JWT tokens signed using NKeys for Ed25519 for the NATS ecosystem.
GoApache-2.0★ 88 estrellas⑂ 37 forksdesde ago 2018Ver en GitHub ↗
nats-io/jwt tiene un índice de salud de 61 sobre 100, lo que lo sitúa en la banda Moderado. Su puntuación más alta es Sustainability & Governance (78/100) y la más baja, Community & Adoption (48/100). Se actualizó por última vez hace 49 días. 2 personas concentran la mayor parte del trabajo reciente.
61
global / 100
Moderado
Índice de salud del software
Las métricas se agrupan en categorías ponderadas sobre una escala de 1 a 100. El resultado global parte de su media; cuando la evidencia pública activa la Política de Jurisdicciones de Alto Riesgo, la calificación se ajusta y recibe el límite 49 (En riesgo). Preparación para IA queda fuera.
61
Excelente85-100Ejemplar; cumple prácticamente todos los criterios evaluados
Bueno70-84Saludable; carencias menores
Moderado50-69Aceptable con carencias notables; se recomienda revisión
En riesgo30-49Debilidades significativas; su adopción exige cautela
Crítico1-29Problemas graves (proyecto abandonado, un solo mantenedor, sin higiene)
Perfil de puntuación
Cada eje es una categoría. La forma importa más que la media: un proyecto sano llena toda la figura, mientras que un perfil de picos y cráteres indica que la fortaleza en una dimensión enmascara el riesgo en otra.
Dependencias directas libres de avisos conocidos — ninguna dependencia directa tiene un aviso conocido
0/25
Dependencias indirectas libres de avisos conocidos — el conjunto transitivo no es separable de las dependencias de desarrollo y prueba en este alcance
0/40
Sin avisos pendientes — ningún aviso tiene fecha de publicación
Datos de entrada utilizados
source
osv
advisories
3
affected_packages
2
assessed_packages
5
unassessed_packages
0
affected_by_severity
critical 1, unknown 1
direct_affected_packages
0
Excluidos de la puntuación (sin datos o no aplicable): Dependencias indirectas libres de avisos conocidos, Sin avisos pendientes. Los pesos restantes se han renormalizado. Se cotejaron 5 dependencias resueltas con OSV. Este repositorio no publica ningún paquete que el índice resuelva, por lo que se evaluó en su lugar el grafo de dependencias del repositorio. Ese grafo mezcla fijaciones de desarrollo y prueba con las dependencias distribuidas, de modo que solo se puntúan las dependencias declaradas en tiempo de ejecución; los hallazgos transitivos se informan como contexto y quedan excluidos de la puntuación. No se analiza la alcanzabilidad.
¿Hasta qué punto está el repositorio preparado para desarrollarse y mantenerse con agentes de codificación de IA? Es una insignia independiente y experimental — peso 0,0, de modo que se presenta por separado y no afecta a la puntuación de salud global.
Código verificable por tipos — Go (tipado estático)
55/55
Tamaños de archivo manejables — 0/66 archivos fuente de más de 60 KB
Datos de entrada utilizados
primary_language
Go
largest_source_bytes
31.695
source_files_sampled
66
oversized_source_files
0
Datos clave
88estrellas de GitHub
16contribuidores
11commits en los últimos 12 meses
49días desde el último push
46versiones publicadas
2factor bus
13issues abiertas
Goecosistemas de paquetes
Más detalle
Historial de estrellas y forks 88 ★ / 37 ⇿
88Estrellas
37Forks
46Versiones
Cuándo se añadió cada estrella y fork, recopilado de GitHub y agrupado por día. El crecimiento acumulado se sitúa justo encima de las adiciones diarias que lo componen, de modo que ambos se leen en conjunto: la acumulación orgánica sostenida no se parece en nada a un pico abrupto y efímero. Cuando esa diferencia es medible, se informa como autenticidad del crecimiento.
Mayor 1Menor 13Parche 32
Cada punto abarca 8 días.
OpenSSF Scorecard 5.6 / 10
5.6agregado
Evaluación de seguridad independiente y agnóstica en cuanto a herramientas, procedente del proyecto de código abierto OpenSSF Scorecard. Cada comprobación premia una práctica de seguridad, no la herramienta de un proveedor concreto. Las comprobaciones que Scorecard no pudo determinar se marcan como n/d y se excluyen de la puntuación de seguridad (nunca se cuentan como cero).Scorecard v5.5.0 · 2026-07-22 07:18 UTC
Conjunto completo de dependencias resueltas según el grafo de dependencias de GitHub: 2 paquetes directos y 3 indirectos (transitivos). El cierre transitivo es completo cuando el repositorio incluye un lockfile.
Registro
Paquete
Versión
Relación
Go
github.com/nats-io/nkeys
0.3.0
directa
Go
github.com/nats-io/nkeys
v0.4.16
directa
Go
github.com/nats-io/jwt
1.2.2
indirecta
Go
golang.org/x/crypto
v0.52.0
indirecta
Go
golang.org/x/sys
v0.45.0
indirecta
Avisos de dependencias 2
Este repositorio no publica ningún paquete que el índice resuelva, así que se evaluó su propio grafo de dependencias — 5 paquetes, que incluyen también fijaciones de desarrollo y prueba que nunca se distribuyen: 2 tienen avisos conocidos, de los cuales 0 son directas.
