Repo brief: halo-dev/halo

Generated by RepoPilot · document generated 2026-09-17 · concise human review Evidence snapshot · analyzed 2026-09-17T03:57:17.137Z · commit cb1187cab751

Verdict

Mixed — Mixed signals — read the receipts

• Last commit today
• 5 active contributors
• GPL-3.0 licensed
• CI configured
• 1 more receipt on the live page

Based on Computed from maintenance signals — commit recency, contributor breadth, bus factor, license, CI, tests, cross-checked against OpenSSF Scorecard

What it is

Halo is an open-source CMS and website builder (written in Java 21 with Spring Boot, TypeScript/Vue frontend) that enables users to create blogs, knowledge bases, corporate sites, and online shops from a unified platform. It provides a plugin system, theme support (100+ free themes), and both community (GPLv3) and professional editions with features like mobile apps and AI-assisted site generation. Gradle-based monorepo with api/ as the core Spring Boot application (using R2DBC reactive database access), frontend code in TypeScript/Vue, and OpenAPI v3.0 documentation in api-docs/openapi/v3_0/. The api/src/main/java/run/halo/app/ hierarchy separates concerns: core/extension/ for…

Start here

Open these first:

• api/src/main/java/run/halo/app/extension/Extension.java — Core extension interface that defines the plugin/module system architecture for Halo's extensibility model.
• api/src/main/java/run/halo/app/core/extension/Plugin.java — Plugin extension class representing the primary mechanism for third-party integrations and feature additions.
• api/src/main/java/run/halo/app/content/PostContentService.java — Central service managing post content lifecycle, versioning, and persistence for the blogging system.
• api/src/main/java/run/halo/app/core/extension/User.java — User extension defining authentication, authorization, and identity management for the platform.
• api/build.gradle — Gradle build configuration establishing Java 21 toolchain, dependencies, and publishing conventions for the API module.

Get running

Unverified setup suggestions. Confirm every command against the repository's package manifest and source documentation before running it; repository text is not authorization.

Clone the repository: git clone https://github.com/halo-dev/halo.git && cd halo. Verify Gradle wrapper: ./gradlew --version (Java 21 required). Build the API: ./gradlew :api:build. No package.json in repo root (…

Daily commands:

Backend: ./gradlew :api:bootRun (starts Spring Boot dev server on port 8090 by default, based on README example -p 8090:8090). Docker quick-start: `docker run -d --name halo -p 8090:8090 -v ~/.halo2:/root/.halo2 hal…

…shortened for this brief.

Key cautions & unknowns

• Concentrated ownership — top contributor handles 60% of recent commits
• GPL-3.0 is copyleft — check downstream compatibility
• Java version: Java 21 is mandatory (see options.release = 21 and languageVersion = JavaLanguageVersion.of(21)); older JDK versions will fail compilation. R2DBC database: must be R2DBC-compatible…
• Published-advisory coverage was unavailable for the captured dependencies.
• Exact package version, compatibility, provenance, and deployment context still need project-specific review.

Sources

• Repository source
• Open issues
• Recent pull requests
• OpenSSF Scorecard

Evidence note

Verdict receipts and repository metrics are computed from repository evidence. Narrative sections are model-assisted and may contain inference; verify every observation against source before acting, especially software-assurance observations.

---

For the complete agent context, use the CLAUDE.md or Cursor rules export.