nats-io/jwt erreicht einen Gesundheitsindex von 61 von 100 und liegt damit im Bereich Mittel. Am stärksten schneidet es bei Sustainability & Governance (78/100) ab, am schwächsten bei Community & Adoption (48/100). Zuletzt vor 49 Tagen aktualisiert. 2 Mitwirkende tragen den Großteil der jüngsten Arbeit.
61
gesamt / 100
Mittel
Software-Gesundheitsindex
Metriken werden auf einer Skala von 1–100 in gewichtete Kategorien gruppiert. Der Gesamtwert beginnt als ihr Mittel; sobald öffentliche Evidenz die Richtlinie für Hochrisikojurisdiktionen auslöst, wird die Bewertung angepasst und erhält die Obergrenze 49 (Gefährdet). AI Readiness liegt außerhalb.
61
Exzellent85-100Vorbildlich; erfüllt im Wesentlichen alle geprüften Kriterien
Gut70-84Gesund; geringfügige Lücken
Mittel50-69Akzeptabel mit deutlichen Lücken; Überprüfung empfohlen
Gefährdet30-49Erhebliche Schwächen; eine Übernahme erfordert Vorsicht
Kritisch1-29Schwerwiegende Probleme (aufgegeben, nur ein Maintainer, keine Hygiene)
Bewertungsprofil
Jede Achse ist eine Kategorie. Die Form zählt mehr als der Durchschnitt — ein gesundes Projekt füllt die gesamte Fläche, während ein Profil aus Spitzen und Kratern bedeutet, dass Stärke in einer Dimension Risiken in einer anderen verdeckt.
Dieses Repository wird von einer Organisation getragen — geteilte, rechenschaftspflichtige Trägerschaft, die jeden einzelnen Maintainer überdauern kann.
Release-Rhythmus — ein Release etwa alle 77,4 Tage
0/10
OpenSSF Scorecard: Signed-Releases — keine Daten
Verwendete Eingangsdaten
releases_count
46
latest_release_tag
v2.8.2
releases_from_tags
nein
days_since_latest_release
49
mean_days_between_releases
77,4
Von der Bewertung ausgeschlossen (keine Daten oder nicht anwendbar): OpenSSF Scorecard: Signed-Releases. Die verbleibenden Gewichte wurden renormalisiert.
Von der Bewertung ausgeschlossen (keine Daten oder nicht anwendbar): branch_protection, packaging, signed_releases. Die verbleibenden Gewichte wurden renormalisiert.
Direkte Abhängigkeiten ohne bekannte Advisories — keine direkte Abhängigkeit trägt ein bekanntes Advisory
0/25
Indirekte Abhängigkeiten ohne bekannte Advisories — transitive Menge in diesem Bereich nicht von Entwicklungs- und Test-Abhängigkeiten trennbar
0/40
Keine offenen Advisories — kein Advisory trägt ein Veröffentlichungsdatum
Verwendete Eingangsdaten
source
osv
advisories
3
affected_packages
2
assessed_packages
5
unassessed_packages
0
affected_by_severity
critical 1, unknown 1
direct_affected_packages
0
Von der Bewertung ausgeschlossen (keine Daten oder nicht anwendbar): Indirekte Abhängigkeiten ohne bekannte Advisories, Keine offenen Advisories. Die verbleibenden Gewichte wurden renormalisiert. 5 aufgelöste Abhängigkeiten wurden mit OSV abgeglichen. Dieses Repository veröffentlicht kein Paket, das der Index auflöst; bewertet wurde daher der Abhängigkeitsgraph des Repositorys. Dieser Graph vermischt Entwicklungs- und Test-Pins mit ausgelieferten Abhängigkeiten, daher werden nur die deklarierten Laufzeit-Abhängigkeiten bewertet; transitive Befunde werden als Kontext ausgewiesen und fließen nicht in die Bewertung ein. Erreichbarkeit wird nicht analysiert.
Wie gut ist das Repository dafür ausgestattet, mit KI-Coding-Agenten entwickelt und gepflegt zu werden? Ein unabhängiges, experimentelles Badge — Gewicht 0,0, es wird eigenständig ausgewiesen und verändert den Gesamt-Gesundheitswert nicht.
Handhabbare Dateigrößen — 0/66 Quelldateien über 60 KB
Verwendete Eingangsdaten
primary_language
Go
largest_source_bytes
31.695
source_files_sampled
66
oversized_source_files
0
Eckdaten
88GitHub-Sterne
16Mitwirkende
11Commits, letzte 12 Monate
49Tage seit letztem Push
46Releases
2Bus-Faktor
13offene Issues
GoPaket-Ökosysteme
Weitere Details
Stern- und Fork-Verlauf 88 ★ / 37 ⇿
88Sterne
37Forks
46Releases
Wann jeder Stern und Fork hinzugefügt wurde, von GitHub erfasst und nach Tagen gruppiert. Das kumulierte Wachstum steht direkt über den täglichen Zugängen, aus denen es besteht, sodass beide gegeneinander lesbar sind: stetiger organischer Zuwachs sieht ganz anders aus als ein abrupter, kurzlebiger Ausschlag. Wo dieser Unterschied messbar ist, wird er als Wachstumsauthentizität ausgewiesen.
Major 1Minor 13Patch 32
Jeder Punkt umfasst 8 Tage.
OpenSSF Scorecard 5.6 / 10
5.6Gesamtwert
Unabhängige, werkzeugneutrale Sicherheitsbewertung durch das quelloffene OpenSSF Scorecard. Jede Prüfung honoriert eine Sicherheits-Praxis, nicht das Werkzeug eines bestimmten Anbieters. Prüfungen, die Scorecard nicht ermitteln konnte, sind mit k. A. markiert und vom Sicherheitswert ausgeschlossen (nie als null gezählt).Scorecard v5.5.0 · 2026-07-22 07:18 UTC
Vollständig aufgelöster Abhängigkeitssatz aus dem GitHub-Abhängigkeitsgraphen: 2 direkte und 3 indirekte (transitive) Pakete. Die transitive Hülle ist vollständig, wenn das Repository eine Lockfile eincheckt.
Registry
Paket
Version
Beziehung
Go
github.com/nats-io/nkeys
0.3.0
direkt
Go
github.com/nats-io/nkeys
v0.4.16
direkt
Go
github.com/nats-io/jwt
1.2.2
indirekt
Go
golang.org/x/crypto
v0.52.0
indirekt
Go
golang.org/x/sys
v0.45.0
indirekt
Abhängigkeits-Advisories 2
Dieses Repository veröffentlicht kein vom Index auflösbares Paket, daher wurde sein eigener Abhängigkeitsgraph bewertet – 5 Pakete, darunter auch Entwicklungs- und Test-Pins, die nie ausgeliefert werden: 2 tragen bekannte Advisories, davon 0 direkte.
Paket
Version
Beziehung
Schweregrad
Advisories
Behoben in
github.com/nats-io/jwt
1.2.2
indirekt
kritisch
2
2.0.1
golang.org/x/crypto
v0.52.0
indirekt
unbekannt
1
—
Ein Advisory bedeutet, dass die im Abhängigkeitsgraphen erfasste Version in den betroffenen Bereich eines Advisories fällt. Erreichbarkeit wird nicht analysiert, und der Graph enthält Entwicklungs- und Test-Pins — ein Fund kann das Werkzeug betreffen und nicht die ausgelieferte Software.
JSON-Rohbericht maschinenlesbar
{
"data": {
"repo": {
"topics": [],
"is_fork": false,
"size_kb": 608,
"has_wiki": true,
"homepage": null,
"languages": {
"Go": 448290,
"Shell": 977,
"Makefile": 491
},
"pushed_at": "2026-06-02T13:54:22Z",
"created_at": "2018-08-22T16:25:50Z",
"owner_type": "Organization",
"updated_at": "2026-06-07T18:00:56Z",
"description": "JWT tokens signed using NKeys for Ed25519 for the NATS ecosystem.",
"is_archived": false,
"is_disabled": false,
"license_spdx": "Apache-2.0",
"default_branch": "main",
"license_spdx_raw": "Apache-2.0",
"primary_language": "Go",
"significant_languages": [
"Go"
]
},
"owner": {
"blog": "https://nats.io",
"name": "NATS - The Edge & Cloud Native Messaging System",
"type": "Organization",
"login": "nats-io",
"company": null,
"location": null,
"followers": 2424,
"avatar_url": "https://avatars.githubusercontent.com/u/10203055?v=4",
"created_at": "2014-12-16T02:38:52Z",
"is_verified": null,
"public_repos": 131,
"account_age_days": 4236
},
"license": {
"state": "standard",
"spdx_id": "Apache-2.0",
"raw_spdx": "Apache-2.0",
"file_present": true,
"scorecard_found": true,
"profile_has_license": true
},
"activity": {
"releases": [
{
"tag": "v2.8.2",
"kind": "patch",
"published_at": "2026-06-02T13:54:22Z"
},
{
"tag": "v2.8.1",
"kind": "patch",
"published_at": "2026-03-17T13:04:32Z"
},
{
"tag": "v2.8.0",
"kind": "minor",
"published_at": "2025-08-08T14:19:25Z"
},
{
"tag": "v2.7.4",
"kind": "patch",
"published_at": "2025-04-16T14:31:01Z"
},
{
"tag": "v2.7.3",
"kind": "patch",
"published_at": "2024-12-13T16:49:52Z"
},
{
"tag": "v2.7.2",
"kind": "patch",
"published_at": "2024-10-09T20:01:27Z"
},
{
"tag": "v2.7.1",
"kind": "patch",
"published_at": "2024-10-09T19:37:43Z"
},
{
"tag": "v2.7.0",
"kind": "minor",
"published_at": "2024-09-17T17:05:09Z"
},
{
"tag": "v2.6.0",
"kind": "minor",
"published_at": "2024-09-10T23:13:08Z"
},
{
"tag": "v2.5.8",
"kind": "patch",
"published_at": "2024-07-05T14:34:37Z"
},
{
"tag": "v2.5.7",
"kind": "patch",
"published_at": "2024-05-09T16:09:54Z"
},
{
"tag": "v2.5.6",
"kind": "patch",
"published_at": "2024-04-18T15:14:55Z"
},
{
"tag": "v2.5.5",
"kind": "patch",
"published_at": "2024-02-22T16:58:21Z"
},
{
"tag": "v2.5.4",
"kind": "patch",
"published_at": "2024-02-15T17:09:38Z"
},
{
"tag": "v2.5.3",
"kind": "patch",
"published_at": "2023-10-31T16:16:39Z"
},
{
"tag": "v2.5.2",
"kind": "patch",
"published_at": "2023-09-18T15:55:58Z"
},
{
"tag": "v2.5.1",
"kind": "patch",
"published_at": "2023-09-18T15:44:06Z"
},
{
"tag": "v2.5.0",
"kind": "minor",
"published_at": "2023-08-21T16:32:42Z"
},
{
"tag": "v2.4.1",
"kind": "patch",
"published_at": "2023-03-24T16:04:04Z"
},
{
"tag": "v2.4.0",
"kind": "minor",
"published_at": "2023-03-21T15:31:28Z"
},
{
"tag": "v2.3.0",
"kind": "minor",
"published_at": "2022-06-28T20:52:42Z"
},
{
"tag": "v2.2.0",
"kind": "minor",
"published_at": "2021-11-15T18:05:31Z"
},
{
"tag": "v2.1.0",
"kind": "minor",
"published_at": "2021-09-28T20:09:40Z"
},
{
"tag": "v2.0.3",
"kind": "patch",
"published_at": "2021-08-02T15:43:13Z"
},
{
"tag": "v2.0.2",
"kind": "patch",
"published_at": "2021-05-04T16:10:13Z"
},
{
"tag": "v2.0.1",
"kind": "patch",
"published_at": "2021-03-14T23:13:04Z"
},
{
"tag": "v2.0.0",
"kind": "major",
"published_at": "2021-03-14T19:53:51Z"
},
{
"tag": "v1.2.2",
"kind": "patch",
"published_at": "2020-11-30T16:49:20Z"
},
{
"tag": "v1.2.0",
"kind": "minor",
"published_at": "2020-10-30T23:40:28Z"
},
{
"tag": "v1.1.0",
"kind": "minor",
"published_at": "2020-10-21T15:51:26Z"
},
{
"tag": "v1.0.1",
"kind": "patch",
"published_at": "2020-05-29T19:52:32Z"
},
{
"tag": "v0.3.2",
"kind": "patch",
"published_at": "2019-11-14T21:48:39Z"
},
{
"tag": "v0.3.0",
"kind": "minor",
"published_at": "2019-09-20T17:04:31Z"
},
{
"tag": "v0.2.16",
"kind": "patch",
"published_at": "2019-09-18T15:07:30Z"
},
{
"tag": "v0.2.14",
"kind": "patch",
"published_at": "2019-08-14T16:24:45Z"
},
{
"tag": "v0.2.12",
"kind": "patch",
"published_at": "2019-07-24T20:08:40Z"
},
{
"tag": "v0.2.10",
"kind": "patch",
"published_at": "2019-07-16T13:10:53Z"
},
{
"tag": "v0.2.8",
"kind": "patch",
"published_at": "2019-06-21T16:36:23Z"
},
{
"tag": "v0.2.6",
"kind": "patch",
"published_at": "2019-05-22T14:19:08Z"
},
{
"tag": "v0.2.4",
"kind": "patch",
"published_at": "2019-04-18T17:58:28Z"
},
{
"tag": "v0.2.2",
"kind": "patch",
"published_at": "2019-04-11T23:37:05Z"
},
{
"tag": "v0.2.0",
"kind": "minor",
"published_at": "2019-04-11T20:49:26Z"
},
{
"tag": "v0.1.0",
"kind": "minor",
"published_at": "2019-04-09T23:41:13Z"
},
{
"tag": "v0.0.8",
"kind": "patch",
"published_at": "2018-12-13T04:28:38Z"
},
{
"tag": "v0.0.6",
"kind": "patch",
"published_at": "2018-12-08T02:04:24Z"
},
{
"tag": "v0.0.4",
"kind": "patch",
"published_at": "2018-12-04T18:47:52Z"
}
],
"recent_commits": [
{
"oid": "82017236da50e4a0173091105d82d46228b8dccf",
"body": null,
"is_bot": false,
"headline": "bumps (#251)",
"author_name": "Alberto Ricart",
"author_login": "aricart",
"committed_at": "2026-06-02T13:53:38Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "071a1dedb58e3da316084d650859d5cf6c00aaf2",
"body": "The nats-server will (only) enable JetStream on an account if `DiskStorage` and/or `MemoryStorage` is set to a non-zero value in the Account JWT Limits. This is due to legacy reasons and cannot be easily changed due to the global impact of already existing NATS clusters based on decentralized auth.\n\nIssue: https://github.com/nats-io/jwt/issues/249",
"is_bot": false,
"headline": "docs: how to enable/disable JetStream when creating AccountClaims (#250)",
"author_name": "Thobias Karlsson",
