sylius/price-history-plugin

Lifecycle scriptscaution

The package defines post-install and post-update Composer scripts, which increase installation-time behavior and warrant review before use. No provided signal shows that these scripts are unsafe, so this is a limited supply-chain hygiene concern.

Release historycaution

The package has had no release in over three years, with zero releases in the last 12 months. That materially raises maintenance and compatibility risk despite a historically active initial release cadence.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months. Although it is not archived, the lack of recent activity is a concrete abandonment concern.

Token permissionscaution

The single workflow has no top-level token permissions declaration. It does not request top-level write access, but the missing explicit restriction is a workflow hygiene gap.