symfony/mercure

Repo bus factorcaution

All 2 recent commits came from one contributor, creating concentrated maintenance capacity. The Symfony organization provides some handoff capacity, so this is a caution rather than a severe risk.

Repo commit activitycaution

Only 2 commits were recorded in the last 3 months, so recent development activity is modest rather than strong. The recent release and organization backing partly offset this concern.

Repo toolingcaution

Composer build tooling is present, but no security scanning tools were detected. The repository's security policy and clean workflow audit provide partial compensation.

Workflow auditcaution

All 3 workflows were analyzed, all use read-only permissions, and no dangerous audit findings or untrusted checkouts were reported. However, all 6 action references are unpinned, leaving avoidable workflow supply-chain drift.