If an approved relationship gets updated, drupal_write_record is called with just array('rid') as a key and so the reverse entry that db_merge created in a previous save will get overridden, creating two entries with the same rid-requester_id-requestee_id.

I just began to work with this module and there is no guidance as to what should happen -- there's no unique key on the table. More, given the bug described in the previous paragraph, adding one in an update would likely fail.

I believe this to be major -- it's unlikely someone gets hit by this bug but if they do, that's bad.

Also, I think some validation is necessary: for a given rid there are only two valid relationships (the forward and the backward) possible and so user_relationships_save_relationship should validate whether the relationship object passed is valid and throw an exception if not.