alsvanzelf/jsonapi

The source is well tested and the package has a long, steady release history. Maintenance is concentrated in one contributor, and workflow actions are all unpinned; the missing security policy adds a smaller transparency gap.

Latest v3.0.2

Packagist

78%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Project backing

The repository is owned by an individual user rather than an organization, so the single-contributor concentration is not visibly compensated by organizational backing.

Repo bus factor

All 3 commits in the last 3 months came from one contributor, so maintenance continuity depends heavily on a single person.

Repo tooling

Composer build tooling is present, but no security-scanning tooling was detected. The lack of scanning modestly reduces visible supply-chain hygiene.

Security policy

The repository has no security policy, leaving reporting and response expectations undocumented. This is a transparency gap, not evidence that the package is unsafe.

Workflow audit

Both workflows were fully analyzed with no untrusted checkouts, script injection, or audit findings, and neither grants top-level write permissions. However, all 8 action references are unpinned, leaving versions exposed to upstream action changes.