tourze/wechat-official-account-bundle

Dependency profilecaution

Thirty-five runtime dependencies create a broad maintenance and transitive-risk surface for a Symfony bundle, though the package's substantial integration scope partly explains the size.

Release historycaution

The package is 507 days old with seven releases, but only one release in the last 12 months; this indicates noticeably slower maintenance than its early cadence.

Security policycaution

The repository has no security policy, which reduces disclosed security-reporting guidance, although this is a transparency gap rather than evidence of an unsafe release.

Workflow auditcaution

Both workflows were analyzed with no detected dangerous findings, but all four action references are unpinned, reducing build reproducibility. One workflow also lacks a top-level permissions block, while another uses read-only permissions.