Documentation and release notes are present, while the organization-owned project provides some continuity despite limited recent contributor activity. The build uses security scanning, but every workflow action reference is unpinned and this alpha release is less predictable than the established line.
68%
Total Score
63
93
50
All recent commits came from one contributor, concentrating short-term maintenance. Organization ownership provides some handoff capacity, but no second recent contributor is shown.
Only two commits were recorded in the last three months, made by one active maintainer, which is a thin recent maintenance signal despite the frequent registry release history.
The repository has 13 open pull requests and one new pull request in the last month, but none were merged and no issues were closed during that period, suggesting some unresolved maintenance backlog.
No repository security policy was found, leaving vulnerability-reporting guidance undocumented; this is a modest transparency gap rather than evidence of abandonment.
Version 6.0.0-alpha.1 is a prerelease while the recorded latest stable version is 5.4.6, so this release carries more compatibility uncertainty than the established major line.
We didn't find any vulnerabilities for this package.
| Dependency | Last Release | Score |
|---|---|---|
craftcms/cms Version ^6.0.0-alpha.4 | — | — |
spatie/schema-org Version ^3.0.0 | — | — |
openspout/openspout Version ^v4|^v5 | — | — |
craftcms/yii2-adapter Version ^6.0.0 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.