Description: ------------ package.xml states that this package is licensed under PHP license, but CAPTCHA/Driver/Numeral.php is clearly licensed under 3-clause BSD license.

This isn't a problem in this package, we simply utilized the same repo folder for 2 packages since it started out as one and we didn't want to lose the CVS history. The package in question with the BSD license can be found here: http://pear.php.net/package/Text_CAPTCHA_Numeral

That's all fine but you should state complete licensing info for whatever you distribute in this package for downstream packagers and users. From what repo folder the file comes is entirely irrelevant.

Actually this was my bad, seems the Numeral thing exists in two places, I'll talk to the two authors in question and ask them to relicense the Numeral file in question.

Thank you for your bug report. This issue has been fixed in the latest released version of the package, which you can download at http://pear.php.net/get/ Version 0.4.0 uses the BSD license for all components.