open-telemetry/contrib-sdk-bundle

Registry deprecationdanger

Packagist marks the entire package as abandoned and provides open-telemetry/symfony-sdk-bundle as the replacement. This directly indicates consumers should migrate rather than start a new dependency on this package.

Lifecycle scriptscaution

Composer post-install and post-update scripts run during dependency operations, increasing installation complexity and the trust placed in package behavior. No provided signal shows those scripts are unsafe, so this is a hygiene concern rather than a severe risk.

Repo bus factorcaution

Two contributors each account for half of recent commits, avoiding single-contributor concentration. The small contributor count still limits demonstrated maintenance capacity.

Repo toolingcaution

The repository uses Composer, but no security scanning tools were detected. Build tooling is present; the missing scanning is a modest transparency and hygiene gap.

Security policycaution

The repository has no security policy. That makes vulnerability reporting and coordinated disclosure less clear for consumers, though it is not by itself evidence of unsafe code.