spryker/shared-cart

Release historycaution

The package has 34 releases over more than eight years, but none in the last 12 months despite a 26-day median historical interval. This indicates a meaningful registry-cadence slowdown, partly offset by recent repository activity.

Repo toolingcaution

Composer build tooling is present, but no security-scanning tool was detected. The missing scanner is a modest repository-hygiene gap rather than evidence of unsafe code.

Security policycaution

The repository has no published security policy. That weakens vulnerability-reporting transparency, although active organization-backed maintenance partly offsets the concern.

Workflow auditcaution

The single workflow was fully analyzed with no injection, untrusted-checkout, or high-confidence audit findings. However, two of four action references are unpinned, leaving avoidable supply-chain hygiene risk; the lack of a top-level permissions block is acceptable on its own.