dbp/relay-mono-bundle

Dependency profilecaution

The bundle declares 27 runtime dependencies across Symfony, Doctrine, API Platform, and related components. This is a substantial dependency surface that increases upgrade and compatibility work, though it is consistent with a full payment integration bundle.

Lifecycle scriptscaution

The package runs a post-autoload-dump install-time script. This is an operational consideration for consumers, but the signal does not show that the script is unsafe or unusually invasive.

Repo bus factorcaution

One contributor made all recorded commits in the last 3 months. Organizational ownership provides some handoff capacity, but the observed contributor base is still concentrated.

Repo commit activitycaution

Only one commit was recorded in the last 3 months, so direct commit activity is light. Recent releases and four merged pull requests partly compensate for this, but the maintenance signal is not as strong as the release cadence alone suggests.

Repo toolingcaution

The repository uses Composer build tooling but reports no security-scanning tools. This is a transparency and preventive-control gap, though it is not evidence of an unsafe release by itself.