"author_login": "choufraise",
"committed_at": "2026-06-02T13:25:44Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "1e990c9a58a81981aca6da7efdc7c5b79314fea9",
"body": "* fix: added a check for the size of JWT token\n\nNote that now all JWTs are limited to 1MB - which may or not be breaking. Note that Generic JWTs could possibly have whatever size they want (this change doesn't affect GenericClaims)\n\nSigned-off-by: Alberto Ricart <alberto@synadia.com>",
"is_bot": false,
"headline": "fix: added a check for the size of JWT token (#248)",
"author_name": "Alberto Ricart",
"author_login": "aricart",
"committed_at": "2026-03-12T16:26:27Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "e6531afcdfe87a6d964693e59b1557bf3d32dfe4",
"body": "Signed-off-by: Alberto Ricart <alberto@synadia.com>",
"is_bot": false,
"headline": "fix: ensure that weighted mappings don't exceed 100 (#247)",
"author_name": "Alberto Ricart",
"author_login": "aricart",
"committed_at": "2026-03-11T19:13:06Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "4cbb6cce481caba30d91a020bc25be99f1d8a791",
"body": "This API is used by external tools to decorate seeds, in cases where they specify a bad input return an error\n\nSigned-off-by: Alberto Ricart <alberto@synadia.com>",
"is_bot": false,
"headline": "fix: make DecorateSeed more resilient in case of short input (#245)",
"author_name": "Alberto Ricart",
"author_login": "aricart",
"committed_at": "2026-03-11T16:36:41Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "4ee18c85bc5ed09dc41fb03b045f077bc3cdce93",
"body": "Signed-off-by: Alberto Ricart <alberto@synadia.com>",
"is_bot": false,
"headline": "ci: enable claude (#246)",
"author_name": "Alberto Ricart",
"author_login": "aricart",
"committed_at": "2026-03-11T16:12:49Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "169803d1a50f8a02e09aadf72195af3c5d716a80",
"body": "* bump dependencies, streamline test matrix\n\n* Go 1.24 vet flagged printf-style functions that passed non-constant strings as the format string\n\nSigned-off-by: Alberto Ricart <alberto@synadia.com>\n\n---------\n\nSigned-off-by: Alberto Ricart <alberto@synadia.com>",
"is_bot": false,
"headline": "bump dependencies, streamline test matrix (#244)",
"author_name": "Alberto Ricart",
"author_login": "aricart",
"committed_at": "2026-03-03T14:59:26Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "a3aa1012e08c00d189405a9313f75bed8ed84f8a",
"body": "…or the JWT provided. (#242)\n\nSigned-off-by: Alberto Ricart <alberto@synadia.com>",
"is_bot": false,
"headline": "added a check when generating creds that the specified key is valid f…",
"author_name": "Alberto Ricart",
"author_login": "aricart",
"committed_at": "2026-03-03T14:59:05Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "e4173126b32a711fcf1595d122a302ee22ff8d43",
"body": "nats-server already allows importing the same (service) subject from different account, while the jwt does not. This becomes an issue when you, for instance, source JetStreams from different accounts and need to import service `$JS.FC.>` from both. Before, this could be solved by importing e.g. `$JS\n[…]\ns-server/pull/6704\nRelated: https://github.com/nats-io/nats-server/issues/6547\nRelated: https://github.com/nats-io/nats-server/issues/6431\n\nSigned-off-by: Thobias Karlsson <thobias.karlsson@gmail.com>",
"is_bot": false,
"headline": "fix: allow import of same service subject from different accounts (#243)",
"author_name": "Thobias Karlsson",
"author_login": "choufraise",
"committed_at": "2026-02-27T22:00:12Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "a2c583b4f3719b35832df7b802db6efe1c6f066e",
"body": "Signed-off-by: Alberto Ricart <alberto@synadia.com>",
"is_bot": false,
"headline": "update build status badge to use GitHub Actions (#240)",
"author_name": "Alberto Ricart",
"author_login": "aricart",
"committed_at": "2025-08-08T14:18:41Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "953e18bb32057b7d5a08fc1a966915a9e76c9bea",
"body": "This would be used in the server to enforce that a user connects\nthrough a trusted proxy.\n\nSigned-off-by: Ivan Kozlovic <ivan@synadia.com>",
"is_bot": false,
"headline": "[ADDED] `ProxyRequired` user claims property (#239)",
"author_name": "Ivan Kozlovic",
"author_login": "kozlovic",
"committed_at": "2025-08-08T14:03:00Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "28e31bd445aeebe6a0bb93902baf91e43036c22c",
"body": "Signed-off-by: Alberto Ricart <alberto@synadia.com>",
"is_bot": false,
"headline": "bump golang.org/x/crypto fixing vulnerability (#238)",
"author_name": "Alberto Ricart",
"author_login": "aricart",
"committed_at": "2025-04-16T14:29:44Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "13f7264e0ea0eb7307d50ce4c117a4ece4f99959",
"body": "[ci skip]",
"is_bot": false,
"headline": "fix the link to go doc to go to v2 (#237)",
"author_name": "Alberto Ricart",
"author_login": "aricart",
"committed_at": "2024-12-19T17:10:44Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "a768c381b3ed3c634bfa6738ba34a4652456986d",
"body": "Upgraded `github.com/nats-io/nkeys` to v0.4.9, `golang.org/x/crypto` to v0.31.0, and `golang.org/x/sys` to v0.28.0. These updates ensure compatibility with the latest changes and include potential bug fixes and improvements. No functional changes were introduced in the codebase.\r\n\r\nSigned-off-by: Alberto Ricart <alberto@synadia.com>",
"is_bot": false,
"headline": "Update dependencies in go.mod and go.sum (#236)",
"author_name": "Alberto Ricart",
"author_login": "aricart",
"committed_at": "2024-12-13T16:48:25Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "698cd7e2aafd4e8fedefbdd5879dcade64c855eb",
"body": "* feat: Claims interface now has `EncodeWithSigner(nkeys.KeyPair`, fn: SignFn)` where signing can be delegated to a function. The `type SignFn func(pub string, data []byte) ([]byte, error)` is provided with the public key whose matching private key should be used to sign the provided payload.\r\n\r\nTh\n[…]\ning a JWT.\r\n\r\nSigned-off-by: Alberto Ricart <alberto@synadia.com>\r\n\r\n* go mod\r\n\r\nSigned-off-by: Alberto Ricart <alberto@synadia.com>\r\n\r\n---------\r\n\r\nSigned-off-by: Alberto Ricart <alberto@synadia.com>",
"is_bot": false,
"headline": "Allow external signing of JWTs (#234)",
"author_name": "Alberto Ricart",
"author_login": "aricart",
"committed_at": "2024-12-13T16:42:21Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "f9c7776a413358752942d078361ee8d13f15e2f4",
"body": "* Revert \"[CHANGE] Tags are now case-sensitive (#225)\"\r\n\r\nThis reverts commit de1f16b5781c771513bdc8de201e86bfa76f0325.\r\n\r\n* retract 2.7.0\r\n\r\nSigned-off-by: Alberto Ricart <alberto@synadia.com>\r\n\r\n---------\r\n\r\nSigned-off-by: Alberto Ricart <alberto@synadia.com>",
"is_bot": false,
"headline": "Retract case-insensitive tag functionality (#233)",
"author_name": "Alberto Ricart",
"author_login": "aricart",
"committed_at": "2024-10-09T19:35:56Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "18a60d6f7f84c2774c29cb926fe421df2deb5bc0",
"body": null,
"is_bot": false,
"headline": "[CHANGE] removing a tag that doesn't exist results in an error (#228)",
"author_name": "Alberto Ricart",
"author_login": "aricart",
"committed_at": "2024-09-17T15:32:41Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "de1f16b5781c771513bdc8de201e86bfa76f0325",
"body": "* [CHANGE] Tags (--tag and --rm-tag) are now case-sensitive. Previous versions of the library lowercased all tags. Now tags such as \"A\" and \"a\" are different.",
"is_bot": false,
"headline": "[CHANGE] Tags are now case-sensitive (#225)",
"author_name": "Alberto Ricart",
"author_login": "aricart",
"committed_at": "2024-09-17T14:09:22Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "2d9ece2f3a7a987c745e4f6d7d6ba02a74756577",
"body": "…ll need to perform some level of validation (#224)\n\n* Added validation to cluster traffic - as downstream tools like nsc will need to perform some level of validation\r\n* removed parsing of account for cluster traffic as that option will be delayed.",
"is_bot": false,
"headline": "Added validation to cluster traffic - as downstream tools like nsc wi…",
"author_name": "Alberto Ricart",
"author_login": "aricart",
"committed_at": "2024-09-13T16:28:03Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "4445fcd6be061ef9a37e02fdf5988bd80adb7d21",
"body": null,
"is_bot": false,
"headline": "Merge pull request #223 from nats-io/neil/accountnrg",
"author_name": "Neil",
"author_login": "neilalexander",
"committed_at": "2024-09-10T22:17:29Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "1378f5922cddb43d7776da60f100520aee0a6c59",
"body": "Signed-off-by: Neil Twigg <neil@nats.io>",
"is_bot": false,
"headline": "Fix lint errors, probably from new staticcheck version",
"author_name": "Neil Twigg",
"author_login": "neilalexander",
"committed_at": "2024-09-10T21:37:40Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "2e1251e5109465388c40eef4d5224c42edd03d11",
"body": "Signed-off-by: Neil Twigg <neil@nats.io>",
"is_bot": false,
"headline": "Update CI to use latest stable Go version",
"author_name": "Neil Twigg",
"author_login": "neilalexander",
"committed_at": "2024-09-10T09:32:32Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "bc9fb5fb3c2f2775b5398a43d401dc13a5668866",
"body": "For supporting nats-io/nats-server#5466.\n\nFor now expected values would be:\n* `\"system\"` - use the system account (default, as today)\n* `\"owner\"` - use the same account that owns the asset\n* `\"account:ACCNAME\"` - use a third specified `ACCNAME`\n\nSigned-off-by: Neil Twigg <neil@nats.io>",
"is_bot": false,
"headline": "Add `ClusterTraffic` to account claims",
"author_name": "Neil Twigg",
"author_login": "neilalexander",
"committed_at": "2024-09-10T09:25:22Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "ff68a3bc6bb70f166b35232159cc9c96aaca4375",
"body": "…222)\n\nFixes https://github.com/nats-io/nsc/issues/657",
"is_bot": false,
"headline": "[FIX] accounting for weights in cluster should be handled separate (#…",
"author_name": "Alberto Ricart",
"author_login": "aricart",
"committed_at": "2024-07-05T14:31:12Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "41dad79143e9cff55e4bde8af4df7a40ad49786c",
"body": "Added `ConnectionTypeInProcess` to the `UserPermissionLimits.AllowedConnectionTypes`\r\nlist of possible types.\r\n\r\nSigned-off-by: Ivan Kozlovic <ivan@synadia.com>",
"is_bot": false,
"headline": "[ADDED] Connection type \"in process\" (#221)",
"author_name": "Ivan Kozlovic",
"author_login": "kozlovic",
"committed_at": "2024-05-09T16:08:51Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "1f3ff3245e5ebd478f98bd584ad1636430246c95",
"body": "…tween same name roles (#220)",
"is_bot": false,
"headline": "[FEAT] added a description to a scope role to enable tools discern be…",
"author_name": "Alberto Ricart",
"author_login": "aricart",
"committed_at": "2024-04-18T15:09:38Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "c2d30e2ffc632a1ea64030467e5a40e02e4158be",
"body": "When an account has a `Trace` field set with a `Destination`, if\r\nan incoming message has a `traceparent` header with proper flag\r\nindicating that the message should be trace, the `Sampling` integer\r\n(value in the range of [1..100]) allows tracing only a random\r\nsample of messages. The server will p\n[…]\nm number below 100\r\nand if that number is lower or equal to this `Sampling` value\r\nthen the trace will trigger. If above, the trace will not trigger.\r\n\r\nSigned-off-by: Ivan Kozlovic <ivan@synadia.com>",
