micoli/symfony-cartography

Lifecycle scriptscaution

The package runs post-install and post-update Composer scripts, so dependency operations execute publisher-provided commands. This is a modest supply-chain and maintenance concern without evidence here that the scripts are harmful.

Package scaffoldingcaution

The artifact includes a README and tests, but the README is for Symfony's demo application rather than this bundle, which materially weakens consumer documentation. The absence of a changelog is normal packaging practice and is not a concern by itself.

Release historycaution

The last release was in June 2023, with no releases in the past 12 months. That long gap is substantial abandonment evidence, though the six-release history shows the package was previously published actively.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months, consistent with the registry's long release gap. That points to a real maintenance and abandonment risk.

Security policycaution

The repository has no published security policy, leaving vulnerability reporting and response expectations unclear. This is a transparency gap for a package with no active maintenance evidence.