varnish/varnish-bundle

Release historydanger

The registry shows only one release, first and latest both on 2012-11-07, with zero releases in the last 12 months. That long gap is a strong indicator of abandonment risk.

Package scaffoldingcaution

The package artifact includes a README, but it has no tests and no changelog. For a dependency, the missing test and change documentation increases risk when underlying platforms or Symfony/PHP versions evolve.

Repo issue activitycaution

Repository activity is effectively dormant: 0 open issues/PRs and no new or closed items in the last month. This does not prove safety, but it is consistent with lack of active maintenance.

Repo package mentioncaution

The linked repository does not match the package name and the README does not mention this package (repo_package_mention=false). That can be normal for subpackages/renames, but here it adds uncertainty about whether the code truly corresponds to the published artifact.

Repo popularitycaution

The repository has very low star/fork/watch counts (3/3/1), which does not directly harm security, but it provides little external maintenance pressure or community verification.