terminal42/contao-webpack-encore

Release historycaution

The package has only 2 releases, with none in the last 12 months; the latest release was 19 months ago. This weakens confidence in ongoing maintenance, although the repository remains active enough to avoid treating the package as abandoned outright.

Repo commit activitycaution

There were 0 commits and 0 active maintainers in the last 3 months. Combined with no releases in the last year, this is a meaningful maintenance concern.

Repo toolingcaution

Composer is used for the build, but no security scanning tool is configured. That is a transparency and hygiene gap, though it is not evidence that the release is unsafe by itself.

Security policycaution

The repository has no security policy, leaving vulnerability reporting and response expectations undocumented. This is a modest transparency gap for a dependency.

Workflow auditcaution

The only workflow was fully analyzed, uses read-only job permissions, and has no reported audit findings. However, both of its 2 action references are unpinned, creating a supply-chain hygiene weakness.