sonata-project/user-bundle

Dangerous workflowscaution

One of seven workflows uses pull_request_target, which can carry elevated workflow risk, but no untrusted checkout or script-injection patterns were detected. The isolated elevated workflow warrants review without making the package unfit to use.

Dependency profilecaution

The bundle declares 24 runtime dependencies, including several Symfony, Doctrine, and Sonata components; that breadth is substantial but consistent with a full-featured framework bundle rather than an unexplained dependency set.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months. Combined with the recent release history, this is a maintenance warning rather than evidence of abandonment, but it lowers confidence in current momentum.

Repo issue activitycaution

There were no new or closed issues or pull requests in the last month, despite two open issues and two open pull requests. This indicates limited recent project interaction and adds a modest maintenance concern.

Repo toolingcaution

The repository uses Composer and Make for builds, but no security scanning tools were detected. Standard build tooling is positive, while the missing scanning coverage is a transparency and maintenance gap.