demos-europe/demosplan-core

Dependency profilecaution

The package declares 144 runtime dependencies and 17 development dependencies, creating substantial upgrade and compatibility surface. Its application-sized scope makes this understandable, but it increases maintenance complexity.

Lifecycle scriptscaution

The package runs post-install, post-update, and pre-autoload-dump Composer scripts. These are meaningful install-time behavior and deserve awareness, but they are ordinary for a Symfony/Composer application and are not evidence of poor health by themselves.

Security policycaution

No repository security policy was found. For a large web application with many dependencies, this is a transparency gap for reporting and handling vulnerabilities.

Workflow auditcaution

All eight workflows were analyzed with no untrusted checkout or script-injection count, but one high-confidence template-injection finding and two high-confidence adhoc-package findings were reported. Fifteen of 23 action references are unpinned, so workflow supply-chain hygiene is incomplete even though no workflow has top-level write permissions.