial but consistent with its broad full-stack application scope. The size increases operational complexity without, by itself, indicating abandonment.

Lifecycle scripts

The package runs post-install and post-update Composer scripts. These add installation complexity, but the signal alone does not show unsafe behavior or make the release unfit.

Security policy

No repository security policy was found, leaving vulnerability-reporting guidance undocumented. This is a modest transparency gap, not evidence of poor maintenance.

Workflow audit

All 10 workflows were analyzed without trigger-to-untrusted-code sinks, and none has top-level write permissions. However, 30 of 32 action references are unpinned, including a high-confidence high-severity unpinned container image, and several workflows inherit secrets; these are meaningful supply-chain hygiene weaknesses.

Vulnerabilities

We didn't find any vulnerabilities for this package.

Package versions

Maintainers

No maintainer information available.

Direct Dependencies

Dependency	Last Release	Score
spryker/uuid Version ^1.0.1	—	—
galbar/jsonpath Version ^1.3.1	—	—
spryker/sitemap Version ^1.0.0	—	—
spryker/tax-app Version ^0.4.3	—	—
spryker/chart-gui Version ^1.1.2	—	—