sonata-project/block-bundle

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months. This is a meaningful maintenance concern, although recent releases and a current repository push provide some counterweight.

Repo issue activitycaution

There was no new or closed issue or pull-request activity in the last month, with only one open issue and two open pull requests. This adds modest evidence of limited current activity.

Repo toolingcaution

The project uses Composer and Make, but no security-scanning tools were detected. The missing scanning is a hygiene gap rather than evidence that the package is unsafe.

Security policycaution

The repository has no security policy, leaving vulnerability-reporting expectations and handling procedures undocumented. The organization-backed project and other repository documentation partly reduce the transparency concern.

Workflow auditcaution

All 33 analyzed action references are unpinned, and a high-confidence audit found an unpinned container image in the documentation workflow. The pull_request_target trigger has no untrusted checkout or script-injection sink, but the workflow supply-chain controls remain weak.