elasticms/core-bundle

Dependency profilecaution

The release declares 34 runtime dependencies, including several framework and extension requirements. That increases integration and update complexity, though it is consistent with a substantial core bundle.

Repo toolingcaution

Composer is used as a build tool, but no security scanning tool is reported. The absence of scanning is a modest transparency gap, not evidence of abandonment.

Security policycaution

The repository has no security policy. This weakens the project's documented vulnerability-reporting process, although active releases and organizational backing partly compensate.

Workflow auditcaution

All workflows were analyzed and no audit findings or untrusted checkouts were reported. However, the single workflow has one unpinned action and no top-level permissions block, leaving minor automation-hygiene concerns.