modx/revolution

Licensecaution

The package declares GPL-2.0+ and includes license files, but the detected artifact license is GPL-2.0, so the declaration and detected text do not fully match.

Lifecycle scriptscaution

Install-time scripts run during project creation and autoload generation. These are relevant execution hooks, but their presence is not by itself evidence of poor maintenance or unsafe dependency health.

Repo toolingcaution

Composer build tooling is present, but no security-scanning tool was detected, leaving a modest transparency and hygiene gap.

Version stabilitycaution

This is a stable-major release, but every recent release is marked prerelease, which adds some release-channel uncertainty for consumers.

Workflow auditcaution

All three workflows were analyzed without high- or medium-severity findings or unsafe untrusted checkouts, but all 9 action references are unpinned, reducing build reproducibility and supply-chain hygiene.