pondit/jwt

Risky to depend on: this package has had only one release, published over six years ago, with no recent repository activity. It is licensed and not deprecated or archived, but maintenance and security coverage are too thin for a dependable dependency.

Latest 1.1.0

Packagist

43%

Total Score

Maintainer Stability

Dependencies

100

Maturity

Supply Chain

Health Score Breakdown

Release history

The package has only one release, 1.1.0, first and last published on February 7, 2020, with no releases in the last 12 months. This strongly suggests abandonment and outweighs the otherwise stable version designation.

Repo commit activity

The repository recorded zero commits and zero active maintainers in the last three months. Combined with the absence of registry releases since 2020, this is strong evidence that maintenance has stopped.

Project backing

The repository is owned by an individual user rather than an organization. This is not inherently unhealthy, but it indicates a thin ownership structure and provides less evidence of durable project backing.

Repo popularity

The repository has only 2 stars, 0 forks, and 1 watcher. Low popularity alone is not disqualifying, but it provides little supporting evidence of broad review or community resilience for an already inactive project.

Repo tooling

The repository uses Composer but has no security-scanning tools. Composer tooling is appropriate for the package, while the lack of automated security scanning is a maintenance and transparency gap.