spryker/testify-backend-api

Release historycaution

The package has four releases over about two and a half years, with two releases in the last 12 months and a median interval of about nine months. This is deliberate but slow, so it is a modest maintenance concern.

Repo toolingcaution

Composer build tooling is present, but no security-scanning tooling was detected. The missing scanning is a modest process gap, not evidence that the package is unsafe.

Security policycaution

The repository has no security policy, leaving no documented process for reporting or handling vulnerabilities. This lowers transparency but does not by itself indicate abandonment.

Version stabilitycaution

Version 0.1.3 is not a prerelease, but the package remains below 1.0, indicating a less mature compatibility promise. That is a caveat rather than a severe adoption risk.

Workflow auditcaution

The single workflow was fully analyzed with no injection or high-severity findings, and it has no top-level write permissions. Two of four action references are unpinned, which creates a minor reproducibility and workflow-integrity gap.