"is_bot": false,
"headline": "[ADDED] Sampling in MsgTrace structure (#219)",
"author_name": "Ivan Kozlovic",
"author_login": "kozlovic",
"committed_at": "2024-02-22T16:57:27Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "38e07c55c548c54df98b709eef943fb1cffc28b1",
"body": "Signed-off-by: Caleb Lloyd <caleb@synadia.com>",
"is_bot": false,
"headline": "add omitempty to authorization.auth_users (#218)",
"author_name": "Caleb Lloyd",
"author_login": "caleblloyd",
"committed_at": "2024-02-16T21:07:39Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "069ee3e448b5443e77f7906d391bf7761e662dcb",
"body": null,
"is_bot": false,
"headline": "[UPDATE] update deps (#217)",
"author_name": "Alberto Ricart",
"author_login": "aricart",
"committed_at": "2024-02-15T17:08:56Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "ed3fbfa49a16cf4aced84aed9d527be532730ad4",
"body": "This is needed for the NATS Server distributed message tracing\r\nfeature.\r\n\r\nThis PR updates validation of a Subject to check for `.` at the\r\nfirst or last position and consecutive ones.\r\n\r\nThe validation of the Account.TraceDest also checks that the\r\ndestination does not have wildcards since this is\n[…]\nf-by: Ivan Kozlovic <ivan@synadia.com>\r\n\r\n* Added container for message trace options\r\n\r\nSigned-off-by: Ivan Kozlovic <ivan@synadia.com>\r\n\r\n---------\r\n\r\nSigned-off-by: Ivan Kozlovic <ivan@synadia.com>",
"is_bot": false,
"headline": "[ADDED] Import/Export.AllowTrace and Account.TraceDest (#216)",
"author_name": "Ivan Kozlovic",
"author_login": "kozlovic",
"committed_at": "2024-02-15T16:56:43Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "f923b10c0be0c8d24fdab7208733504c4887def5",
"body": "Bumps [golang.org/x/crypto](https://github.com/golang/crypto) from 0.14.0 to 0.17.0.\r\n- [Commits](https://github.com/golang/crypto/compare/v0.14.0...v0.17.0)\r\n\r\n---\r\nupdated-dependencies:\r\n- dependency-name: golang.org/x/crypto\r\n dependency-type: indirect\r\n...\r\n\r\nSigned-off-by: dependabot[bot] <support@github.com>\r\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
"is_bot": true,
"headline": "Bump golang.org/x/crypto from 0.14.0 to 0.17.0 in /v2 (#214)",
"author_name": "dependabot[bot]",
"author_login": "dependabot[bot]",
"committed_at": "2023-12-20T10:48:56Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "457367366f2ff72a3fefeed38b56a1da281476fb",
"body": null,
"is_bot": false,
"headline": "[BUMP] bump nkeys (#212)",
"author_name": "Alberto Ricart",
"author_login": "aricart",
"committed_at": "2023-10-31T16:15:48Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "012e7a3a42dce49e62a7f14662461ecf14a8d5fc",
"body": "…operations (#209)",
"is_bot": false,
"headline": "[FEAT] relax protocol names to allow for ws/wss for account resolver …",
"author_name": "Alberto Ricart",
"author_login": "aricart",
"committed_at": "2023-10-24T22:36:25Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "4b4f5502a8b3acb9fe78ecc86814dd3ec2c20a90",
"body": "… (#208)\n\nFix #200",
"is_bot": false,
"headline": "[FEAT] added convenience API GetTags() to Account/Operator/UserClaims…",
"author_name": "Alberto Ricart",
"author_login": "aricart",
"committed_at": "2023-09-18T15:52:19Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "a3a24780d2f287e5149de20aa40158045afbe868",
"body": "The discussions tab needs to be enabled.",
"is_bot": false,
"headline": "Fix issue config discussions link (#205)",
"author_name": "Byron Ruth",
"author_login": "bruth",
"committed_at": "2023-08-21T20:38:34Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "75d6d8701e5ca225078e10cf93e2e3ff98d5ecad",
"body": "Signed-off-by: Byron Ruth <byron@nats.io>",
"is_bot": false,
"headline": "Add issue forms (#204)",
"author_name": "Byron Ruth",
"author_login": "bruth",
"committed_at": "2023-08-21T20:26:01Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "44fe206dcc2696bfe1d1d53ac8da553caeaf26a0",
"body": null,
"is_bot": false,
"headline": "sort signing keys on marshal (#203)",
"author_name": "Seth Back",
"author_login": "sethjback",
"committed_at": "2023-08-21T20:24:27Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "c4f1fd0ca5889c20ba2ae5cca0e88d1cf964f60c",
"body": "…r setup that actually runs on a server (#198)",
"is_bot": false,
"headline": "[DOC] changed the main example to show a basic operator->account->use…",
"author_name": "Alberto Ricart",
"author_login": "aricart",
"committed_at": "2023-08-21T16:28:50Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "78a1bd080817e10534d03583c3e0c2569e42073e",
"body": "remove wildcard validation from mappings",
"is_bot": false,
"headline": "Merge pull request #202 from haisum/main",
"author_name": "Haisum Mussawir",
"author_login": null,
"committed_at": "2023-08-21T16:28:36Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "96b5387a7afcb092eeac24126f781fa628af2383",
"body": "Signed-off-by: haisum <haisum@synadia.com>",
"is_bot": false,
"headline": "remove wildcard validation from mappings",
"author_name": "haisum",
"author_login": null,
"committed_at": "2023-08-18T19:54:37Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "535a7674fb6149ba5d35297b3125b337ee281e13",
"body": "* [FEAT] allow callout service to generate users for any account, added constant `AnyAccount` for wildcard",
"is_bot": false,
"headline": "[FEAT] allow callout service to generate users for any account (#197)",
"author_name": "Alberto Ricart",
"author_login": "aricart",
"committed_at": "2023-03-24T16:02:18Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "11e1fdb1415310764b7678bc31a6e63c53e99edd",
"body": null,
"is_bot": false,
"headline": "Bump version for imminent release: 2.4.0",
"author_name": "Phil Pennock",
"author_login": "philpennock",
"committed_at": "2023-03-16T21:45:09Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "7018e50b6fccc7bda45d4bc692a1873f33afa879",
"body": "simplify AuthorizationResponse",
"is_bot": false,
"headline": "Merge pull request #189 from nats-io/simplify-response",
"author_name": "Waldemar Quevedo",
"author_login": "wallyqs",
"committed_at": "2023-03-16T21:41:56Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "7b33986cffa3bd7df2277d853249c385edf9315f",
"body": "- [FIX] fixed the DidSign for account claims to return true only if the signing key and the issuer account constraints met - this api is only used by nsc\n- [TEST] fixed test that used improper user JWT\n- [TEST] fixed tests that expected failure, but were out of order with a following test that now triggers the error\n\nrequired authorization claims subject to be the user public key from the request\nrequired audience in the authorization claim subject to be the public server key from the request",
"is_bot": false,
"headline": "added additional scrutiny to DidSign in the case of signing keys (#190)",
"author_name": "aricart",
"author_login": "aricart",
"committed_at": "2023-03-16T21:32:39Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "e3e39d66ad1c45611b8b058a0170b765f788d692",
"body": "Move all the top-level go code into v2/v1compat and explicitly refer to that,\r\nand with all other go.??? files removed, so that from the go module handling\r\nperspective, this is all in one Go module. This will prevent v1 code\r\nreferences from going out to Go modules and fetching old vulnerable code\n[…]\nvisible to tests in other software, such as nats-io/nats-account-server too.\r\n\r\nThis PR changes modules, imports, and CI test invocations, but makes no changes\r\nto the Go functionality of the library.",
"is_bot": false,
"headline": "overhaul jwt v2 and v1 inter-tangling (#195)",
"author_name": "Phil Pennock",
"author_login": "philpennock",
"committed_at": "2023-03-16T21:28:27Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "8d1c62fe17b1306a3fe18118b810fe45736e9d9e",
"body": "- [FIX] fixed the DidSign for account claims to return true only if the signing key and the issuer account constraints met - this api is only used by nsc\r\n- [TEST] fixed test that used improper user JWT\r\n- [TEST] fixed tests that expected failure, but were out of order with a following test that now triggers the error",
"is_bot": false,
"headline": "added additional scrutiny to DidSign in the case of signing keys (#190)",
"author_name": "Alberto Ricart",
"author_login": "aricart",
"committed_at": "2023-02-15T18:58:59Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "f135d4a5a6f99ff2705b7f1a8aca2949da33f2bb",
"body": "* [CI] github actions",
"is_bot": false,
"headline": "[chore] migrate ci to gha (#191)",
"author_name": "Alberto Ricart",
"author_login": "aricart",
"committed_at": "2023-02-15T18:49:09Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "bdf40fa3627bc5cd1f378bb94ba8ab26768a9c70",
"body": "Authorization Response and Server ID additions",
"is_bot": false,
"headline": "Merge pull request #186 from nats-io/auth-updates",
"author_name": "Derek Collison",
"author_login": "derekcollison",
"committed_at": "2022-12-27T17:05:42Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "146945d1bedc8ec8d8cda0cee8b20d2960174583",
"body": "…to a NATS server.\n\nAlso added in version, cluster and tags to the server info for an authorization request.\n\nSigned-off-by: Derek Collison <derek@nats.io>",
"is_bot": false,
"headline": "Added in a formal authorization response for propagating errors back …",
"author_name": "Derek Collison",
"author_login": "derekcollison",
"committed_at": "2022-12-26T22:45:25Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "ff7baa9e5e73489e49a6cf6062d26fc0ef0e11d9",
"body": "Force authorization requests to have a public user nkey.",
"is_bot": false,
"headline": "Merge pull request #185 from nats-io/user-nkey",
"author_name": "Derek Collison",
"author_login": "derekcollison",
"committed_at": "2022-12-14T23:34:35Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "1ddeceefd4542ce8909642ac83b71b751b329bc5",
"body": "This will be required for the user claim sent back from the authorization service to avoid replay attacks.\n\nSigned-off-by: Derek Collison <derek@nats.io>",
"is_bot": false,
"headline": "Force authorization requests to have a public user nkey.",
"author_name": "Derek Collison",
"author_login": "derekcollison",
"committed_at": "2022-12-14T21:33:16Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "a07c95dfa9e1a706fea0dadeb247a382ef6a5b54",
"body": "[ADDED] Xkeys support",
"is_bot": false,
"headline": "Merge pull request #182 from nats-io/xkeys",
"author_name": "Derek Collison",
"author_login": "derekcollison",
"committed_at": "2022-12-06T12:51:46Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "317149c3c5db01ea98dd1a5dfed4c8800826c40c",
"body": "The ServerID will now optionally include the public XKey from the server.\nAccountClaims can specify a public XKey for ExternalAuthorization that will force the server's authorization requests to be encrypted.\n\nNote go.mod changes are temporary to pull in staged xkeys PR. Once merged I will update.\n\nSigned-off-by: Derek Collison <derek@nats.io>",
"is_bot": false,
"headline": "Added in XKey support.",
"author_name": "Derek Collison",
"author_login": "derekcollison",
"committed_at": "2022-12-06T00:58:33Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "ec09c3a122ff202ed4c73f5fb272f881b36d45f9",
"body": "Some Updates",
"is_bot": false,
"headline": "Merge pull request #183 from nats-io/updates",
