swag/language-pack

Package scaffoldingdanger

The artifact has a substantial README, tests, and release notes, but the README explicitly says the extension is obsolete and will no longer be compatible with Shopware 6.8. That compatibility warning materially limits its suitability despite the otherwise healthy scaffolding.

Repo package mentioncaution

The repository name does not exactly match the package name and its README does not mention the package, which weakens package-to-source traceability. The dedicated SwagLanguagePack repository and organization backing provide some compensation, but not a complete one.

Security policycaution

The repository has no security policy, leaving vulnerability-reporting and response expectations undocumented. This is a transparency gap, but not evidence that the release is unsafe by itself.

Workflow auditcaution

All 12 analyzed action references are unpinned, and three workflows grant top-level write permissions, creating workflow hygiene concerns. High-confidence template-injection findings were also reported, but no untrusted checkout or script-injection trigger was found, so they do not independently establish a severe risk.