websocket

Build provenancecaution

No build attestation or trusted-publisher setup is reported, so consumers cannot verify how this release was produced. This lowers release transparency but is not an abandonment verdict by itself.

Dependency profilecaution

Six runtime dependencies are a moderate dependency surface for a WebSocket implementation. This is not excessive, but it increases the maintenance burden compared with a nearly self-contained package.

Maintainerscaution

Only one registry account has publish access. That is a thin publishing base for a long-lived package, although the repository has an established project history.

Release historycaution

The package has 56 releases since July 2011, but none in the last 12 months and its latest release was May 12, 2024—about two years ago. This is a meaningful maintenance slowdown for a library with ongoing dependencies.

Repo commit activitycaution

There were zero commits and zero active maintainers in the last three months. Together with the old latest registry release, this is evidence that active maintenance has slowed substantially.