arout/rhapsody-app

Dependency profilecaution

The package declares 17 runtime dependencies spanning framework, database, payment, mail, cache, and image functionality. This is substantial dependency surface for a young project and increases maintenance exposure.

Lifecycle scriptscaution

Composer defines post-root-package-install, pre-update-cmd, and post-update-cmd scripts. These are a small supply-chain exposure because package-manager operations execute project-defined commands, though no dangerous behavior is shown here.

Maintainerscaution

Only one account has registry publish access. That is consistent with the linked user-owned project, but it leaves publishing dependent on a single person.

Project backingcaution

The repository is owned by a user account rather than an organization, so there is no organizational backing to offset the concentrated contributor and publishing base.

Release historycaution

The package is only 96 days old but has 40 releases, including 40 in the last 12 months and a median interval of about 15 hours. This shows strong activity but limited evidence of mature, sustained maintenance.