Paquete
Versión
Relación
Gravedad
Avisos
Corregido en
github.com/nats-io/jwt
1.2.2
indirecta
crítica
2
2.0.1
golang.org/x/crypto
v0.52.0
indirecta
desconocida
1
—
Un aviso significa que la versión registrada en el grafo de dependencias cae dentro del rango afectado de un aviso. No se analiza la alcanzabilidad, y el grafo incluye fijaciones de desarrollo y prueba: un hallazgo puede referirse al utillaje y no al software distribuido.
Informe JSON sin procesar legible por máquina
{
"data": {
"repo": {
"topics": [],
"is_fork": false,
"size_kb": 608,
"has_wiki": true,
"homepage": null,
"languages": {
"Go": 448290,
"Shell": 977,
"Makefile": 491
},
"pushed_at": "2026-06-02T13:54:22Z",
"created_at": "2018-08-22T16:25:50Z",
"owner_type": "Organization",
"updated_at": "2026-06-07T18:00:56Z",
"description": "JWT tokens signed using NKeys for Ed25519 for the NATS ecosystem.",
"is_archived": false,
"is_disabled": false,
"license_spdx": "Apache-2.0",
"default_branch": "main",
"license_spdx_raw": "Apache-2.0",
"primary_language": "Go",
"significant_languages": [
"Go"
]
},
"owner": {
"blog": "https://nats.io",
"name": "NATS - The Edge & Cloud Native Messaging System",
"type": "Organization",
"login": "nats-io",
"company": null,
"location": null,
"followers": 2424,
"avatar_url": "https://avatars.githubusercontent.com/u/10203055?v=4",
"created_at": "2014-12-16T02:38:52Z",
"is_verified": null,
"public_repos": 131,
"account_age_days": 4236
},
"license": {
"state": "standard",
"spdx_id": "Apache-2.0",
"raw_spdx": "Apache-2.0",
"file_present": true,
"scorecard_found": true,
"profile_has_license": true
},
"activity": {
"releases": [
{
"tag": "v2.8.2",
"kind": "patch",
"published_at": "2026-06-02T13:54:22Z"
},
{
"tag": "v2.8.1",
"kind": "patch",
"published_at": "2026-03-17T13:04:32Z"
},
{
"tag": "v2.8.0",
"kind": "minor",
"published_at": "2025-08-08T14:19:25Z"
},
{
"tag": "v2.7.4",
"kind": "patch",
"published_at": "2025-04-16T14:31:01Z"
},
{
"tag": "v2.7.3",
"kind": "patch",
"published_at": "2024-12-13T16:49:52Z"
},
{
"tag": "v2.7.2",
"kind": "patch",
"published_at": "2024-10-09T20:01:27Z"
},
{
"tag": "v2.7.1",
"kind": "patch",
"published_at": "2024-10-09T19:37:43Z"
},
{
"tag": "v2.7.0",
"kind": "minor",
"published_at": "2024-09-17T17:05:09Z"
},
{
"tag": "v2.6.0",
"kind": "minor",
"published_at": "2024-09-10T23:13:08Z"
},
{
"tag": "v2.5.8",
"kind": "patch",
"published_at": "2024-07-05T14:34:37Z"
},
{
"tag": "v2.5.7",
"kind": "patch",
"published_at": "2024-05-09T16:09:54Z"
},
{
"tag": "v2.5.6",
"kind": "patch",
"published_at": "2024-04-18T15:14:55Z"
},
{
"tag": "v2.5.5",
"kind": "patch",
"published_at": "2024-02-22T16:58:21Z"
},
{
"tag": "v2.5.4",
"kind": "patch",
"published_at": "2024-02-15T17:09:38Z"
},
{
"tag": "v2.5.3",
"kind": "patch",
"published_at": "2023-10-31T16:16:39Z"
},
{
"tag": "v2.5.2",
"kind": "patch",
"published_at": "2023-09-18T15:55:58Z"
},
{
"tag": "v2.5.1",
"kind": "patch",
"published_at": "2023-09-18T15:44:06Z"
},
{
"tag": "v2.5.0",
"kind": "minor",
"published_at": "2023-08-21T16:32:42Z"
},
{
"tag": "v2.4.1",
"kind": "patch",
"published_at": "2023-03-24T16:04:04Z"
},
{
"tag": "v2.4.0",
"kind": "minor",
"published_at": "2023-03-21T15:31:28Z"
},
{
"tag": "v2.3.0",
"kind": "minor",
"published_at": "2022-06-28T20:52:42Z"
},
{
"tag": "v2.2.0",
"kind": "minor",
"published_at": "2021-11-15T18:05:31Z"
},
{
"tag": "v2.1.0",
"kind": "minor",
"published_at": "2021-09-28T20:09:40Z"
},
{
"tag": "v2.0.3",
"kind": "patch",
"published_at": "2021-08-02T15:43:13Z"
},
{
"tag": "v2.0.2",
"kind": "patch",
"published_at": "2021-05-04T16:10:13Z"
},
{
"tag": "v2.0.1",
"kind": "patch",
"published_at": "2021-03-14T23:13:04Z"
},
{
"tag": "v2.0.0",
"kind": "major",
"published_at": "2021-03-14T19:53:51Z"
},
{
"tag": "v1.2.2",
"kind": "patch",
"published_at": "2020-11-30T16:49:20Z"
},
{
"tag": "v1.2.0",
"kind": "minor",
"published_at": "2020-10-30T23:40:28Z"
},
{
"tag": "v1.1.0",
"kind": "minor",
"published_at": "2020-10-21T15:51:26Z"
},
{
"tag": "v1.0.1",
"kind": "patch",
"published_at": "2020-05-29T19:52:32Z"
},
{
"tag": "v0.3.2",
"kind": "patch",
"published_at": "2019-11-14T21:48:39Z"
},
{
"tag": "v0.3.0",
"kind": "minor",
"published_at": "2019-09-20T17:04:31Z"
},
{
"tag": "v0.2.16",
"kind": "patch",
"published_at": "2019-09-18T15:07:30Z"
},
{
"tag": "v0.2.14",
"kind": "patch",
"published_at": "2019-08-14T16:24:45Z"
},
{
"tag": "v0.2.12",
"kind": "patch",
"published_at": "2019-07-24T20:08:40Z"
},
{
"tag": "v0.2.10",
"kind": "patch",
"published_at": "2019-07-16T13:10:53Z"
},
{
"tag": "v0.2.8",
"kind": "patch",
"published_at": "2019-06-21T16:36:23Z"
},
{
"tag": "v0.2.6",
"kind": "patch",
"published_at": "2019-05-22T14:19:08Z"
},
{
"tag": "v0.2.4",
"kind": "patch",
