vanvasten/magento2-replace-bundled

Release historydanger

The package has had no releases in more than four years, despite 27 releases concentrated on its first day. This is strong evidence of abandonment risk for a dependency.

Repo commit activitydanger

The repository has recorded zero commits and zero active maintainers in the last three months, matching the stale release history rather than showing ongoing maintenance.

Licensecaution

Neither the package nor the linked repository declares or includes a license file. That creates a material legal and adoption risk for an open-source dependency.

Security policycaution

The linked repository has no security policy. For a small package this is a transparency gap, though it is less significant than the absence of maintenance and licensing.

Workflow auditcaution

The single workflow was fully analyzed with no dangerous findings, but its only action reference is unpinned. The missing top-level permissions block is acceptable on its own, while the unpinned action weakens build reproducibility.