"author_name": "Derek Collison",
"author_login": "derekcollison",
"committed_at": "2022-12-05T23:02:55Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "c1f61ea53f7806b98d8be07917c91d70b84fe92a",
"body": "Signed-off-by: Derek Collison <derek@nats.io>",
"is_bot": false,
"headline": "Update travis.tml to go 1.19 and 1.18, update go modules version",
"author_name": "Derek Collison",
"author_login": "derekcollison",
"committed_at": "2022-12-05T22:58:02Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "4f532654e69662a82fab006a908f689970d2f79b",
"body": "Signed-off-by: Derek Collison <derek@nats.io>",
"is_bot": false,
"headline": "Remove ioutil",
"author_name": "Derek Collison",
"author_login": "derekcollison",
"committed_at": "2022-12-05T14:32:26Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "44198ae9f41fae1d579cc9674d28f37005c7c17e",
"body": "Signed-off-by: Derek Collison <derek@nats.io>",
"is_bot": false,
"headline": "go vet and go fmt",
"author_name": "Derek Collison",
"author_login": "derekcollison",
"committed_at": "2022-12-05T14:25:30Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "83b58fd548384c16c3101c22e13da899d2361a63",
"body": "…ecified (#181)",
"is_bot": false,
"headline": "[FIX] added validation where auth user is required if accounts are sp…",
"author_name": "Alberto Ricart",
"author_login": "aricart",
"committed_at": "2022-12-02T18:04:56Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "31baa5546134db61e7c2f6242aa3f1b873ec0627",
"body": "Added in an authorization request claims.",
"is_bot": false,
"headline": "Merge pull request #180 from nats-io/auth_request",
"author_name": "Derek Collison",
"author_login": "derekcollison",
"committed_at": "2022-12-02T14:11:17Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "bf796004f40fff71aed50f3a67686f96b953ba9d",
"body": "Signed-off-by: Derek Collison <derek@nats.io>",
"is_bot": false,
"headline": "Naming updates based on review feedback",
"author_name": "Derek Collison",
"author_login": "derekcollison",
"committed_at": "2022-12-02T14:04:21Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "8721d1a30789bbb20794b68ddf53b9bc41418ff1",
"body": "…or the NATS server.\n\nSigned-off-by: Derek Collison <derek@nats.io>",
"is_bot": false,
"headline": "Added in an authorization request claim for external authentication f…",
"author_name": "Derek Collison",
"author_login": "derekcollison",
"committed_at": "2022-12-02T13:58:22Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "ca3be3cbd866ece56191ac9b8fa274302b7abc10",
"body": "Add in support for external authorization for accounts.",
"is_bot": false,
"headline": "Merge pull request #179 from nats-io/auth_callout",
"author_name": "Derek Collison",
"author_login": "derekcollison",
"committed_at": "2022-12-01T23:24:32Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "f490b9052a670880ad044ba9da794e6a348adc98",
"body": "Signed-off-by: Derek Collison <derek@nats.io>",
"is_bot": false,
"headline": "Add in support for external authorization for accounts.",
"author_name": "Derek Collison",
"author_login": "derekcollison",
"committed_at": "2022-12-01T21:51:25Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "4a8a7328f44f94e4e9d4582fbd7f439100a2cd0e",
"body": "Release v2.3.0",
"is_bot": false,
"headline": "Merge pull request #178 from nats-io/release_2_3_0",
"author_name": "Ivan Kozlovic",
"author_login": "kozlovic",
"committed_at": "2022-06-28T20:01:56Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "58dfad6b83a61716ac242c27878b5b1da299a06e",
"body": "Signed-off-by: Ivan Kozlovic <ivan@synadia.com>",
"is_bot": false,
"headline": "Release v2.3.0",
"author_name": "Ivan Kozlovic",
"author_login": "kozlovic",
"committed_at": "2022-06-28T19:52:25Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "3bcd719cc7d083d359a1fbca2acb04a25103e264",
"body": "[add] DisallowBearerToken option to operator to disallow bearer = true",
"is_bot": false,
"headline": "Merge pull request #177 from nats-io/DisallowBearerToken",
"author_name": "Matthias Hanel",
"author_login": "matthiashanel",
"committed_at": "2022-05-09T18:01:18Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "b7cabf8dbe60a5235559a735400d84bdab1bacf6",
"body": "Signed-off-by: Matthias Hanel <mh@synadia.com>",
"is_bot": false,
"headline": "moved attribute to account",
"author_name": "Matthias Hanel",
"author_login": "matthiashanel",
"committed_at": "2022-05-09T16:59:55Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "9f4f1d5cc9778e59a02c345580814c19d845d7a7",
"body": "change 1 out of 3 for https://github.com/nats-io/nats-server/issues/3084",
"is_bot": false,
"headline": "[add] DisallowBearerToken option to operator to disallow bearer = true",
"author_name": "Matthias Hanel",
"author_login": "matthiashanel",
"committed_at": "2022-04-29T17:51:40Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "3b8532b48b96c7b018d61c646477f7bccaf33abe",
"body": "fix validation text",
"is_bot": false,
"headline": "Merge pull request #176 from nats-io/validation-text",
"author_name": "Matthias Hanel",
"author_login": "matthiashanel",
"committed_at": "2022-04-08T19:53:10Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "d3db06c2932324d92ec66a23dcf9caac3fa272fb",
"body": "Signed-off-by: Matthias Hanel <mh@synadia.com>",
"is_bot": false,
"headline": "fix validation text",
"author_name": "Matthias Hanel",
"author_login": "matthiashanel",
"committed_at": "2022-04-08T19:06:15Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "442af02fd36a57aa5b0f6b45c28f171eb2c4596d",
"body": "Adding max_ack_pending stream limit",
"is_bot": false,
"headline": "Merge pull request #174 from nats-io/max-ack-pending",
"author_name": "Matthias Hanel",
"author_login": "matthiashanel",
"committed_at": "2022-03-30T18:01:45Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "03a6fb27606bd094a397b17f420f8b3f3446d0a2",
"body": "Signed-off-by: Matthias Hanel <mh@synadia.com>",
"is_bot": false,
"headline": "Fix go 1.16 github actions staticcheck build issues",
"author_name": "Matthias Hanel",
"author_login": "matthiashanel",
"committed_at": "2022-03-30T17:54:51Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "c11dbed5c4caf2f57047ca165571088a10a6f09c",
"body": "Signed-off-by: Matthias Hanel <mh@synadia.com>",
"is_bot": false,
"headline": "Use t.Fatalf(...) instead of t.Fatal(fmt.Sprintf(...))",
"author_name": "Matthias Hanel",
"author_login": "matthiashanel",
"committed_at": "2022-03-30T17:26:24Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "9928008f35af8ef1c1e6d7475e90c30a049159a4",
"body": "Signed-off-by: Matthias Hanel <mh@synadia.com>",
"is_bot": false,
"headline": "Adding max_ack_pending stream limit",
"author_name": "Matthias Hanel",
"author_login": "matthiashanel",
"committed_at": "2022-03-30T17:26:21Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "5efd4536dd5c01f860191a1e9908dc4cb08cc1b1",
"body": "Switching MaxStreamBytes to Disk/Memory",
"is_bot": false,
"headline": "Merge pull request #173 from nats-io/maxmaxbytes-2",
"author_name": "Matthias Hanel",
"author_login": "matthiashanel",
"committed_at": "2022-03-28T22:21:44Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "2eedfe4932b246c504e3e5b1a0562081d58537c1",
"body": "And removing dependency on MaxBytesRequired\n\nSigned-off-by: Matthias Hanel <mh@synadia.com>",
"is_bot": false,
"headline": "Switching MaxStreamBytes to Disk/Memory",
"author_name": "Matthias Hanel",
"author_login": "matthiashanel",
"committed_at": "2022-03-28T22:07:42Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "3472a33220ba06f07b27c174f3a160d7ad46d047",
"body": "Adding max_max_bytes to limit the maximum value for max bytes",
"is_bot": false,
"headline": "Merge pull request #172 from nats-io/maxmaxbytes",
"author_name": "Matthias Hanel",
"author_login": "matthiashanel",
"committed_at": "2022-03-23T19:50:37Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "30ec1f4583a95097d52d11d7c8fbd5770a9fcc8e",
"body": "Signed-off-by: Matthias Hanel <mh@synadia.com>",
"is_bot": false,
"headline": "renaminb MaxMaxBytes to MaxStreamBytes",
"author_name": "Matthias Hanel",
"author_login": "matthiashanel",
"committed_at": "2022-03-23T19:34:17Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "3c80622308f6b0227c0765536e9199cfd2f6eed5",
"body": "Signed-off-by: Matthias Hanel <mh@synadia.com>",
"is_bot": false,
"headline": "Adding max_max_bytes to limit the maximum value for max bytes",
"author_name": "Matthias Hanel",
"author_login": "matthiashanel",
"committed_at": "2022-03-23T17:36:34Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "b65a1fb60b29b3dfe00ca03a835166d33b3f1ed5",
"body": "Replace HAResources with TieredLimits",
"is_bot": false,
"headline": "Merge pull request #169 from nats-io/tiers",
"author_name": "Matthias Hanel",
"author_login": "matthiashanel",
"committed_at": "2022-03-23T01:09:31Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "a1fd29b7d5757ae6987fbee5ea4f690cc5829a35",
"body": "Signed-off-by: Matthias Hanel <mh@synadia.com>",
"is_bot": false,
"headline": "Adding check for empty tier name",
"author_name": "Matthias Hanel",
"author_login": "matthiashanel",
"committed_at": "2022-03-22T17:16:34Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "afab08bdab408e12a70ed2c57ac0c5a6d76762d4",
"body": "Signed-off-by: Matthias Hanel <mh@synadia.com>",
"is_bot": false,
"headline": "Removed IsJSEnabled from JetStreamLimits",
"author_name": "Matthias Hanel",
"author_login": "matthiashanel",
"committed_at": "2022-03-22T17:16:34Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "c7a51045b15e21de6f66cc488f829565811f27b8",
"body": "Signed-off-by: Matthias Hanel <mh@synadia.com>",
"is_bot": false,
"headline": "add IsJSEnabled to operator",
"author_name": "Matthias Hanel",
"author_login": "matthiashanel",
"committed_at": "2022-03-22T17:16:33Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "97065db7e63601cd6b27341f753955c0a729f34f",
"body": "TieredLimits are mutually exclusive with JetStream limits\n\nSigned-off-by: Matthias Hanel <mh@synadia.com>",
"is_bot": false,
"headline": "Replace HAResources with TieredLimits",
"author_name": "Matthias Hanel",
"author_login": "matthiashanel",
"committed_at": "2022-03-22T17:16:30Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "a4dc57f25ef3e0e29b2147ac2a1bf1707e02197f",
"body": "Fix test deps",
"is_bot": false,
"headline": "Merge pull request #171 from nats-io/fix-testdeps",
"author_name": "Waldemar Quevedo",
"author_login": "wallyqs",
"committed_at": "2022-03-14T19:23:52Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "c3542f5ffb33d1f6e04103b7f2bfd039240d9e55",
"body": "Signed-off-by: Waldemar Quevedo <wally@synadia.com>",
"is_bot": false,
"headline": "Add script for testing and update Makefile",
"author_name": "Waldemar Quevedo",
"author_login": "wallyqs",
"committed_at": "2022-03-14T18:24:08Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "cbc856a8beb08a926a974ee77e6104d87ea3f888",
"body": "Only used for testing\n\nSigned-off-by: Waldemar Quevedo <wally@synadia.com>",
"is_bot": false,
"headline": "Remove indirect dependency on jwt v1",
"author_name": "Waldemar Quevedo",
"author_login": "wallyqs",
"committed_at": "2022-03-14T17:28:37Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "0ebff70bb0963daa37c706e5960818b0d6ad6e3f",
"body": "Update travis to Go 1.17",
"is_bot": false,
"headline": "Merge pull request #167 from nats-io/go_1_17",
"author_name": "Ivan Kozlovic",
"author_login": "kozlovic",
