keboola/dockerbundle

Lifecycle scriptscaution

The package runs post-install and post-update Composer scripts, which expand install-time behavior and deserve extra trust in the publishing project.

Release historycaution

The package has only one release, published over 11 years ago, with no releases in the last 12 months. This weakens confidence in the registry release as a maintained dependency, despite recent repository activity.

Repo issue activitycaution

The repository has 23 open issues and no issues closed in the last month, although one pull request was merged. This suggests unresolved maintenance work but not clear abandonment.

Repo package mentioncaution

The repository name does not exactly match the package name and its README does not mention the package, leaving some uncertainty that the linked source is the intended project. The shared organization and Docker Bundle content provide partial context but do not remove that gap.

Repo toolingcaution

Composer is used for builds, but no security scanning tools were detected. The missing scanning is a hygiene weakness rather than evidence that the package is unsafe.