yireo/yireo_serverpush

Registry deprecationdanger

Packagist marks the package abandoned and names yireo/magento2-serverpush as its replacement. This directly makes the assessed package unsuitable for a new dependency despite other healthy project evidence.

Repo bus factorcaution

One contributor made all 5 commits in the last 3 months, leaving maintenance dependent on a single active contributor. Organization backing partly compensates for this concentration, but continuity risk remains.

Repo toolingcaution

Composer build tooling is present, but no security scanning tools were detected. The available build tooling is useful, while the missing scanning is a modest transparency gap.

Workflow auditcaution

All 5 workflows were analyzed without failures and have no untrusted checkout or script-injection findings. However, all 6 action references are unpinned and four high-confidence findings identify unpinned or floating container images, creating reproducibility and supply-chain hygiene risk.