"committed_at": "2022-02-16T23:03:43Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "c9f0ca9fcf07a515b599a5ffce05e67a488c6283",
"body": "rename struct member HaResources to HAResources",
"is_bot": false,
"headline": "Merge pull request #166 from nats-io/ha-resources",
"author_name": "Matthias Hanel",
"author_login": "matthiashanel",
"committed_at": "2022-02-16T19:22:39Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "5be8995e08934c19c03c5a5da099fadf56010742",
"body": "Signed-off-by: Ivan Kozlovic <ivan@synadia.com>",
"is_bot": false,
"headline": "Update travis to Go 1.17",
"author_name": "Ivan Kozlovic",
"author_login": "kozlovic",
"committed_at": "2022-02-16T19:01:34Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "1e88c50fd302b04501d43a44147296805eb1bb69",
"body": "Signed-off-by: Matthias Hanel <mh@synadia.com>",
"is_bot": false,
"headline": "rename struct member HaResources to HAResources",
"author_name": "Matthias Hanel",
"author_login": "matthiashanel",
"committed_at": "2022-02-16T18:20:53Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "4b4a1c85619d16bd2aa59e41e94d8cdf2c1b7eca",
"body": "* Adding support for HA resources",
"is_bot": false,
"headline": "Adding support for HA resources (#165)",
"author_name": "Matthias Hanel",
"author_login": "matthiashanel",
"committed_at": "2022-02-08T17:44:25Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "58e87895b29641314818a5171038b73cff3bd25a",
"body": "* [FEATURE] Adding support for js max bytes required\r\n\r\nSigned-off-by: Matthias Hanel <mh@synadia.com>",
"is_bot": false,
"headline": "[FEATURE] Adding support for js max bytes required (#164)",
"author_name": "Matthias Hanel",
"author_login": "matthiashanel",
"committed_at": "2022-01-13T02:27:32Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "b87bc9cf336d182cff5afba51e7515893da95bba",
"body": "Adr 14",
"is_bot": false,
"headline": "Merge pull request #163 from nats-io/ADR-14",
"author_name": "Jean-Noël Moyne",
"author_login": "jnmoyne",
"committed_at": "2021-12-14T20:16:57Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "b991e3474e70adc228c509ea13a2c223a510a8ba",
"body": null,
"is_bot": false,
"headline": "IssuedAt is set by encode",
"author_name": "jnmoyne",
"author_login": "jnmoyne",
"committed_at": "2021-12-07T20:13:09Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "2406b1ff49e98e94b47040b2d951dafb271882b0",
"body": "…ob/main/adr/ADR-14.md",
"is_bot": false,
"headline": "Implements https://github.com/nats-io/nats-architecture-and-design/bl…",
"author_name": "jnmoyne",
"author_login": "jnmoyne",
"committed_at": "2021-12-06T23:48:18Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "fbbb4a5843511563d15bdd483f7ff3746aed0b36",
"body": "…ob/main/adr/ADR-14.md",
"is_bot": false,
"headline": "Implements https://github.com/nats-io/nats-architecture-and-design/bl…",
"author_name": "jnmoyne",
"author_login": "jnmoyne",
"committed_at": "2021-12-06T22:37:09Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "5474835bf2710001b83cc23d8c86d07b1bb75477",
"body": "Release v2.2.0",
"is_bot": false,
"headline": "Merge pull request #162 from nats-io/release_2_2_0",
"author_name": "Ivan Kozlovic",
"author_login": "kozlovic",
"committed_at": "2021-11-15T17:56:59Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "18ec093b4302783654e28b9aeb06e8afa28459c3",
"body": "Signed-off-by: Ivan Kozlovic <ivan@synadia.com>",
"is_bot": false,
"headline": "Release v2.2.0",
"author_name": "Ivan Kozlovic",
"author_login": "kozlovic",
"committed_at": "2021-11-15T17:03:38Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "ab1121ab4151fe0c6f99880f376483a929c4c058",
"body": "[ADDED] New websocket connection types",
"is_bot": false,
"headline": "Merge pull request #161 from nats-io/add_ws_conn_types",
"author_name": "Ivan Kozlovic",
"author_login": "kozlovic",
"committed_at": "2021-11-15T16:46:47Z",
"body_truncated": false,
"is_coding_agent": false
}
],
"releases_count": 46,
"commits_last_year": 11,
"latest_release_at": "2026-06-02T13:54:22Z",
"latest_release_tag": "v2.8.2",
"releases_from_tags": false,
"days_since_last_push": 49,
"active_weeks_last_year": 4,
"days_since_latest_release": 49,
"mean_days_between_releases": 77.4
},
"community": {
"has_readme": true,
"has_license": true,
"has_description": true,
"has_contributing": false,
"health_percentage": 37,
"has_issue_template": false,
"has_code_of_conduct": false,
"has_pull_request_template": false
},
"ecosystem": {
"packages": [
{
"name": "github.com/nats-io/jwt/v2",
"exists": true,
"license": null,
"keywords": [],
"ecosystem": "go",
"matches_repo": true,
"registry_url": "https://pkg.go.dev/github.com/nats-io/jwt/v2",
"is_deprecated": false,
"latest_version": "v2.8.2",
"repository_url": "https://github.com/nats-io/jwt",
"versions_count": 27,
"total_downloads": null,
"dependents_count": null,
"deprecation_note": null,
"maintainers_count": null,
"monthly_downloads": null,
"first_published_at": null,
"latest_published_at": "2026-06-02T13:53:38Z",
"latest_version_yanked": null,
"days_since_latest_publish": 49
}
]
},
"popularity": {
"forks": 37,
"stars": 88,
"watchers": 3,
"fork_history": {
"days": [
{
"date": "2018-12-16",
"count": 1
},
{
"date": "2019-03-01",
"count": 1
},
{
"date": "2019-08-09",
"count": 1
},
{
"date": "2019-09-22",
"count": 1
},
{
"date": "2019-12-05",
"count": 1
},
{
"date": "2020-02-12",
"count": 1
},
{
"date": "2020-03-12",
"count": 1
},
{
"date": "2020-05-22",
"count": 1
},
{
"date": "2020-10-14",
"count": 1
},
{
"date": "2020-10-28",
"count": 1
},
{
"date": "2020-12-21",
"count": 1
},
{
"date": "2021-05-12",
"count": 1
},
{
"date": "2021-07-20",
"count": 2
},
{
"date": "2021-08-06",
"count": 1
},
{
"date": "2021-08-24",
"count": 1
},
{
"date": "2021-09-28",
"count": 1
},
{
"date": "2022-03-03",
"count": 1
},
{
"date": "2022-11-30",
"count": 1
},
{
"date": "2023-01-20",
"count": 1
},
{
"date": "2023-04-03",
"count": 1
},
{
"date": "2023-07-03",
"count": 1
},
{
"date": "2023-07-20",
"count": 1
},
{
"date": "2023-08-18",
"count": 1
},
{
"date": "2023-10-24",
"count": 1
},
{
"date": "2024-10-28",
"count": 1
},
{
"date": "2025-04-26",
"count": 1
},
{
"date": "2025-04-27",
"count": 1
},
{
"date": "2025-04-29",
"count": 1
},
{
"date": "2025-07-09",
"count": 1
},
{
"date": "2025-07-11",
"count": 1
},
{
"date": "2025-08-23",
"count": 1
},
{
"date": "2026-02-17",
"count": 1
},
{
"date": "2026-02-20",
"count": 1
},
{
"date": "2026-03-05",
"count": 1
},
{
"date": "2026-06-21",
"count": 1
}
],
"complete": true,
"collected": 36,
"total_forks": 37
},
"star_history": {
"days": [
{
"date": "2018-10-15",
"count": 1
},
{
"date": "2018-12-16",
"count": 1
},
{
"date": "2018-12-21",
"count": 1
},
{
"date": "2019-03-01",
"count": 1
},
{
"date": "2019-03-24",
"count": 1
},
{
"date": "2019-04-16",
"count": 1
},
{
"date": "2019-06-17",
"count": 1
},
{
"date": "2019-07-06",
"count": 1
},
{
"date": "2019-07-20",
"count": 1
},
{
"date": "2019-07-31",
"count": 2
},
{
"date": "2019-08-01",
"count": 1
},
{
"date": "2019-08-05",
"count": 1
},
{
"date": "2019-08-14",
"count": 1
},
{
"date": "2019-08-19",
"count": 1
},
{
"date": "2019-09-04",
"count": 1
},
{
"date": "2019-09-17",
"count": 1
},
{
"date": "2019-09-18",
"count": 1
},
{
"date": "2019-09-19",
"count": 1
},
{
"date": "2019-12-03",
"count": 1
},
{
"date": "2019-12-04",
"count": 1
},
{
"date": "2019-12-05",
"count": 1
},
{
"date": "2020-01-13",
"count": 1
},
{
"date": "2020-01-19",
"count": 1
},
{
"date": "2020-03-05",
"count": 1
},
{
"date": "2020-03-15",
"count": 1
},
{
"date": "2020-03-20",
"count": 1
},
{
"date": "2020-05-08",
"count": 1
},
{
"date": "2020-05-24",
"count": 1
},
{
"date": "2020-07-05",
"count": 1
},
{
"date": "2020-09-04",
"count": 1
},
{
"date": "2020-09-27",
"count": 1
},
{
"date": "2020-10-07",
"count": 1
},
{
"date": "2020-10-31",
"count": 1
},
{
"date": "2020-12-11",
"count": 1
},
{
"date": "2020-12-13",
"count": 1
},
{
"date": "2021-01-27",
"count": 1
},
{
"date": "2021-02-05",
"count": 1
},
{
"date": "2021-03-22",
"count": 1
},
{
"date": "2021-04-25",
"count": 1
},
{
"date": "2021-05-12",
"count": 1
},
{
"date": "2021-09-29",
"count": 1
},
{
"date": "2021-10-22",
"count": 1
},
{
"date": "2021-12-20",
"count": 1
},
{
"date": "2022-01-14",
"count": 1
},
{
"date": "2022-02-21",
"count": 1
},
{
"date": "2022-03-03",
"count": 1
},
{
"date": "2022-03-22",
"count": 1
},
{
"date": "2022-03-29",
"count": 1
},
{
"date": "2022-05-03",
"count": 1
},
{
"date": "2022-07-16",
"count": 1
},
{
"date": "2022-08-14",
"count": 1
},
{
"date": "2022-09-21",
"count": 1
},
{
"date": "2022-11-04",
"count": 1
},
{
"date": "2022-12-17",
"count": 1
},
{
"date": "2023-01-16",
"count": 1
},
{
"date": "2023-01-24",
"count": 1
},
{
"date": "2023-02-22",
"count": 1
},
{
"date": "2023-03-06",
"count": 2
},
{
"date": "2023-03-21",
"count": 1
},
{
"date": "2023-03-25",
"count": 1
},
{
"date": "2023-04-24",
"count": 1
},
{
"date": "2023-08-25",
"count": 1
},
{
"date": "2023-09-07",
"count": 1
},
{
"date": "2024-03-23",
"count": 1
},
{
"date": "2024-03-25",
"count": 1
},
{
"date": "2024-04-21",
"count": 1
},
{
"date": "2024-06-17",
"count": 1
},
{
"date": "2024-06-27",
"count": 1
},
{
"date": "2024-07-10",
"count": 1
},
{
"date": "2024-07-18",
"count": 1
},
{
"date": "2024-07-27",
"count": 1
},
{
"date": "2024-09-25",
"count": 2
},
{
"date": "2025-02-03",
"count": 1
},
{
"date": "2025-03-27",
"count": 1
},
{
"date": "2025-04-04",
"count": 1
},
{
"date": "2025-04-26",
"count": 1
},
{
"date": "2025-05-20",
"count": 1
},
{
"date": "2025-06-04",
"count": 1
},
{
"date": "2025-09-09",
"count": 1
},
{
"date": "2025-10-05",
"count": 1
},
{
"date": "2025-10-28",
"count": 1
},
{
"date": "2026-01-19",
"count": 1
},
{
"date": "2026-02-23",
"count": 1
},
{
"date": "2026-06-07",
"count": 1
}
],
"complete": true,
"collected": 87,
"total_stars": 88
},
"open_issues_and_prs": 14
},
"ai_readiness": {
"has_nix": false,
"example_dirs": [],
"has_llms_txt": false,
"has_dockerfile": false,
"has_mcp_signal": false,
"bootstrap_files": [
"v2/Makefile",
"v2/v1compat/Makefile"
],
"api_schema_files": [],
"has_devcontainer": false,
"typecheck_configs": [],
"toolchain_manifests": [
"v2/go.mod"
],
"largest_source_bytes": 31695,
"source_files_sampled": 66,
"oversized_source_files": 0,
"agent_instruction_files": [],
"agent_instruction_max_bytes": null
},
"dependencies": {
"manifests": [
"v2/go.mod"
],
"advisories": {
"error": null,
"scope": "repository_graph",
"source": "osv",
"findings": [
{
"name": "github.com/nats-io/jwt",
"direct": false,
"version": "1.2.2",
"severity": "critical",
"ecosystem": "go",
"cvss_score": null,
"advisory_ids": [
"GHSA-62mh-w5cv-p88c",
"GO-2022-0386"
],
"fixed_version": "2.0.1",
"advisory_count": 2,
"oldest_advisory_days": 1618
},
{
"name": "golang.org/x/crypto",
"direct": false,
"version": "v0.52.0",
"severity": "unknown",
"ecosystem": "go",
"cvss_score": null,
"advisory_ids": [
"GO-2026-5932"
],
"fixed_version": null,
"advisory_count": 1,
"oldest_advisory_days": 14
}
],
"collected": true,
"malicious": [],
"truncated": false,
"by_severity": {
"unknown": 1,
"critical": 1
},
"advisory_count": 3,
"affected_count": 2,
"assessed_count": 5,
"malicious_count": 0,
"assessed_package": null,
"unassessed_count": 0,
"direct_affected_count": 0
},
"ecosystems": [
"go"
],
"dependencies": [
{
"name": "github.com/nats-io/nkeys",
"manifest": "v2/go.mod",
"ecosystem": "go",
"version_constraint": "v0.4.16"
}
],
"all_dependencies": {
"error": null,
