vmlyr-drupal/kit

Release historydanger

The latest release was published in March 2023, with no releases in the following 12 months; by the September 2026 collection this is more than three years without a release. That materially raises abandonment and compatibility risk.

Dependency profilecaution

The package declares 77 runtime dependencies, including a broad Drupal distribution, increasing upgrade coordination and transitive dependency exposure. Its documented role as a full project template partly explains the size but does not remove the maintenance burden.

Lifecycle scriptscaution

Pre-install and pre-update Composer scripts run package lifecycle actions, adding execution and review surface during installation or updates. This is relevant for a project template even though the scripts are not evidence of malicious behavior.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months. This confirms there is no current development activity, although it does not by itself prove the project is permanently abandoned.

Security policycaution

The linked repository has no security policy, leaving vulnerability reporting and response expectations undocumented. The organization-backed repository provides some compensating project context, but not a published security process.