ecotone/kafka

Licensecaution

The manifest declares the package proprietary while artifact and repository license files are detected as Apache-2.0. The mismatch needs clarification before relying on the package's licensing terms.

Repo bus factorcaution

One contributor made all 14 commits in the last 3 months, creating a concentrated maintenance dependency. The organization-owned repository provides some handoff capacity, but no second active contributor is shown.

Repo toolingcaution

Composer build tooling is present, but no security scanning tools were detected. This is a modest transparency and assurance gap, not evidence of an unsafe release by itself.

Security policycaution

The repository has no security policy, leaving vulnerability reporting and response expectations undocumented. This is a transparency gap for a transport integration package.

Version stabilitycaution

Version 2.0.0-beta.1 is a prerelease, so compatibility may still change, although prereleases represent only 5% of recent releases.