sylius/gmv-bundle

Release historycaution

The package has only three releases, with none in the last 12 months; its last registry release was about 21 months ago. This is meaningful evidence of slowing maintenance, though the package is still relatively young.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months, with the last push about 21 months ago. This materially raises abandonment risk.

Repo toolingcaution

Composer build tooling is present, but no security scanning tool was detected. The missing scanner is a modest transparency and maintenance gap, not evidence of an unsafe release by itself.

Workflow auditcaution

All three workflow action references are unpinned, weakening build reproducibility. The audit also found a low-confidence cache-poisoning pattern; because it is low confidence and cache poisoning is otherwise hygiene, it adds only limited concern.