glpi-project/glpi: technical due diligence, read from its repository

The median source file here is 107 lines. 198 files exceed 1,070 lines, the largest being 17,556. Size is not a defect on its own — some problems genuinely live in one place — but these are where merge conflicts, review fatigue and single-owner knowledge concentrate, and they are the first thing that slows an inheriting engineer down.

The suite is configured to retry failing tests (playwright.config.ts). A retry turns a flaky test green without saying why it failed, so a green build means the tests passed eventually. Ask how many retries a typical run needs, and which tests need them.

7 files were marked deprecated over two years ago and still are, the oldest since Jan 2022. A deprecation is a promise to remove. Ask what still depends on these, and whether removing them is scheduled.

56 places set HTML from a value that is neither a literal nor passed through a sanitiser. Where the value can come from a user, that is stored cross-site scripting, and it is the first thing a buyer's security review looks for in a frontend.

The root licence changed 1 time(s). Code taken under earlier terms stays under them; check which terms any fork or customer relied on.

The newest was published on 2026-11-03. A project that publishes advisories is telling its users about its fixes, and the count and pace say how much security work it carries. Whether 9 of them are fixed in the code you ship could not be told from this history: its version is only known to be at least 12.0.1. Answer lives in: the release you run, set against each fixed version. The record is incomplete: NVD: 17 records name glpi with nothing tying them to this repository (CVE-2012-1037, CVE-2012-4002, CVE-2012-4003, …).

Nothing in the service initialises an error reporter (Sentry, Rollbar, Bugsnag, Honeybadger or an APM agent). An exception in production reaches a person only if someone is reading the logs, which usually means a customer reports it first.

3 images in the deployment configuration are named without a version or as `latest`. A redeploy can change the software without a commit, a rollback has nothing to roll back to, and nobody can say from the repository what is running.