"source": "github-sbom",
"packages": [
{
"name": "github.com/nats-io/nkeys",
"direct": true,
"version": "0.3.0",
"ecosystem": "go"
},
{
"name": "github.com/nats-io/nkeys",
"direct": true,
"version": "v0.4.16",
"ecosystem": "go"
},
{
"name": "github.com/nats-io/jwt",
"direct": false,
"version": "1.2.2",
"ecosystem": "go"
},
{
"name": "golang.org/x/crypto",
"direct": false,
"version": "v0.52.0",
"ecosystem": "go"
},
{
"name": "golang.org/x/sys",
"direct": false,
"version": "v0.45.0",
"ecosystem": "go"
}
],
"collected": true,
"truncated": false,
"total_count": 5,
"direct_count": 2,
"indirect_count": 3
}
},
"maintainership": {
"issues": {
"open_prs": 1,
"merged_prs": 188,
"open_issues": 13,
"closed_ratio": 0.594,
"closed_issues": 19,
"closed_unmerged_prs": 27
},
"bus_factor": 2,
"bot_contributors": 1,
"top_contributors": [
{
"type": "User",
"login": "aricart",
"commits": 96,
"avatar_url": "https://avatars.githubusercontent.com/u/1032976?v=4"
},
{
"type": "User",
"login": "matthiashanel",
"commits": 71,
"avatar_url": "https://avatars.githubusercontent.com/u/19881388?v=4"
},
{
"type": "User",
"login": "derekcollison",
"commits": 47,
"avatar_url": "https://avatars.githubusercontent.com/u/90097?v=4"
},
{
"type": "User",
"login": "kozlovic",
"commits": 46,
"avatar_url": "https://avatars.githubusercontent.com/u/13736691?v=4"
},
{
"type": "User",
"login": "sasbury",
"commits": 10,
"avatar_url": "https://avatars.githubusercontent.com/u/3311569?v=4"
},
{
"type": "User",
"login": "wallyqs",
"commits": 8,
"avatar_url": "https://avatars.githubusercontent.com/u/26195?v=4"
},
{
"type": "User",
"login": "jnmoyne",
"commits": 4,
"avatar_url": "https://avatars.githubusercontent.com/u/7819096?v=4"
},
{
"type": "User",
"login": "neilalexander",
"commits": 4,
"avatar_url": "https://avatars.githubusercontent.com/u/310854?v=4"
},
{
"type": "User",
"login": "henryleduc",
"commits": 3,
"avatar_url": "https://avatars.githubusercontent.com/u/55436491?v=4"
},
{
"type": "User",
"login": "philpennock",
"commits": 3,
"avatar_url": "https://avatars.githubusercontent.com/u/559098?v=4"
}
],
"contributors_sampled": 16,
"top_contributor_share": 0.32
},
"quality_signals": {
"has_ci": true,
"has_tests": true,
"ci_workflows": [
"claude.yaml",
"go-test.yaml"
],
"has_docs_dir": false,
"linter_configs": [],
"has_editorconfig": false,
"has_linter_config": false,
"has_precommit_config": false
},
"security_signals": {
"lockfiles": [
"go.sum"
],
"scorecard": {
"checks": [
{
"name": "Binary-Artifacts",
"score": 10,
"reason": "no binaries found in the repo",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#binary-artifacts"
},
{
"name": "Branch-Protection",
"score": null,
"reason": "internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#branch-protection"
},
{
"name": "CI-Tests",
"score": 4,
"reason": "11 out of 27 merged PRs checked by a CI test -- score normalized to 4",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#ci-tests"
},
{
"name": "CII-Best-Practices",
"score": 0,
"reason": "no effort to earn an OpenSSF best practices badge detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#cii-best-practices"
},
{
"name": "Code-Review",
"score": 10,
"reason": "all changesets reviewed",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#code-review"
},
{
"name": "Contributors",
"score": 10,
"reason": "project has 5 contributing companies or organizations",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#contributors"
},
{
"name": "Dangerous-Workflow",
"score": 10,
"reason": "no dangerous workflow patterns detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dangerous-workflow"
},
{
"name": "Dependency-Update-Tool",
"score": 10,
"reason": "update tool detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dependency-update-tool"
},
{
"name": "Fuzzing",
"score": 0,
"reason": "project is not fuzzed",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#fuzzing"
},
{
"name": "License",
"score": 10,
"reason": "license file detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#license"
},
{
"name": "Maintained",
"score": 1,
"reason": "2 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 1",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#maintained"
},
{
"name": "Packaging",
"score": null,
"reason": "packaging workflow not detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#packaging"
},
{
"name": "Pinned-Dependencies",
"score": 0,
"reason": "dependency not pinned by hash detected -- score normalized to 0",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#pinned-dependencies"
},
{
"name": "SAST",
"score": 3,
"reason": "SAST tool is not run on all commits -- score normalized to 3",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#sast"
},
{
"name": "Security-Policy",
"score": 0,
"reason": "security policy file not detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#security-policy"
},
{
"name": "Signed-Releases",
"score": null,
"reason": "no releases found",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#signed-releases"
},
{
"name": "Token-Permissions",
"score": 0,
"reason": "detected GitHub workflow tokens with excessive permissions",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#token-permissions"
},
{
"name": "Vulnerabilities",
"score": 9,
"reason": "1 existing vulnerabilities detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#vulnerabilities"
}
],
"commit": "82017236da50e4a0173091105d82d46228b8dccf",
"ran_at": "2026-07-22T07:18:17Z",
"aggregate_score": 5.6,
"scorecard_version": "v5.5.0"
},
"has_codeql_workflow": false,
"has_security_policy": false,
"has_dependabot_config": false
},
"contribution_flow": {
"collected": true,
"ci_last_run_at": "2026-07-15T17:54:58Z",
"oldest_open_prs": [
{
"number": 210,
"created_at": "2023-10-25T18:44:30Z",
"last_comment_at": null,
"last_comment_author": null
}
],
"last_merged_pr_at": "2026-06-02T13:53:39Z",
"ci_last_conclusion": "SUCCESS",
"oldest_open_issues": [
{
"number": 30,
"created_at": "2019-04-09T23:24:12Z",
"last_comment_at": null,
"last_comment_author": null
},
{
"number": 63,
"created_at": "2019-12-19T13:44:00Z",
"last_comment_at": null,
"last_comment_author": null
},
{
"number": 65,
"created_at": "2019-12-19T13:49:31Z",
"last_comment_at": null,
"last_comment_author": null
},
{
"number": 83,
"created_at": "2020-06-24T22:22:23Z",
"last_comment_at": null,
"last_comment_author": null
},
{
"number": 84,
"created_at": "2020-06-24T22:23:32Z",
"last_comment_at": null,
"last_comment_author": null
},
{
"number": 101,
"created_at": "2020-09-22T18:09:41Z",
"last_comment_at": null,
"last_comment_author": null
},
{
"number": 112,
"created_at": "2020-10-24T02:40:51Z",
"last_comment_at": null,
"last_comment_author": null
},
{
"number": 118,
"created_at": "2020-11-24T22:50:51Z",
"last_comment_at": "2020-11-24T23:36:28Z",
"last_comment_author": "philpennock"
},
{
"number": 123,
"created_at": "2020-12-04T18:14:50Z",
"last_comment_at": null,
"last_comment_author": null
},
{
"number": 170,
"created_at": "2022-03-14T15:06:58Z",
"last_comment_at": null,
"last_comment_author": null
},
{
"number": 199,
"created_at": "2023-05-06T22:38:00Z",
"last_comment_at": "2023-12-18T12:13:31Z",
"last_comment_author": "ahirner"
},
{
"number": 207,
"created_at": "2023-08-25T19:58:54Z",
"last_comment_at": "2023-08-25T20:19:04Z",
"last_comment_author": "aricart"
},
{
"number": 249,
"created_at": "2026-04-23T08:18:19Z",
"last_comment_at": "2026-04-23T13:56:26Z",
"last_comment_author": "choufraise"
}
]
}
},
"config": {
"disabled_metrics": [],
"disabled_categories": [],
"disabled_components": {}
},
"source": {
"url": "https://github.com/nats-io/jwt",
"host": "github.com",
"name": "jwt",
"owner": "nats-io"
},
"metrics": {
"overall": {
"key": "overall",
"band": "moderate",
"name": "Overall health",
"note": null,
"notes": [],
"value": 61,
"inputs": {
"security": 65,
"vitality": 56,
"community": 48,
"governance": 78,
"engineering": 54
},
"components": []
},
"categories": [
{
"key": "vitality",
"band": "moderate",
"name": "Vitality",
"value": 56,
"weight": 0.22,
"metrics": [
{
"key": "development_activity",
"band": "at_risk",
"name": "Development activity",
"note": null,
"notes": [],
"value": 32,
"inputs": {
"commits_last_year": 11,
"human_commit_share": 0.99,
"days_since_last_push": 49,
"active_weeks_last_year": 4
},
"components": [
{
"key": "push_recency",
"name": "Push recency",
"detail": "last push 49 days ago",
"points": 18,
"status": "partial",
"details": [
{
"code": "push_recency",
"params": {
"days": 49
}
}
],
"max_points": 36
},
{
"key": "commit_cadence",
"name": "Commit cadence",
"detail": "4/52 weeks with commits",
"points": 2.8,
"status": "partial",
"details": [
{
"code": "commit_cadence_weeks",
"params": {
"weeks": 4
}
}
],
"max_points": 36
},
{
"key": "commit_volume",
"name": "Commit volume",
"detail": "11 commits in the last year",
"points": 9.7,
"status": "partial",
"details": [
{
"code": "commits_last_year",
"params": {
"count": 11
}
}
],
"max_points": 18
},
{
"key": "openssf_scorecard_maintained",
"name": "OpenSSF Scorecard: Maintained",
"detail": "2 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 1",
"points": 1,
"status": "partial",
"details": [],
"max_points": 10
}
]
},
{
"key": "release_discipline",
"band": "excellent",
"name": "Release discipline",
"note": "Excluded from scoring (no data or not applicable): OpenSSF Scorecard: Signed-Releases. Remaining weights renormalized.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"openssf_scorecard_signed_releases"
]
}
},
{
"code": "weights_renormalized",
"params": {}
}
],
"value": 92,
"inputs": {
"releases_count": 46,
"latest_release_tag": "v2.8.2",
"releases_from_tags": false,
"days_since_latest_release": 49,
"mean_days_between_releases": 77.4
},
"components": [
{
"key": "ships_releases",
"name": "Ships releases",
"detail": "46 releases published",
"points": 27,
"status": "met",
"details": [
{
"code": "releases_published",
"params": {
"count": 46
}
}
],
"max_points": 27
},
{
"key": "release_recency",
"name": "Release recency",
"detail": "latest release 49 days ago",
"points": 36,
"status": "met",
"details": [
{
"code": "release_recency",
"params": {
"days": 49
}
}
],
"max_points": 36
},
{
"key": "release_cadence",
"name": "Release cadence",
"detail": "a release every ~77.4 days",
"points": 19.8,
"status": "partial",
"details": [
{
"code": "release_cadence",
"params": {
"gap": 77.4
}
}
],
"max_points": 27
},
{
"key": "openssf_scorecard_signed_releases",
"name": "OpenSSF Scorecard: Signed-Releases",
"detail": "no releases found",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_data",
"params": {}
}
],
"max_points": 10
}
]
},
{
"key": "abandonment",
"band": "excellent",
"name": "Abandonment",
"note": null,
"notes": [],
"value": 100,
"inputs": {
"cap": null,
"state": "maintained",
"guards": [],
"signals": [],
"red_flag": false,
"multiplier_pct": 100,
"declared_reason": null,
"unverified_reason": null,
"unanswered_open_prs": null,
"unanswered_open_issues": null,
"days_since_last_merged_pr": null,
"days_since_last_human_commit": 49,
"days_since_last_human_commit_is_floor": false
},
"components": [
{
"key": "project_is_still_maintained",
"name": "Project is still maintained",
"detail": "last human commit 49 days ago",
"points": 100,
"status": "met",
"details": [
{
"code": "abandonment_maintained",
"params": {
"days": 49
}
}
],
"max_points": 100
}
]
}
],
"description": "Is the project alive — is code being written and are releases shipping?"
