componenta/cycle

Dependency profilecaution

The package declares 13 runtime dependencies, reflecting a broad integration surface for its ORM and framework role. That increases maintenance exposure somewhat, but the dependency set is coherent with the documented package purpose.

Repo bus factorcaution

All 10 recent commits came from one contributor, creating concentration risk. Organization ownership provides some handoff capacity, so this is a caution rather than a severe abandonment signal.

Repo toolingcaution

The project uses Composer build tooling, but no security scanning tool was detected. The missing scanner reduces transparency around automated security checks without indicating a direct release defect.

Security policycaution

The linked repository has no security policy. This is a transparency and vulnerability-reporting gap, although it is not evidence that the release is unsafe.

Workflow auditcaution

The single workflow was fully analyzed, uses read-only permissions, and has no detected dangerous sinks or audit findings. However, all 3 action references are unpinned, leaving the build exposed to dependency-reference drift.