openpsa/midcom

Dependency profilecaution

Thirty-eight runtime dependencies make the package relatively complex to update and audit, including a broad Symfony surface and several embedded web components. The profile is manageable but increases maintenance exposure.

Licensecaution

The package declares LGPL-2.1-or-later and includes license files, but the artifact also contains MIT and BSD-3-Clause licensed components not covered by that declaration. This is licensed, though the bundled-license picture needs careful review.

Lifecycle scriptscaution

The package runs post-install and post-update Composer commands, which expands the trust placed in installation and update operations. This is a supply-chain hygiene concern even though it is not evidence of malicious behavior.

Project backingcaution

The repository is owned by a personal GitHub account rather than an organization, so there is no provided evidence of organizational handoff capacity. This makes the concentrated commit pattern more significant.

Repo bus factorcaution

One contributor made 47 of 52 recent commits, or about 90%, despite three contributors being active. That concentration creates a meaningful continuity risk for a user-owned repository.