spryker/company-user-data-import

Release historycaution

The package has five releases since September 2018, but none in the last 12 months and its latest registry release was over three years ago. Recent repository commits partly compensate for the stale registry cadence, so this is a maintenance caution rather than an abandonment verdict.

Repo toolingcaution

Composer build tooling is present, but no security-scanning tools were detected. The missing scanning is a modest process gap, not evidence of unsafe code by itself.

Security policycaution

The repository has no security policy. That reduces transparency around vulnerability reporting, although it does not by itself indicate abandonment or unsafe behavior.

Version stabilitycaution

Version 0.2.1 is not on a stable major version, but it is not a prerelease and recent prerelease share is zero. The versioning profile is acceptable with some API-maturity uncertainty.

Workflow auditcaution

The sole workflow was fully analyzed with no audit findings, no untrusted checkout or script injection, and no broad write permissions. Two of four action references are unpinned, which is a minor reproducibility and supply-chain hygiene gap.