spryker/url-collector

Dependency profilecaution

The release declares 11 runtime dependencies, creating a moderately broad dependency surface for a module, though the profile is explicit and ecosystem-aligned.

Release historycaution

The package has had no registry release in more than two years and only seven releases since 2018, which lowers confidence in release freshness. Recent repository activity provides some compensation.

Repo toolingcaution

Composer build tooling is present, but no security-scanning tool was detected, leaving a modest assurance gap.

Security policycaution

The repository has no security policy, reducing transparency about vulnerability reporting and response expectations.

Workflow auditcaution

The single workflow was fully analyzed with no injection or high-severity findings; two of four action references are unpinned, which is a minor build-reproducibility concern rather than a severe risk.