xp-forge/json-patch

Clear documentation, tests, a changelog, and an exact GitHub release are backed by an organization. Its tiny audience and absent recent activity reduce confidence in ongoing maintenance; workflow dependencies are also unpinned.

Latest v2.1.1

Packagist

68%

Total Score

Maintainer Stability

Maturity

Supply Chain

100

Health Score Breakdown

Release history

The package has existed since 2015 and has 12 releases, but it made no release in the last 12 months; the latest release was about 13 months ago. This points to slower maintenance rather than abandonment on its own.

Repo commit activity

There were no commits and no active maintainers in the last 3 months. This is a meaningful maintenance concern, although the recent release and repository documentation provide some compensating evidence.

Repo popularity

The repository has 4 stars, no forks, and 1 watcher. Low adoption is supporting caution about community depth, but popularity alone does not establish that the package is unsafe to depend on.

Repo tooling

Composer is used for builds, but no security scanning tools were detected. This is a modest transparency and hygiene gap, not evidence of abandonment by itself.

Workflow audit

The single workflow was fully analyzed with no high-confidence audit findings, but all 3 action references are unpinned. The workflow has no untrusted checkout or script-injection findings, limiting this to a hygiene concern.