},
{
"key": "community",
"band": "at_risk",
"name": "Community & Adoption",
"value": 48,
"weight": 0.18,
"metrics": [
{
"key": "popularity",
"band": "at_risk",
"name": "Popularity & adoption",
"note": null,
"notes": [],
"value": 46,
"inputs": {
"forks": 37,
"stars": 88,
"watchers": 3,
"growth_state": "unverified",
"growth_factor_pct": 100,
"growth_unverified_reason": "below_threshold"
},
"components": [
{
"key": "stars",
"name": "Stars",
"detail": "88 stars",
"points": 31.5,
"status": "partial",
"details": [
{
"code": "stars",
"params": {
"count": 88
}
}
],
"max_points": 60
},
{
"key": "forks",
"name": "Forks",
"detail": "37 forks",
"points": 13,
"status": "partial",
"details": [
{
"code": "forks",
"params": {
"count": 37
}
}
],
"max_points": 25
},
{
"key": "watchers",
"name": "Watchers",
"detail": "3 watchers",
"points": 1.7,
"status": "partial",
"details": [
{
"code": "watchers",
"params": {
"count": 3
}
}
],
"max_points": 15
}
]
},
{
"key": "community_health",
"band": "moderate",
"name": "Community health",
"note": null,
"notes": [],
"value": 50,
"inputs": {
"has_readme": true,
"has_license": true,
"has_contributing": false,
"has_issue_template": false,
"has_code_of_conduct": false,
"has_pull_request_template": false
},
"components": [
{
"key": "readme",
"name": "README",
"detail": null,
"points": 22.5,
"status": "met",
"details": [],
"max_points": 22.5
},
{
"key": "license",
"name": "License",
"detail": "recognized license (Apache-2.0)",
"points": 22.5,
"status": "met",
"details": [
{
"code": "license_standard",
"params": {}
},
{
"code": "license_spdx",
"params": {
"spdx": "Apache-2.0"
}
}
],
"max_points": 22.5
},
{
"key": "contributing_guide",
"name": "CONTRIBUTING guide",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 18
},
{
"key": "code_of_conduct",
"name": "Code of conduct",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 13.5
},
{
"key": "issue_template",
"name": "Issue template",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.2
},
{
"key": "pr_template",
"name": "PR template",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 6.3
}
]
}
],
"description": "Does the project have users, downloads, attention, and a welcoming setup for contributors?"
},
{
"key": "governance",
"band": "good",
"name": "Sustainability & Governance",
"value": 78,
"weight": 0.24,
"metrics": [
{
"key": "maintainer_resilience",
"band": "moderate",
"name": "Maintainer resilience (bus factor)",
"note": null,
"notes": [],
"value": 64,
"inputs": {
"bus_factor": 2,
"contributors_sampled": 16,
"top_contributor_share": 0.32
},
"components": [
{
"key": "bus_factor",
"name": "Bus factor",
"detail": "2 contributor(s) cover half of all commits",
"points": 25.2,
"status": "partial",
"details": [
{
"code": "bus_factor",
"params": {
"count": 2
}
}
],
"max_points": 54
},
{
"key": "commit_distribution",
"name": "Commit distribution",
"detail": "top contributor authored 32% of commits",
"points": 15.3,
"status": "partial",
"details": [
{
"code": "top_contributor_share",
"params": {
"share": 32
}
}
],
"max_points": 22.5
},
{
"key": "contributor_breadth",
"name": "Contributor breadth",
"detail": "16 contributors",
"points": 13.5,
"status": "met",
"details": [
{
"code": "contributors_sampled",
"params": {
"count": 16
}
}
],
"max_points": 13.5
},
{
"key": "openssf_scorecard_contributors",
"name": "OpenSSF Scorecard: Contributors",
"detail": "project has 5 contributing companies or organizations",
"points": 10,
"status": "met",
"details": [],
"max_points": 10
}
]
},
{
"key": "responsiveness",
"band": "good",
"name": "Issue & PR responsiveness",
"note": null,
"notes": [],
"value": 76,
"inputs": {
"merged_prs": 188,
"open_issues": 13,
"closed_issues": 19,
"issue_closed_ratio": 0.594,
"closed_unmerged_prs": 27
},
"components": [
{
"key": "issue_resolution",
"name": "Issue resolution",
"detail": "59% of issues closed",
"points": 27.8,
"status": "partial",
"details": [
{
"code": "issues_closed_share",
"params": {
"share": 59
}
}
],
"max_points": 46.75
},
{
"key": "pr_acceptance",
"name": "PR acceptance",
"detail": "188/215 decided PRs merged",
"points": 33.4,
"status": "partial",
"details": [
{
"code": "decided_prs_merged",
"params": {
"merged": 188,
"decided": 215
}
}
],
"max_points": 38.25
},
{
"key": "openssf_scorecard_code_review",
"name": "OpenSSF Scorecard: Code-Review",
"detail": "all changesets reviewed",
"points": 15,
"status": "met",
"details": [],
"max_points": 15
}
]
},
{
"key": "stewardship",
"band": "good",
"name": "Ownership & stewardship",
"note": null,
"notes": [],
"value": 79,
"inputs": {
"followers": 2424,
"owner_type": "Organization",
"is_verified": null,
"owner_login": "nats-io",
"public_repos": 131,
"account_age_days": 4236
},
"components": [
{
"key": "ownership_backing",
"name": "Ownership backing",
"detail": "organization-owned",
"points": 30,
"status": "met",
"details": [
{
"code": "owner_organization",
"params": {}
}
],
"max_points": 30
},
{
"key": "verified_domain",
"name": "Verified domain",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 20
},
{
"key": "owner_reach",
"name": "Owner reach",
"detail": "2,424 followers of nats-io",
"points": 24.3,
"status": "partial",
"details": [
{
"code": "owner_followers",
"params": {
"count": 2424,
"login": "nats-io"
}
}
],
"max_points": 25
},
{
"key": "track_record",
"name": "Track record",
"detail": "131 public repos, account ~11 yr old",
"points": 25,
"status": "met",
"details": [
{
"code": "public_repos",
"params": {
"count": 131
}
},
{
"code": "account_age_years",
"params": {
"years": 11
}
}
],
"max_points": 25
}
]
},
{
"key": "package_maintenance",
"band": "excellent",
"name": "Package maintenance",
"note": null,
"notes": [],
"value": 100,
"inputs": {
"packages": [
"github.com/nats-io/jwt/v2"
],
"ecosystems": "go",
"any_deprecated": false,
"min_days_since_publish": 49
},
"components": [
{
"key": "published_resolvable",
"name": "Published & resolvable",
"detail": "1 package(s) on go",
"points": 25,
"status": "met",
"details": [
{
"code": "packages_published",
"params": {
"count": 1,
"ecosystems": "go"
}
}
],
"max_points": 25
},
{
"key": "publish_recency",
"name": "Publish recency",
"detail": "latest publish 49 days ago",
"points": 35,
"status": "met",
"details": [
{
"code": "publish_recency",
"params": {
"days": 49
}
}
],
"max_points": 35
},
{
"key": "version_history",
"name": "Version history",
"detail": "27 published versions",
"points": 20,
"status": "met",
"details": [
{
"code": "published_versions",
"params": {
"count": 27
}
}
],
"max_points": 20
},
{
"key": "not_deprecated",
"name": "Not deprecated",
"detail": "active, not deprecated or yanked",
"points": 20,
"status": "met",
"details": [
{
"code": "package_not_deprecated",
"params": {}
}
],
"max_points": 20
}
]
}
],
"description": "Will the project survive its people — bus factor, responsiveness, who backs it, and package upkeep?"
},
{
"key": "engineering",
"band": "moderate",
"name": "Engineering Quality",
"value": 54,
"weight": 0.2,
"metrics": [
{
"key": "engineering_practices",
"band": "moderate",
"name": "Engineering practices",
"note": null,
"notes": [],
"value": 56,
"inputs": {
"has_ci": true,
"has_tests": true,
"has_editorconfig": false,
"has_linter_config": false,
"has_precommit_config": false
},
"components": [
{
"key": "ci_workflows",
"name": "CI workflows",
"detail": "2 workflow(s)",
"points": 24,
"status": "met",
"details": [
{
"code": "ci_workflows",
"params": {
"count": 2
}
}
],
"max_points": 24
},
{
"key": "tests_present",
"name": "Tests present",
"detail": null,
"points": 24,
"status": "met",
"details": [],
"max_points": 24
},
{
"key": "linter_config",
"name": "Linter config",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 16
},
{
"key": "pre_commit_hooks",
"name": "Pre-commit hooks",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 9.6
},
{
"key": "editorconfig",
"name": ".editorconfig",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 6.4
},
{
"key": "openssf_scorecard_ci_tests",
"name": "OpenSSF Scorecard: CI-Tests",
"detail": "11 out of 27 merged PRs checked by a CI test -- score normalized to 4",
"points": 8,
"status": "partial",
"details": [],
"max_points": 20
}
]
},
{
"key": "documentation",
"band": "moderate",
"name": "Documentation",
"note": null,
"notes": [],
"value": 50,
"inputs": {
"topics": [],
"has_wiki": true,
"homepage": null,
"has_readme": true,
"has_docs_dir": false,
"has_description": true
},
"components": [
{
"key": "readme",
"name": "README",
"detail": null,
"points": 30,
"status": "met",
"details": [],
"max_points": 30
},
{
"key": "documentation_directory",
"name": "Documentation directory",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 25
},
{
"key": "documentation_homepage_site",
"name": "Documentation / homepage site",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 15
},
{
"key": "repository_description",
"name": "Repository description",
"detail": null,
"points": 10,
"status": "met",
"details": [],
"max_points": 10
},
{
"key": "topics",
"name": "Topics",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 10
},
{
"key": "wiki",
"name": "Wiki",
"detail": null,
"points": 10,
"status": "met",
"details": [],
"max_points": 10
}
]
}
],
"description": "Are baseline engineering and documentation practices in place?"
