@img/sharp-libvips-linuxmusl-arm64

Licensecaution

The manifest declares LGPL-3.0-or-later, while the linked repository license file was detected as Apache-2.0; this mismatch should be clarified even though the repository is licensed.

Repo package mentioncaution

The repository name does not match the package and its README does not mention the package, creating uncertainty about the exact package-to-repository relationship despite the repository containing platform package definitions.

Security policycaution

The repository has no published security policy, leaving reporting and response expectations unclear. Active maintenance and Dependabot provide some compensating security practice.