viktorf/jwt

Release historycaution

The package has made no release in more than six years, and all five releases were published within one day in July 2020. This strongly suggests the project is no longer maintained, although the stable 1.0.5 version reduces version-churn risk.

Repo commit activitycaution

The repository has recorded zero commits and zero active maintainers in the last three months, consistent with the long release gap. The repository is not archived, but that does not compensate for the absence of recent work.

Repo popularitycaution

The repository has zero stars and forks and only one watcher, providing little evidence of a broader user or contributor base. Popularity is supporting evidence rather than a verdict, so this reinforces—but does not independently establish—the maintenance concern.

Repo toolingcaution

Composer is used for builds, but no security-scanning tooling is present. For an authentication package, that is a meaningful transparency and maintenance gap.

Security policycaution

The repository has no security policy, leaving no documented process for reporting vulnerabilities in a security-sensitive JWT authorization package. Its MIT license and README provide basic transparency but do not replace a response policy.