octobercms/october: technical due diligence, read from its repository

50% of commit subjects are exact repeats of another subject, and subject length varies by only 32.7 characters. A log written by someone explaining their reasoning to a future reader does not look like this. The log is therefore weak evidence of intent, whatever the code is like.

The median source file here is 82 lines. 12 files exceed 1,000 lines, the largest being 14,879. Size is not a defect on its own — some problems genuinely live in one place — but these are where merge conflicts, review fatigue and single-owner knowledge concentrate, and they are the first thing that slows an inheriting engineer down.

Of five ordinary markers — CI workflows, CODEOWNERS, a pull-request template, pre-commit hooks, contribution guidance — 1 is present: contribution guidance. Branch protection itself is a GitHub setting rather than a file, so this is a reading of proxies and not of the rules themselves. What it does establish is that the process is not written down anywhere a new engineer would find it.

Deleted lines per line added rose from 0.34 to 0.76 between the first and second halves of this history. Rework is normal and often healthy, but a rising ratio means an increasing share of the team's time is spent replacing code that already exists rather than building what does not. Whether that is deliberate repayment or churn is a question for the team.

Dependency versions are declared as ranges and no lockfile is committed, so a build today does not necessarily produce what a build last month produced. That matters twice over in a transaction: the thing being bought cannot be reproduced exactly, and a compromised upstream release arrives without anyone choosing to take it.

12 places read data with a deserialiser that executes what it reads (PHP `unserialize`). That is safe on data the system wrote itself and remote code execution on anything else. Ask where each one's input comes from.

91 places set HTML from a value that is neither a literal nor passed through a sanitiser. Where the value can come from a user, that is stored cross-site scripting, and it is the first thing a buyer's security review looks for in a frontend.

Third-party code is committed into this repository without any statement of the terms it arrived under. Unknown terms are harder to deal with than inconvenient ones: an awkward licence can be complied with, an absent one cannot. Each of these needs its origin established before the code changes hands.

LICENSE.md grants EULA: source available, not open source; use, copying and redistribution limited to what the agreement grants. The reading comes from the licence's own title and clauses. Whether the terms fit the buyer's intended use, and whether any paid licence transfers with the code, is a question for counsel and the licensor.

The root licence changed 1 time(s). The latest terms restrict what users, hosts or a buyer may do in ways the earlier ones did not. Code taken under the old terms stays under them, so both matter in diligence.