"published_at": "2019-04-18T17:58:28Z"
},
{
"tag": "v0.2.2",
"kind": "patch",
"published_at": "2019-04-11T23:37:05Z"
},
{
"tag": "v0.2.0",
"kind": "minor",
"published_at": "2019-04-11T20:49:26Z"
},
{
"tag": "v0.1.0",
"kind": "minor",
"published_at": "2019-04-09T23:41:13Z"
},
{
"tag": "v0.0.8",
"kind": "patch",
"published_at": "2018-12-13T04:28:38Z"
},
{
"tag": "v0.0.6",
"kind": "patch",
"published_at": "2018-12-08T02:04:24Z"
},
{
"tag": "v0.0.4",
"kind": "patch",
"published_at": "2018-12-04T18:47:52Z"
}
],
"recent_commits": [
{
"oid": "82017236da50e4a0173091105d82d46228b8dccf",
"body": null,
"is_bot": false,
"headline": "bumps (#251)",
"author_name": "Alberto Ricart",
"author_login": "aricart",
"committed_at": "2026-06-02T13:53:38Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "071a1dedb58e3da316084d650859d5cf6c00aaf2",
"body": "The nats-server will (only) enable JetStream on an account if `DiskStorage` and/or `MemoryStorage` is set to a non-zero value in the Account JWT Limits. This is due to legacy reasons and cannot be easily changed due to the global impact of already existing NATS clusters based on decentralized auth.\n\nIssue: https://github.com/nats-io/jwt/issues/249",
"is_bot": false,
"headline": "docs: how to enable/disable JetStream when creating AccountClaims (#250)",
"author_name": "Thobias Karlsson",
"author_login": "choufraise",
"committed_at": "2026-06-02T13:25:44Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "1e990c9a58a81981aca6da7efdc7c5b79314fea9",
"body": "* fix: added a check for the size of JWT token\n\nNote that now all JWTs are limited to 1MB - which may or not be breaking. Note that Generic JWTs could possibly have whatever size they want (this change doesn't affect GenericClaims)\n\nSigned-off-by: Alberto Ricart <alberto@synadia.com>",
"is_bot": false,
"headline": "fix: added a check for the size of JWT token (#248)",
"author_name": "Alberto Ricart",
"author_login": "aricart",
"committed_at": "2026-03-12T16:26:27Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "e6531afcdfe87a6d964693e59b1557bf3d32dfe4",
"body": "Signed-off-by: Alberto Ricart <alberto@synadia.com>",
"is_bot": false,
"headline": "fix: ensure that weighted mappings don't exceed 100 (#247)",
"author_name": "Alberto Ricart",
"author_login": "aricart",
"committed_at": "2026-03-11T19:13:06Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "4cbb6cce481caba30d91a020bc25be99f1d8a791",
"body": "This API is used by external tools to decorate seeds, in cases where they specify a bad input return an error\n\nSigned-off-by: Alberto Ricart <alberto@synadia.com>",
"is_bot": false,
"headline": "fix: make DecorateSeed more resilient in case of short input (#245)",
"author_name": "Alberto Ricart",
"author_login": "aricart",
"committed_at": "2026-03-11T16:36:41Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "4ee18c85bc5ed09dc41fb03b045f077bc3cdce93",
"body": "Signed-off-by: Alberto Ricart <alberto@synadia.com>",
"is_bot": false,
"headline": "ci: enable claude (#246)",
"author_name": "Alberto Ricart",
"author_login": "aricart",
"committed_at": "2026-03-11T16:12:49Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "169803d1a50f8a02e09aadf72195af3c5d716a80",
"body": "* bump dependencies, streamline test matrix\n\n* Go 1.24 vet flagged printf-style functions that passed non-constant strings as the format string\n\nSigned-off-by: Alberto Ricart <alberto@synadia.com>\n\n---------\n\nSigned-off-by: Alberto Ricart <alberto@synadia.com>",
"is_bot": false,
"headline": "bump dependencies, streamline test matrix (#244)",
"author_name": "Alberto Ricart",
"author_login": "aricart",
"committed_at": "2026-03-03T14:59:26Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "a3aa1012e08c00d189405a9313f75bed8ed84f8a",
"body": "…or the JWT provided. (#242)\n\nSigned-off-by: Alberto Ricart <alberto@synadia.com>",
"is_bot": false,
"headline": "added a check when generating creds that the specified key is valid f…",
"author_name": "Alberto Ricart",
"author_login": "aricart",
"committed_at": "2026-03-03T14:59:05Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "e4173126b32a711fcf1595d122a302ee22ff8d43",
"body": "nats-server already allows importing the same (service) subject from different account, while the jwt does not. This becomes an issue when you, for instance, source JetStreams from different accounts and need to import service `$JS.FC.>` from both. Before, this could be solved by importing e.g. `$JS\n[…]\ns-server/pull/6704\nRelated: https://github.com/nats-io/nats-server/issues/6547\nRelated: https://github.com/nats-io/nats-server/issues/6431\n\nSigned-off-by: Thobias Karlsson <thobias.karlsson@gmail.com>",
"is_bot": false,
