diversworld/contao-diversworld-theme-bundle

Licensecaution

The manifest declares GPL-3.0-or-later and license files are present, but the artifact also contains MIT and Apache-2.0 text that is not covered by the declaration. This creates licensing clarity risk for consumers.

Release historycaution

The package is only 1 day old despite 14 releases, with releases arriving roughly every 18 minutes. That shows active initial publishing but not an established maintenance record.

Repo bus factorcaution

One contributor made all 2 recent commits, leaving maintenance fully concentrated in a single person. The matching user-owned repository provides no organizational handoff evidence to offset that concentration.

Repo commit activitycaution

Only 2 commits were recorded in the last 3 months. Because the repository itself is only 1 day old, this is partly expected, but it provides little evidence of sustained maintenance yet.

Security policycaution

The repository has no published security policy. This is a transparency gap for a package that integrates into a CMS, although it is not by itself evidence of abandonment.