jsonpointer

Release historycaution

The latest registry release was in July 2022, with no releases in the last 12 months, indicating a long release gap. Recent repository commits partly offset this, but do not replace a current published release.

Repo bus factorcaution

One contributor made all 4 recent commits, giving the project a concentrated maintenance base. The linked repository is user-owned, so there is no organization backing shown to compensate for that concentration.

Repo toolingcaution

No build tool or security scanning tool was detected. The package is small and has no runtime dependencies, which limits the impact, but the repository provides little automated assurance.

Security policycaution

The repository has no security policy, leaving no documented channel or process for handling vulnerability reports. This is a transparency and maintenance gap for a package intended to be used as a dependency.

Workflow auditcaution

The only workflow was fully analyzed and has no untrusted checkout or script-injection findings, but both of its action references are unpinned. That leaves avoidable workflow supply-chain drift risk.