"headline": "fix: allow import of same service subject from different accounts (#243)",
"author_name": "Thobias Karlsson",
"author_login": "choufraise",
"committed_at": "2026-02-27T22:00:12Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "a2c583b4f3719b35832df7b802db6efe1c6f066e",
"body": "Signed-off-by: Alberto Ricart <alberto@synadia.com>",
"is_bot": false,
"headline": "update build status badge to use GitHub Actions (#240)",
"author_name": "Alberto Ricart",
"author_login": "aricart",
"committed_at": "2025-08-08T14:18:41Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "953e18bb32057b7d5a08fc1a966915a9e76c9bea",
"body": "This would be used in the server to enforce that a user connects\nthrough a trusted proxy.\n\nSigned-off-by: Ivan Kozlovic <ivan@synadia.com>",
"is_bot": false,
"headline": "[ADDED] `ProxyRequired` user claims property (#239)",
"author_name": "Ivan Kozlovic",
"author_login": "kozlovic",
"committed_at": "2025-08-08T14:03:00Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "28e31bd445aeebe6a0bb93902baf91e43036c22c",
"body": "Signed-off-by: Alberto Ricart <alberto@synadia.com>",
"is_bot": false,
"headline": "bump golang.org/x/crypto fixing vulnerability (#238)",
"author_name": "Alberto Ricart",
"author_login": "aricart",
"committed_at": "2025-04-16T14:29:44Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "13f7264e0ea0eb7307d50ce4c117a4ece4f99959",
"body": "[ci skip]",
"is_bot": false,
"headline": "fix the link to go doc to go to v2 (#237)",
"author_name": "Alberto Ricart",
"author_login": "aricart",
"committed_at": "2024-12-19T17:10:44Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "a768c381b3ed3c634bfa6738ba34a4652456986d",
"body": "Upgraded `github.com/nats-io/nkeys` to v0.4.9, `golang.org/x/crypto` to v0.31.0, and `golang.org/x/sys` to v0.28.0. These updates ensure compatibility with the latest changes and include potential bug fixes and improvements. No functional changes were introduced in the codebase.\r\n\r\nSigned-off-by: Alberto Ricart <alberto@synadia.com>",
"is_bot": false,
"headline": "Update dependencies in go.mod and go.sum (#236)",
"author_name": "Alberto Ricart",
"author_login": "aricart",
"committed_at": "2024-12-13T16:48:25Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "698cd7e2aafd4e8fedefbdd5879dcade64c855eb",
"body": "* feat: Claims interface now has `EncodeWithSigner(nkeys.KeyPair`, fn: SignFn)` where signing can be delegated to a function. The `type SignFn func(pub string, data []byte) ([]byte, error)` is provided with the public key whose matching private key should be used to sign the provided payload.\r\n\r\nTh\n[…]\ning a JWT.\r\n\r\nSigned-off-by: Alberto Ricart <alberto@synadia.com>\r\n\r\n* go mod\r\n\r\nSigned-off-by: Alberto Ricart <alberto@synadia.com>\r\n\r\n---------\r\n\r\nSigned-off-by: Alberto Ricart <alberto@synadia.com>",
"is_bot": false,
"headline": "Allow external signing of JWTs (#234)",
"author_name": "Alberto Ricart",
"author_login": "aricart",
"committed_at": "2024-12-13T16:42:21Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "f9c7776a413358752942d078361ee8d13f15e2f4",
"body": "* Revert \"[CHANGE] Tags are now case-sensitive (#225)\"\r\n\r\nThis reverts commit de1f16b5781c771513bdc8de201e86bfa76f0325.\r\n\r\n* retract 2.7.0\r\n\r\nSigned-off-by: Alberto Ricart <alberto@synadia.com>\r\n\r\n---------\r\n\r\nSigned-off-by: Alberto Ricart <alberto@synadia.com>",
"is_bot": false,
"headline": "Retract case-insensitive tag functionality (#233)",
"author_name": "Alberto Ricart",
"author_login": "aricart",
"committed_at": "2024-10-09T19:35:56Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "18a60d6f7f84c2774c29cb926fe421df2deb5bc0",
"body": null,
"is_bot": false,
"headline": "[CHANGE] removing a tag that doesn't exist results in an error (#228)",
"author_name": "Alberto Ricart",
"author_login": "aricart",
"committed_at": "2024-09-17T15:32:41Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "de1f16b5781c771513bdc8de201e86bfa76f0325",
"body": "* [CHANGE] Tags (--tag and --rm-tag) are now case-sensitive. Previous versions of the library lowercased all tags. Now tags such as \"A\" and \"a\" are different.",
"is_bot": false,
"headline": "[CHANGE] Tags are now case-sensitive (#225)",
"author_name": "Alberto Ricart",
"author_login": "aricart",
"committed_at": "2024-09-17T14:09:22Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "2d9ece2f3a7a987c745e4f6d7d6ba02a74756577",
"body": "…ll need to perform some level of validation (#224)\n\n* Added validation to cluster traffic - as downstream tools like nsc will need to perform some level of validation\r\n* removed parsing of account for cluster traffic as that option will be delayed.",
"is_bot": false,
