spryker/product-alternative-product-label-connector

Release historycaution

The package has existed since 2018 and released version 1.3.2 recently, but only one release occurred in the last 12 months and the median interval is about 254 days. This suggests deliberate rather than rapid maintenance and is a minor concern, not an abandonment signal.

Repo toolingcaution

The project uses Composer, but no security scanning tools were detected. That is a transparency and hygiene gap, though the repository otherwise has active maintenance and testing evidence.

Security policycaution

No repository security policy was found. This weakens vulnerability-reporting transparency, but it is a minor concern alongside the package's active, organization-backed development.

Workflow auditcaution

All workflows were analyzed with no audit findings, unsafe checkout, or script-injection findings. Two of four action references are unpinned, which is a minor reproducibility weakness; the lack of a top-level permissions block is acceptable on its own.