alto/json-patch

Clear MIT licensing, repository tests, release notes, and a security policy support adoption. The tiny dependency surface and active repository are reassuring, though the project remains young.

Latest v1.0.1

Packagist

73%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Release history

The package is young at 254 days old with two releases and a median interval of about 194 days; this is limited history, but the latest release is recent rather than abandoned.

Repo bus factor

One contributor made all five recent commits, creating a meaningful continuity risk despite organization backing.

Repo popularity

The repository has only 2 stars and 1 fork, so external adoption evidence is limited; popularity is supporting evidence rather than a requirement for a small library.

Repo tooling

Composer build tooling is present, but no repository security scanning tools were detected, leaving a modest security-process gap.

Workflow audit

The workflow is fully analyzed, uses read-only permissions, and has no dangerous sinks or audit findings. However, all 3 action references are unpinned, weakening build reproducibility and supply-chain hygiene.