jsonschema

Build provenancecaution

The release has no build attestation or trusted-publisher provenance. This is a transparency gap, although it does not by itself indicate that the package is unsafe to use.

Project backingcaution

The repository is owned by an individual rather than an organization, so continuity depends on a relatively narrow project backing structure. This matters more given the recent lack of commits.

Release historycaution

The package has existed for over 14 years with 39 releases, but it has had no releases in the last 12 months. That supports maturity while raising a maintenance concern for a dependency taking a new release.

Repo commit activitycaution

There were zero commits and zero active maintainers during the past three months. Combined with no registry releases in the past year, this is the main abandonment concern despite the repository's recent push timestamp.

Repo issue activitycaution

The repository still receives occasional activity, with one new issue and one new pull request in the past month, but neither an issue nor a pull request was closed or merged during that period. This provides limited evidence of responsiveness.