open-telemetry/dev-tools

Dependency profilecaution

The release declares 15 runtime dependencies, including Composer, GitHub API, HTTP, and Symfony components; this is a meaningful dependency surface for a small tool.

Lifecycle scriptscaution

post-install-cmd and post-update-cmd scripts run during Composer operations, increasing installation trust and reproducibility concerns even though this is a development-tool package.

Release historycaution

Only two releases have appeared over about 26 months, with one release in the last 12 months and an interval of about 18 months; the recent 0.2 release partly offsets the sparse cadence.

Repo bus factorcaution

One contributor made all commits in the last three months, creating a concentrated maintenance path; organization backing partly compensates but does not remove the continuity risk.

Security policycaution

No security policy is present, reducing transparency around vulnerability reporting and response expectations.