"headline": "Added validation to cluster traffic - as downstream tools like nsc wi…",
"author_name": "Alberto Ricart",
"author_login": "aricart",
"committed_at": "2024-09-13T16:28:03Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "4445fcd6be061ef9a37e02fdf5988bd80adb7d21",
"body": null,
"is_bot": false,
"headline": "Merge pull request #223 from nats-io/neil/accountnrg",
"author_name": "Neil",
"author_login": "neilalexander",
"committed_at": "2024-09-10T22:17:29Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "1378f5922cddb43d7776da60f100520aee0a6c59",
"body": "Signed-off-by: Neil Twigg <neil@nats.io>",
"is_bot": false,
"headline": "Fix lint errors, probably from new staticcheck version",
"author_name": "Neil Twigg",
"author_login": "neilalexander",
"committed_at": "2024-09-10T21:37:40Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "2e1251e5109465388c40eef4d5224c42edd03d11",
"body": "Signed-off-by: Neil Twigg <neil@nats.io>",
"is_bot": false,
"headline": "Update CI to use latest stable Go version",
"author_name": "Neil Twigg",
"author_login": "neilalexander",
"committed_at": "2024-09-10T09:32:32Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "bc9fb5fb3c2f2775b5398a43d401dc13a5668866",
"body": "For supporting nats-io/nats-server#5466.\n\nFor now expected values would be:\n* `\"system\"` - use the system account (default, as today)\n* `\"owner\"` - use the same account that owns the asset\n* `\"account:ACCNAME\"` - use a third specified `ACCNAME`\n\nSigned-off-by: Neil Twigg <neil@nats.io>",
"is_bot": false,
"headline": "Add `ClusterTraffic` to account claims",
"author_name": "Neil Twigg",
"author_login": "neilalexander",
"committed_at": "2024-09-10T09:25:22Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "ff68a3bc6bb70f166b35232159cc9c96aaca4375",
"body": "…222)\n\nFixes https://github.com/nats-io/nsc/issues/657",
"is_bot": false,
"headline": "[FIX] accounting for weights in cluster should be handled separate (#…",
"author_name": "Alberto Ricart",
"author_login": "aricart",
"committed_at": "2024-07-05T14:31:12Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "41dad79143e9cff55e4bde8af4df7a40ad49786c",
"body": "Added `ConnectionTypeInProcess` to the `UserPermissionLimits.AllowedConnectionTypes`\r\nlist of possible types.\r\n\r\nSigned-off-by: Ivan Kozlovic <ivan@synadia.com>",
"is_bot": false,
"headline": "[ADDED] Connection type \"in process\" (#221)",
"author_name": "Ivan Kozlovic",
"author_login": "kozlovic",
"committed_at": "2024-05-09T16:08:51Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "1f3ff3245e5ebd478f98bd584ad1636430246c95",
"body": "…tween same name roles (#220)",
"is_bot": false,
"headline": "[FEAT] added a description to a scope role to enable tools discern be…",
"author_name": "Alberto Ricart",
"author_login": "aricart",
"committed_at": "2024-04-18T15:09:38Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "c2d30e2ffc632a1ea64030467e5a40e02e4158be",
"body": "When an account has a `Trace` field set with a `Destination`, if\r\nan incoming message has a `traceparent` header with proper flag\r\nindicating that the message should be trace, the `Sampling` integer\r\n(value in the range of [1..100]) allows tracing only a random\r\nsample of messages. The server will p\n[…]\nm number below 100\r\nand if that number is lower or equal to this `Sampling` value\r\nthen the trace will trigger. If above, the trace will not trigger.\r\n\r\nSigned-off-by: Ivan Kozlovic <ivan@synadia.com>",
"is_bot": false,
"headline": "[ADDED] Sampling in MsgTrace structure (#219)",
"author_name": "Ivan Kozlovic",
"author_login": "kozlovic",
"committed_at": "2024-02-22T16:57:27Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "38e07c55c548c54df98b709eef943fb1cffc28b1",
"body": "Signed-off-by: Caleb Lloyd <caleb@synadia.com>",
"is_bot": false,
"headline": "add omitempty to authorization.auth_users (#218)",
"author_name": "Caleb Lloyd",
"author_login": "caleblloyd",
"committed_at": "2024-02-16T21:07:39Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "069ee3e448b5443e77f7906d391bf7761e662dcb",
"body": null,
"is_bot": false,
"headline": "[UPDATE] update deps (#217)",
"author_name": "Alberto Ricart",
"author_login": "aricart",
"committed_at": "2024-02-15T17:08:56Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "ed3fbfa49a16cf4aced84aed9d527be532730ad4",
"body": "This is needed for the NATS Server distributed message tracing\r\nfeature.\r\n\r\nThis PR updates validation of a Subject to check for `.` at the\r\nfirst or last position and consecutive ones.\r\n\r\nThe validation of the Account.TraceDest also checks that the\r\ndestination does not have wildcards since this is\n[…]\nf-by: Ivan Kozlovic <ivan@synadia.com>\r\n\r\n* Added container for message trace options\r\n\r\nSigned-off-by: Ivan Kozlovic <ivan@synadia.com>\r\n\r\n---------\r\n\r\nSigned-off-by: Ivan Kozlovic <ivan@synadia.com>",
