unzerdev/shopware6

Healthy and suitable to use, with one maintenance caveat: the package has frequent recent releases, clear source backing, tests, and release notes, but only two commits from one contributor in the last three months. The organization ownership reduces the risk from that concentrated activity, though the repository lacks a security policy and explicit workflow permissions.

Latest 7.1.12

Packagist

78%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Repo bus factor

One contributor made all two commits in the last three months, creating concentrated recent activity. Organization ownership provides some handoff capacity, so this is a caution rather than a severe risk.

Repo commit activity

Only two commits were recorded in the last three months, indicating low recent source activity despite 30 releases in the last year. This is a maintenance caution, though releases may be produced through a workflow not reflected in the sampled commits.

Repo tooling

Composer build tooling is present, but no security-scanning tools were detected. The missing scanning coverage is a modest transparency gap for a payment integration.

Security policy

The repository has no SECURITY.md or other detected security policy, leaving vulnerability reporting expectations unclear.

Token permissions

The only workflow does not declare top-level token permissions. No write permissions were detected, but explicit least-privilege configuration would provide stronger assurance.