vanwittlaer/what3words

The workflow relies on three unpinned actions and archived actions, while no security policy is published. MIT licensing, a focused dependency set, and a README make adoption clearer.

Latest 1.1.1

Packagist

58%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Release history

The latest release was about 2 years 6 months ago, with no releases in the last 12 months. This is a meaningful maintenance concern for a production Shopware plugin.

Repo commit activity

The repository recorded 0 commits and 0 active maintainers in the last 3 months, consistent with the long gap since the latest release. That weakens evidence of ongoing maintenance.

Repo popularity

The repository has 2 stars and 2 forks, providing little community evidence or backup maintenance capacity. Low popularity alone is not disqualifying for a small focused plugin.

Security policy

The linked repository has no security policy, leaving vulnerability reporting and response expectations undocumented. The package's MIT license and focused scope compensate for transparency only partially.

Workflow audit

All 3 action references are unpinned, and the workflow contains two high-confidence medium-severity archived-action findings. No untrusted checkout or script-injection path was found, so this is a hygiene concern rather than a severe risk.