jwt/php-jwt

Its README, repository tests, BSD license, and minimal runtime dependency support integration. The repository is not archived and the workflow audit found no active unsafe pattern, but all eight action references are unpinned.

Latest v5.3.0

Packagist

42%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Release history

The latest release was v5.3.0 on June 3, 2021, with no releases in the last 12 months and more than five years since publication. This is strong evidence of abandonment for a security-sensitive library.

Repo commit activity

The repository recorded zero commits and zero active maintainers in the last three months, consistent with the release history showing no recent maintenance.

Repo popularity

The linked repository has zero stars, forks, and watchers, providing no supporting evidence of a broad user or contributor base. Popularity is supporting evidence only, so this reinforces rather than drives the abandonment concern.

Security policy

The linked repository has no security policy, leaving vulnerability reporting and disclosure practices undocumented. This is a transparency gap, though it is secondary to the prolonged inactivity.

Workflow audit

The single workflow was fully analyzed with no untrusted checkout, script injection, or auditor findings. However, all eight action references are unpinned, creating a modest build-reproducibility and supply-chain hygiene concern.