spryker/product-attribute

This is a healthy, mature release with a long history since 2017, five releases in the last 12 months, stable versioning, an active non-archived organization-owned repository, and recent contributions from six maintainers. The artifact and repository include documentation, tests, changelog, license, substantial source files, and CI workflow safeguards, while the package is not deprecated and has no install-time lifecycle scripts. The main reservations are the absence of a repository security policy and explicit top-level GitHub Actions token permissions, no detected security-scanning tooling, and negligible public popularity or issue/PR activity; these are transparency and hardening gaps rather than evidence of abandonment.

Latest 1.22.0Packagist

Health Score Breakdown

Repo popularitycaution

The repository has zero stars and forks and six watchers, indicating little public popularity; this is a supporting caution only because popularity is not decisive for an organization-owned package.

Repo toolingcaution

Composer build tooling is present, but no security-scanning tools were detected; this is a hardening gap for supply-chain transparency rather than a direct abandonment signal.

Security policycaution

The repository has no SECURITY.md or other detected security policy, reducing vulnerability-reporting transparency for dependents.

Token permissionscaution

The only workflow lacks top-level token permissions, and no read-only or other explicit permissions were detected; explicit least-privilege declarations would provide stronger CI hardening.

View all 19 health checks

Vulnerabilities

We didn't find any vulnerabilities for this package.

Direct Dependencies

Dependency	Last Release	Score
spryker/kernel Version ^3.30.0	—	—
spryker/locale Version ^3.0.0 || ^4.0.0	—	—
spryker/product Version ^5.2.0 || ^6.0.0	—	—
spryker/glossary Version ^3.8.0	—	—
spryker/transfer Version ^3.27.0	—	—

View All 12 Dependencies