Package Health/jojo1981/json-path-ast-builder

jojo1981/json-path-ast-builder

The package includes a clear README, tests, and an MIT license. A single maintainer and minimal repository use leave limited evidence of ongoing support; the workflow also uses unpinned actions.

Latest 1.0.0

Packagist

61%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Maintainers

Only one registry account publishes the package. Because the repository is user-owned rather than organization-backed, this leaves a relatively thin visible maintainer base.

Release history

This is the package's only release, published about 12 months ago, with no releases in the last 12 months. That limits evidence of sustained maintenance, despite the stable 1.0.0 version.

Repo commit activity

There were no commits and no active maintainers during the last three months. Combined with only one release, this is meaningful evidence of limited ongoing maintenance.

Repo tooling

Composer-based build tooling is present, but no security scanning tool was detected. This is a modest transparency gap, not a standalone reason to reject the package.

Workflow audit

All 3 of 3 analyzed action references are unpinned, weakening build reproducibility and update control. The reported cache-poisoning issue has low confidence, so it is only a hygiene concern rather than a severe workflow risk.