sylius/product-bundle-plugin

Release historycaution

The package is 457 days old with five releases, but only one release in the last 12 months; this suggests a relatively limited release cadence and merits some maintenance caution.

Repo bus factorcaution

Two contributors remain active, and organization ownership provides some handoff capacity, but one contributor made five of six recent commits, leaving meaningful concentration risk.

Repo toolingcaution

Composer build tooling is present, but no security-scanning tool was detected; this is a process gap, not evidence of unsafe code by itself.

Token permissionscaution

One workflow lacks top-level permissions and another declares write permissions; although this is not automatically unsafe, the incomplete and elevated permission posture reduces workflow transparency.