matiux/broadway-sensitive-serializer-dbal

Lifecycle scriptscaution

Composer post-install and post-update scripts run during dependency operations, adding some execution surface for consumers. The signal does not show that these scripts are malicious or unusually risky, so this is a limited concern.

Maintainerscaution

Only one registry account has publish access. That is a meaningful resilience concern for a user-owned project, especially alongside the lack of recent activity.

Project backingcaution

The registry namespace and repository owner match, providing consistent ownership evidence. The owner is an individual rather than an organization, so there is limited organizational continuity to compensate for the thin maintainer base.

Release historycaution

The package has 10 releases, but its latest release was nearly four years ago and there were no releases in the last 12 months. This materially raises abandonment risk despite the earlier release cadence.

Repo commit activitycaution

There were zero commits and zero active maintainers in the last three months, consistent with the repository's last push nearly four years ago. This is the strongest concern because bug fixes and dependency updates may no longer be happening.