heimrichhannot/contao-company-bundle

Licensecaution

The artifact contains a license file, but it is detected as GPL-3.0 while the manifest declares LGPL-3.0-or-later. The release is licensed, but the mismatch reduces transparency and warrants verification.

Release historycaution

The package has 11 releases over about eight years, but no releases in the last 12 months; the latest release was about 18 months ago. This indicates a meaningful slowdown, though the repository was pushed more recently.

Repo commit activitycaution

The repository recorded no commits and had no active maintainers in the last 3 months. This is a direct sign of currently limited maintenance capacity.

Security policycaution

The linked repository has no security policy. This is a transparency gap for reporting and handling vulnerabilities, although it is not evidence of an unmaintained release by itself.

Workflow auditcaution

The single workflow was fully analyzed with no dangerous triggers or audit findings, but all 9 action references are unpinned. That leaves build inputs less reproducible and creates a modest supply-chain hygiene concern.