pbd-kn/contao-besslichschmuck

Licensecaution

The artifact contains a license file, but it identifies MIT while the manifest declares LGPL-3.0-or-later. That mismatch creates a genuine licensing concern despite the release being explicitly licensed.

Package scaffoldingcaution

A GitHub release with notes exists for this exact version, which documents the change. The 27-character README is unusually sparse for a Contao integration and limits consumer guidance.

Project backingcaution

The package and repository are owned by the same individual account rather than an organization. This is consistent ownership, but it provides less visible backing than an organization-supported project.

Repo commit activitycaution

There were zero commits and zero active maintainers in the last three months. Although the repository was pushed recently and the registry had a release about four months ago, this still signals a thin current maintenance window.

Repo toolingcaution

Composer is used as the build tool, but no security-scanning tooling is present. The missing scanning is a modest transparency and maintenance gap, not evidence of unsafe behavior.