"is_bot": false,
"headline": "[ADDED] Import/Export.AllowTrace and Account.TraceDest (#216)",
"author_name": "Ivan Kozlovic",
"author_login": "kozlovic",
"committed_at": "2024-02-15T16:56:43Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "f923b10c0be0c8d24fdab7208733504c4887def5",
"body": "Bumps [golang.org/x/crypto](https://github.com/golang/crypto) from 0.14.0 to 0.17.0.\r\n- [Commits](https://github.com/golang/crypto/compare/v0.14.0...v0.17.0)\r\n\r\n---\r\nupdated-dependencies:\r\n- dependency-name: golang.org/x/crypto\r\n dependency-type: indirect\r\n...\r\n\r\nSigned-off-by: dependabot[bot] <support@github.com>\r\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
"is_bot": true,
"headline": "Bump golang.org/x/crypto from 0.14.0 to 0.17.0 in /v2 (#214)",
"author_name": "dependabot[bot]",
"author_login": "dependabot[bot]",
"committed_at": "2023-12-20T10:48:56Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "457367366f2ff72a3fefeed38b56a1da281476fb",
"body": null,
"is_bot": false,
"headline": "[BUMP] bump nkeys (#212)",
"author_name": "Alberto Ricart",
"author_login": "aricart",
"committed_at": "2023-10-31T16:15:48Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "012e7a3a42dce49e62a7f14662461ecf14a8d5fc",
"body": "…operations (#209)",
"is_bot": false,
"headline": "[FEAT] relax protocol names to allow for ws/wss for account resolver …",
"author_name": "Alberto Ricart",
"author_login": "aricart",
"committed_at": "2023-10-24T22:36:25Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "4b4f5502a8b3acb9fe78ecc86814dd3ec2c20a90",
"body": "… (#208)\n\nFix #200",
"is_bot": false,
"headline": "[FEAT] added convenience API GetTags() to Account/Operator/UserClaims…",
"author_name": "Alberto Ricart",
"author_login": "aricart",
"committed_at": "2023-09-18T15:52:19Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "a3a24780d2f287e5149de20aa40158045afbe868",
"body": "The discussions tab needs to be enabled.",
"is_bot": false,
"headline": "Fix issue config discussions link (#205)",
"author_name": "Byron Ruth",
"author_login": "bruth",
"committed_at": "2023-08-21T20:38:34Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "75d6d8701e5ca225078e10cf93e2e3ff98d5ecad",
"body": "Signed-off-by: Byron Ruth <byron@nats.io>",
"is_bot": false,
"headline": "Add issue forms (#204)",
"author_name": "Byron Ruth",
"author_login": "bruth",
"committed_at": "2023-08-21T20:26:01Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "44fe206dcc2696bfe1d1d53ac8da553caeaf26a0",
"body": null,
"is_bot": false,
"headline": "sort signing keys on marshal (#203)",
"author_name": "Seth Back",
"author_login": "sethjback",
"committed_at": "2023-08-21T20:24:27Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "c4f1fd0ca5889c20ba2ae5cca0e88d1cf964f60c",
"body": "…r setup that actually runs on a server (#198)",
"is_bot": false,
"headline": "[DOC] changed the main example to show a basic operator->account->use…",
"author_name": "Alberto Ricart",
"author_login": "aricart",
"committed_at": "2023-08-21T16:28:50Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "78a1bd080817e10534d03583c3e0c2569e42073e",
"body": "remove wildcard validation from mappings",
"is_bot": false,
"headline": "Merge pull request #202 from haisum/main",
"author_name": "Haisum Mussawir",
"author_login": null,
"committed_at": "2023-08-21T16:28:36Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "96b5387a7afcb092eeac24126f781fa628af2383",
"body": "Signed-off-by: haisum <haisum@synadia.com>",
"is_bot": false,
"headline": "remove wildcard validation from mappings",
"author_name": "haisum",
"author_login": null,
"committed_at": "2023-08-18T19:54:37Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "535a7674fb6149ba5d35297b3125b337ee281e13",
"body": "* [FEAT] allow callout service to generate users for any account, added constant `AnyAccount` for wildcard",
"is_bot": false,
"headline": "[FEAT] allow callout service to generate users for any account (#197)",
"author_name": "Alberto Ricart",
"author_login": "aricart",
"committed_at": "2023-03-24T16:02:18Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "11e1fdb1415310764b7678bc31a6e63c53e99edd",
"body": null,
"is_bot": false,
"headline": "Bump version for imminent release: 2.4.0",
"author_name": "Phil Pennock",
"author_login": "philpennock",
"committed_at": "2023-03-16T21:45:09Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "7018e50b6fccc7bda45d4bc692a1873f33afa879",
"body": "simplify AuthorizationResponse",
"is_bot": false,
"headline": "Merge pull request #189 from nats-io/simplify-response",
