adhocore/json-comment

The package is small and easy to inspect, with tests, release notes, a clear license, and minimal runtime dependencies. Maintenance has been quiet for nearly four years, while the workflow uses unpinned actions and the repository lacks a security policy.

Latest 1.2.1

Packagist

62%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Release history

The latest release was published in October 2022, nearly four years ago, and there were no releases in the last 12 months. This is a meaningful maintenance concern despite the package having 14 releases overall.

Repo commit activity

There were no commits and no active maintainers in the last three months. Combined with the old latest release, this indicates a real abandonment risk rather than merely a slow release cadence.

Security policy

The repository has no security policy. For a small library this is a transparency gap, though the complete source tree and tests provide some compensating visibility.

Workflow audit

The single workflow was fully analyzed, uses read-only permissions, and has no injection or high-severity findings. However, both action references are unpinned, leaving a modest reproducibility and supply-chain hygiene gap.