},
{
"key": "security",
"band": "moderate",
"name": "Security",
"value": 65,
"weight": 0.16,
"metrics": [
{
"key": "security_posture",
"band": "moderate",
"name": "Security posture",
"note": "Excluded from scoring (no data or not applicable): Branch-Protection, Packaging, Signed-Releases. Remaining weights renormalized.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"branch_protection",
"packaging",
"signed_releases"
]
}
},
{
"code": "weights_renormalized",
"params": {}
}
],
"value": 56,
"inputs": {
"source": "openssf_scorecard",
"checks_evaluated": 15,
"scorecard_version": "v5.5.0",
"checks_inconclusive": 3,
"scorecard_aggregate": 5.6
},
"components": [
{
"key": "binary_artifacts",
"name": "Binary-Artifacts",
"detail": "no binaries found in the repo",
"points": 7.5,
"status": "met",
"details": [],
"max_points": 7.5
},
{
"key": "branch_protection",
"name": "Branch-Protection",
"detail": "internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_data",
"params": {}
}
],
"max_points": 7.5
},
{
"key": "ci_tests",
"name": "CI-Tests",
"detail": "11 out of 27 merged PRs checked by a CI test -- score normalized to 4",
"points": 1,
"status": "partial",
"details": [],
"max_points": 2.5
},
{
"key": "cii_best_practices",
"name": "CII-Best-Practices",
"detail": "no effort to earn an OpenSSF best practices badge detected",
"points": 0,
"status": "missed",
"details": [],
"max_points": 2.5
},
{
"key": "code_review",
"name": "Code-Review",
"detail": "all changesets reviewed",
"points": 7.5,
"status": "met",
"details": [],
"max_points": 7.5
},
{
"key": "contributors",
"name": "Contributors",
"detail": "project has 5 contributing companies or organizations",
"points": 2.5,
"status": "met",
"details": [],
"max_points": 2.5
},
{
"key": "dangerous_workflow",
"name": "Dangerous-Workflow",
"detail": "no dangerous workflow patterns detected",
"points": 10,
"status": "met",
"details": [],
"max_points": 10
},
{
"key": "dependency_update_tool",
"name": "Dependency-Update-Tool",
"detail": "update tool detected",
"points": 7.5,
"status": "met",
"details": [],
"max_points": 7.5
},
{
"key": "fuzzing",
"name": "Fuzzing",
"detail": "project is not fuzzed",
"points": 0,
"status": "missed",
"details": [],
"max_points": 5
},
{
"key": "license",
"name": "License",
"detail": "license file detected",
"points": 2.5,
"status": "met",
"details": [],
"max_points": 2.5
},
{
"key": "maintained",
"name": "Maintained",
"detail": "2 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 1",
"points": 0.8,
"status": "partial",
"details": [],
"max_points": 7.5
},
{
"key": "packaging",
"name": "Packaging",
"detail": "packaging workflow not detected",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_data",
"params": {}
}
],
"max_points": 5
},
{
"key": "pinned_dependencies",
"name": "Pinned-Dependencies",
"detail": "dependency not pinned by hash detected -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 5
},
{
"key": "sast",
"name": "SAST",
"detail": "SAST tool is not run on all commits -- score normalized to 3",
"points": 1.5,
"status": "partial",
"details": [],
"max_points": 5
},
{
"key": "security_policy",
"name": "Security-Policy",
"detail": "security policy file not detected",
"points": 0,
"status": "missed",
"details": [],
"max_points": 5
},
{
"key": "signed_releases",
"name": "Signed-Releases",
"detail": "no releases found",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_data",
"params": {}
}
],
"max_points": 7.5
},
{
"key": "token_permissions",
"name": "Token-Permissions",
"detail": "detected GitHub workflow tokens with excessive permissions",
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.5
},
{
"key": "vulnerabilities",
"name": "Vulnerabilities",
"detail": "1 existing vulnerabilities detected",
"points": 6.8,
"status": "partial",
"details": [],
"max_points": 7.5
}
]
},
{
"key": "dependency_advisories",
"band": "excellent",
"name": "Dependency advisories",
"note": "Excluded from scoring (no data or not applicable): Indirect dependencies free of known advisories, No advisories left outstanding. Remaining weights renormalized. Matched 5 resolved dependencies against OSV. This repository publishes no package the index resolves, so the repository dependency graph was assessed instead. That graph mixes development and test pins with shipped dependencies, so only the declared runtime dependencies are scored; transitive findings are reported as context and excluded from the score. Reachability is not analyzed.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"indirect_dependencies_free_of_known_advisories",
"no_advisories_left_outstanding"
]
}
},
{
"code": "weights_renormalized",
"params": {}
},
{
"code": "advisories_scope_repository",
"params": {
"assessed": 5
}
},
{
"code": "advisories_repo_graph_caveat",
"params": {}
},
{
"code": "advisories_reachability",
"params": {}
}
],
"value": 100,
"inputs": {
"source": "osv",
"advisories": 3,
"affected_packages": 2,
"assessed_packages": 5,
"unassessed_packages": 0,
"affected_by_severity": "critical 1, unknown 1",
"direct_affected_packages": 0
},
"components": [
{
"key": "direct_dependencies_free_of_known_advisories",
"name": "Direct dependencies free of known advisories",
"detail": "no direct dependency carries a known advisory",
"points": 35,
"status": "met",
"details": [
{
"code": "no_direct_advisories",
"params": {}
}
],
"max_points": 35
},
{
"key": "indirect_dependencies_free_of_known_advisories",
"name": "Indirect dependencies free of known advisories",
"detail": "transitive set not separable from development and test dependencies in this scope",
"points": 0,
"status": "excluded",
"details": [
{
"code": "advisories_scope_not_separable",
"params": {}
}
],
"max_points": 25
},
{
"key": "no_advisories_left_outstanding",
"name": "No advisories left outstanding",
"detail": "no advisory carries a publication date",
"points": 0,
"status": "excluded",
"details": [
{
"code": "advisories_no_publication_date",
"params": {}
}
],
"max_points": 40
}
]
},
{
"key": "malicious_dependencies",
"band": "excellent",
"name": "Malicious dependencies",
"note": null,
"notes": [],
"value": 100,
"inputs": {
"source": "osv",
"meaning": "reported as a malicious package by the OpenSSF corpus; the remedy is removal or moving off the compromised name, never an upgrade of the same artifact. Versions the registry has since pulled are listed but not scored",
"packages": [],
"red_flag": false,
"assessed_packages": 5,
"malicious_packages": 0,
"direct_malicious_packages": 0,
"withdrawn_malicious_packages": 0,
"installable_malicious_packages": 0
},
"components": [
{
"key": "no_dependency_reported_as_a_malicious_package",
"name": "No dependency reported as a malicious package",
"detail": "no dependency is reported as a malicious package",
"points": 100,
"status": "met",
"details": [
{
"code": "no_malicious_dependencies",
"params": {}
}
],
"max_points": 100
}
]
},
{
"key": "high_risk_jurisdiction_exposure",
"band": "excellent",
"name": "High-Risk Jurisdiction Exposure",
"note": "Only high-confidence self-published location evidence affects this multiplier. Ambiguous matches are review-only; country evidence is not proof of nationality, citizenship, legal registration, malicious intent, or sanctions status.",
"notes": [
{
"code": "jurisdiction_evidence_limits",
"params": {}
}
],
"value": 100,
"inputs": {
"meaning": "self-published location evidence; not nationality or citizenship",
"red_flag": false,
"exposures": [],
"policy_countries": [
"Russia",
"Iran",
"North Korea"
],
"review_only_matches": 0,
"assessed_self_published_locations": 13
},
"components": [
{
"key": "policy_exposure_multiplier",
"name": "Policy exposure multiplier",
"detail": "no confirmed policy-scope location match",
"points": 100,
"status": "met",
"details": [
{
"code": "jurisdiction_no_match",
"params": {}
}
],
"max_points": 100
}
]
}
],
"description": "Are visible security and supply-chain practices strong, with no malicious dependency and no unresolved high-risk jurisdiction exposure?"
},
{
"key": "ai_readiness",
"band": "moderate",
"name": "AI Readiness",
"value": 62,
"weight": 0,
"metrics": [
{
"key": "ai_agent_context",
"band": "at_risk",
"name": "Agent context & guidance",
"note": null,
"notes": [],
"value": 34,
"inputs": {
"has_llms_txt": false,
"legible_history_share": 0.636,
"agent_instruction_files": [],
"agent_instruction_max_bytes": null
},
"components": [
{
"key": "agent_instructions",
"name": "Agent instructions",
"detail": "no CLAUDE.md / AGENTS.md / editor rules",
"points": 0,
"status": "missed",
"details": [
{
"code": "no_agent_instructions",
"params": {}
}
],
"max_points": 45
},
{
"key": "machine_readable_docs_llms_txt",
"name": "Machine-readable docs (llms.txt)",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 15
},
{
"key": "legible_commit_history",
"name": "Legible commit history",
"detail": "63 of 99 human commits state their intent (structured subject or explanatory body)",
"points": 33.9,
"status": "partial",
"details": [
{
"code": "legible_history",
"params": {
"legible": 63,
"sampled": 99
}
}
],
"max_points": 40
}
]
},
{
"key": "ai_verify_loop",
"band": "moderate",
"name": "Verify loop (build / test / typecheck)",
"note": null,
"notes": [],
"value": 69,
"inputs": {
"has_nix": false,
"has_tests": true,
"lockfiles": [
"go.sum"
],
"has_dockerfile": false,
"typed_language": true,
"bootstrap_files": [
"v2/Makefile",
"v2/v1compat/Makefile"
],
"has_devcontainer": false,
"has_linter_config": false,
"typecheck_configs": [],
"agent_commit_share": 0,
"toolchain_manifests": [
"v2/go.mod"
],
"dependency_bot_commit_share": 0.01
},
"components": [
{
"key": "one_command_bootstrap",
"name": "One-command bootstrap",
"detail": "v2/Makefile, v2/v1compat/Makefile",
"points": 18,
"status": "met",
"details": [
{
"code": "file_list",
"params": {
"files": "v2/Makefile, v2/v1compat/Makefile"
}
}
],
"max_points": 18
},
{
"key": "automated_tests",
"name": "Automated tests",
"detail": null,
"points": 22,
"status": "met",
"details": [],
"max_points": 22
},
{
"key": "lint_format_config",
"name": "Lint / format config",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 11
},
{
"key": "static_type_checking",
"name": "Static type checking",
"detail": "Go (statically typed)",
"points": 11,
"status": "met",
"details": [
{
"code": "statically_typed_language",
"params": {
"language": "Go"
}
}
],
"max_points": 11
},
{
"key": "reproducible_environment",
"name": "Reproducible environment",
"detail": "lockfile",
"points": 10,
"status": "met",
"details": [
{
"code": "file_list",
"params": {
"files": "lockfile"
}
}
],
"max_points": 10
},
{
"key": "demonstrated_agent_practice",
"name": "Demonstrated agent practice",
"detail": "no agent-authored commits among the last 100",
"points": 0,
"status": "missed",
"details": [
{
"code": "no_agent_authored_commits",
"params": {
"sampled": 100
}
}
],
"max_points": 10
},
{
"key": "automated_maintenance",
"name": "Automated maintenance",
"detail": "1 of the last 100 commits are automated dependency updates",
"points": 8,
"status": "met",
"details": [
{
"code": "dependency_bot_commits",
"params": {
"count": 1,
"sampled": 100
}
}
],
"max_points": 8
},
{
"key": "openssf_scorecard_pinned_dependencies",
"name": "OpenSSF Scorecard: Pinned-Dependencies",
"detail": "dependency not pinned by hash detected -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 10
}
]
},
{
"key": "ai_code_legibility",
"band": "excellent",
"name": "Code legibility for models",
"note": null,
"notes": [],
"value": 100,
"inputs": {
"primary_language": "Go",
"largest_source_bytes": 31695,
"source_files_sampled": 66,
"oversized_source_files": 0
},
"components": [
{
"key": "type_checkable_code",
"name": "Type-checkable code",
"detail": "Go (statically typed)",
"points": 45,
"status": "met",
"details": [
{
"code": "statically_typed_language",
"params": {
"language": "Go"
}
}
],
"max_points": 45
},
{
"key": "manageable_file_sizes",
"name": "Manageable file sizes",
"detail": "0/66 source files over 60KB",
"points": 55,
"status": "met",
"details": [
{
"code": "oversized_source_files",
"params": {
"kb": 60,
"sampled": 66,
"oversized": 0
}
}
],
"max_points": 55
}
]
}
],
"description": "How well is the repo equipped to be developed and maintained with AI coding agents? An independent, experimental badge — weight 0.0, so it is surfaced on its own and does not affect the overall health score."
}
],
"metrics_version": "1.13.0"
},
"warnings": [],
"report_type": "repository",
"generated_at": "2026-07-22T07:18:40.889999Z",
"schema_version": "0.26.0",
"badge_url": "https://raw.githubusercontent.com/inspect-software/badges/main/v1/n/nats-io/jwt.svg",
"full_name": "nats-io/jwt",
"license_state": "standard",
"license_spdx": "Apache-2.0"
}
Verwandte Einträge
Geprüfte Repositories, die Katalog-Tags oder Ökosysteme mit nats-io/jwt teilen. Nebeneinander lesen →
Bewertungen sind Signale, keine Garantien. Sie spiegeln öffentlich sichtbare Praxis auf GitHub wider — kein Code-Audit und keine Sicherheitsgarantie.
Fehlende Daten werden ausgeschlossen und die Gewichte neu normiert, nie als null bewertet. Die Methodik ist versioniert und offen: Metriken v1.13.0, Schema v0.26.0 — vollständige Methodik · Metriken-Wiki.