"author_name": "Waldemar Quevedo",
"author_login": "wallyqs",
"committed_at": "2023-03-16T21:41:56Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "7b33986cffa3bd7df2277d853249c385edf9315f",
"body": "- [FIX] fixed the DidSign for account claims to return true only if the signing key and the issuer account constraints met - this api is only used by nsc\n- [TEST] fixed test that used improper user JWT\n- [TEST] fixed tests that expected failure, but were out of order with a following test that now triggers the error\n\nrequired authorization claims subject to be the user public key from the request\nrequired audience in the authorization claim subject to be the public server key from the request",
"is_bot": false,
"headline": "added additional scrutiny to DidSign in the case of signing keys (#190)",
"author_name": "aricart",
"author_login": "aricart",
"committed_at": "2023-03-16T21:32:39Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "e3e39d66ad1c45611b8b058a0170b765f788d692",
"body": "Move all the top-level go code into v2/v1compat and explicitly refer to that,\r\nand with all other go.??? files removed, so that from the go module handling\r\nperspective, this is all in one Go module. This will prevent v1 code\r\nreferences from going out to Go modules and fetching old vulnerable code\n[…]\nvisible to tests in other software, such as nats-io/nats-account-server too.\r\n\r\nThis PR changes modules, imports, and CI test invocations, but makes no changes\r\nto the Go functionality of the library.",
"is_bot": false,
"headline": "overhaul jwt v2 and v1 inter-tangling (#195)",
"author_name": "Phil Pennock",
"author_login": "philpennock",
"committed_at": "2023-03-16T21:28:27Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "8d1c62fe17b1306a3fe18118b810fe45736e9d9e",
"body": "- [FIX] fixed the DidSign for account claims to return true only if the signing key and the issuer account constraints met - this api is only used by nsc\r\n- [TEST] fixed test that used improper user JWT\r\n- [TEST] fixed tests that expected failure, but were out of order with a following test that now triggers the error",
"is_bot": false,
"headline": "added additional scrutiny to DidSign in the case of signing keys (#190)",
"author_name": "Alberto Ricart",
"author_login": "aricart",
"committed_at": "2023-02-15T18:58:59Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "f135d4a5a6f99ff2705b7f1a8aca2949da33f2bb",
"body": "* [CI] github actions",
"is_bot": false,
"headline": "[chore] migrate ci to gha (#191)",
"author_name": "Alberto Ricart",
"author_login": "aricart",
"committed_at": "2023-02-15T18:49:09Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "bdf40fa3627bc5cd1f378bb94ba8ab26768a9c70",
"body": "Authorization Response and Server ID additions",
"is_bot": false,
"headline": "Merge pull request #186 from nats-io/auth-updates",
"author_name": "Derek Collison",
"author_login": "derekcollison",
"committed_at": "2022-12-27T17:05:42Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "146945d1bedc8ec8d8cda0cee8b20d2960174583",
"body": "…to a NATS server.\n\nAlso added in version, cluster and tags to the server info for an authorization request.\n\nSigned-off-by: Derek Collison <derek@nats.io>",
"is_bot": false,
"headline": "Added in a formal authorization response for propagating errors back …",
"author_name": "Derek Collison",
"author_login": "derekcollison",
"committed_at": "2022-12-26T22:45:25Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "ff7baa9e5e73489e49a6cf6062d26fc0ef0e11d9",
"body": "Force authorization requests to have a public user nkey.",
"is_bot": false,
"headline": "Merge pull request #185 from nats-io/user-nkey",
"author_name": "Derek Collison",
"author_login": "derekcollison",
"committed_at": "2022-12-14T23:34:35Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "1ddeceefd4542ce8909642ac83b71b751b329bc5",
"body": "This will be required for the user claim sent back from the authorization service to avoid replay attacks.\n\nSigned-off-by: Derek Collison <derek@nats.io>",
"is_bot": false,
"headline": "Force authorization requests to have a public user nkey.",
"author_name": "Derek Collison",
"author_login": "derekcollison",
"committed_at": "2022-12-14T21:33:16Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "a07c95dfa9e1a706fea0dadeb247a382ef6a5b54",
"body": "[ADDED] Xkeys support",
"is_bot": false,
"headline": "Merge pull request #182 from nats-io/xkeys",
"author_name": "Derek Collison",
"author_login": "derekcollison",
"committed_at": "2022-12-06T12:51:46Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "317149c3c5db01ea98dd1a5dfed4c8800826c40c",
