rbdwllr/reallysimplejwt

The repository has no security policy, and its workflow uses three unpinned actions, including one from an archived project. Tests, release notes, and a clear MIT license improve transparency, but they do not address the maintenance gap.

Latest 5.0.0

Packagist

58%

Total Score

Maintainer Stability

Maturity

Supply Chain

Health Score Breakdown

Release history

The package has 46 releases and a history dating to 2017, but its latest release was in April 2022 with no releases in the following four years. That sustained pause is a meaningful maintenance concern.

Repo commit activity

The repository recorded zero commits and zero active maintainers in the last three months, reinforcing the long release pause and increasing abandonment risk.

Repo issue activity

There were no new or closed issues or pull requests in the last month, while six issues remain open. This indicates little recent project activity.

Security policy

The repository has no security policy, leaving vulnerability reporting and response expectations undocumented for a security-sensitive JWT library.

Workflow audit

The only workflow was fully analyzed with no untrusted checkout or script-injection findings, but all three action references are unpinned and one uses an archived action. These are maintenance and build-integrity hygiene concerns, not standalone severe risks.