heimrichhannot/contao-head-bundle

Licensecaution

The package declares LGPL-3.0-or-later but its license file is detected as GPL-3.0, so the licensing terms should be verified before adoption despite license files existing in both artifact and repository.

Repo commit activitycaution

There were no commits and no active maintainers in the last three months, a meaningful sign of recently slowed maintenance, although the package had a release during the broader 12-month period.

Repo toolingcaution

The repository uses Composer build tooling, but no security-scanning tools were detected, leaving a modest transparency and maintenance-hygiene gap.

Security policycaution

The repository has no security policy, which makes vulnerability reporting and response expectations less clear.

Workflow auditcaution

The single workflow was fully analyzed with no untrusted checkout or script-injection findings, but all nine action references are unpinned, weakening build reproducibility and update control.