msheng/yii2-jwt

Release historydanger

The latest release was published in August 2016, with no releases in the last 12 months. That long period without updates is a substantial maintenance and compatibility concern.

Repo commit activitydanger

There were zero commits and zero active maintainers during the last three months, consistent with roughly 10 years since the last repository update. This is strong evidence of abandonment risk.

Project backingcaution

The package is backed by an individual-owned repository rather than an organization, so there is no visible organizational maintenance capacity to compensate for the inactive contributor base.

Repo popularitycaution

The repository has 7 stars, 1 fork, and 2 watchers. This limited adoption is only supporting evidence, but it offers little external assurance for a package that is no longer active.

Repo toolingcaution

Composer is used for the build, which is appropriate for a PHP package, but no security scanning tools are configured. The missing scanning is a transparency gap rather than proof of a security defect.