"body": "The ServerID will now optionally include the public XKey from the server.\nAccountClaims can specify a public XKey for ExternalAuthorization that will force the server's authorization requests to be encrypted.\n\nNote go.mod changes are temporary to pull in staged xkeys PR. Once merged I will update.\n\nSigned-off-by: Derek Collison <derek@nats.io>",
"is_bot": false,
"headline": "Added in XKey support.",
"author_name": "Derek Collison",
"author_login": "derekcollison",
"committed_at": "2022-12-06T00:58:33Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "ec09c3a122ff202ed4c73f5fb272f881b36d45f9",
"body": "Some Updates",
"is_bot": false,
"headline": "Merge pull request #183 from nats-io/updates",
"author_name": "Derek Collison",
"author_login": "derekcollison",
"committed_at": "2022-12-05T23:02:55Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "c1f61ea53f7806b98d8be07917c91d70b84fe92a",
"body": "Signed-off-by: Derek Collison <derek@nats.io>",
"is_bot": false,
"headline": "Update travis.tml to go 1.19 and 1.18, update go modules version",
"author_name": "Derek Collison",
"author_login": "derekcollison",
"committed_at": "2022-12-05T22:58:02Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "4f532654e69662a82fab006a908f689970d2f79b",
"body": "Signed-off-by: Derek Collison <derek@nats.io>",
"is_bot": false,
"headline": "Remove ioutil",
"author_name": "Derek Collison",
"author_login": "derekcollison",
"committed_at": "2022-12-05T14:32:26Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "44198ae9f41fae1d579cc9674d28f37005c7c17e",
"body": "Signed-off-by: Derek Collison <derek@nats.io>",
"is_bot": false,
"headline": "go vet and go fmt",
"author_name": "Derek Collison",
"author_login": "derekcollison",
"committed_at": "2022-12-05T14:25:30Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "83b58fd548384c16c3101c22e13da899d2361a63",
"body": "…ecified (#181)",
"is_bot": false,
"headline": "[FIX] added validation where auth user is required if accounts are sp…",
"author_name": "Alberto Ricart",
"author_login": "aricart",
"committed_at": "2022-12-02T18:04:56Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "31baa5546134db61e7c2f6242aa3f1b873ec0627",
"body": "Added in an authorization request claims.",
"is_bot": false,
"headline": "Merge pull request #180 from nats-io/auth_request",
"author_name": "Derek Collison",
"author_login": "derekcollison",
"committed_at": "2022-12-02T14:11:17Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "bf796004f40fff71aed50f3a67686f96b953ba9d",
"body": "Signed-off-by: Derek Collison <derek@nats.io>",
"is_bot": false,
"headline": "Naming updates based on review feedback",
"author_name": "Derek Collison",
"author_login": "derekcollison",
"committed_at": "2022-12-02T14:04:21Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "8721d1a30789bbb20794b68ddf53b9bc41418ff1",
"body": "…or the NATS server.\n\nSigned-off-by: Derek Collison <derek@nats.io>",
"is_bot": false,
"headline": "Added in an authorization request claim for external authentication f…",
"author_name": "Derek Collison",
"author_login": "derekcollison",
"committed_at": "2022-12-02T13:58:22Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "ca3be3cbd866ece56191ac9b8fa274302b7abc10",
"body": "Add in support for external authorization for accounts.",
"is_bot": false,
"headline": "Merge pull request #179 from nats-io/auth_callout",
"author_name": "Derek Collison",
"author_login": "derekcollison",
"committed_at": "2022-12-01T23:24:32Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "f490b9052a670880ad044ba9da794e6a348adc98",
"body": "Signed-off-by: Derek Collison <derek@nats.io>",
"is_bot": false,
"headline": "Add in support for external authorization for accounts.",
"author_name": "Derek Collison",
"author_login": "derekcollison",
"committed_at": "2022-12-01T21:51:25Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "4a8a7328f44f94e4e9d4582fbd7f439100a2cd0e",
"body": "Release v2.3.0",
"is_bot": false,
"headline": "Merge pull request #178 from nats-io/release_2_3_0",
"author_name": "Ivan Kozlovic",
"author_login": "kozlovic",
"committed_at": "2022-06-28T20:01:56Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "58dfad6b83a61716ac242c27878b5b1da299a06e",
"body": "Signed-off-by: Ivan Kozlovic <ivan@synadia.com>",
"is_bot": false,
"headline": "Release v2.3.0",
"author_name": "Ivan Kozlovic",
"author_login": "kozlovic",
"committed_at": "2022-06-28T19:52:25Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "3bcd719cc7d083d359a1fbca2acb04a25103e264",
"body": "[add] DisallowBearerToken option to operator to disallow bearer = true",
"is_bot": false,
"headline": "Merge pull request #177 from nats-io/DisallowBearerToken",
"author_name": "Matthias Hanel",
"author_login": "matthiashanel",
"committed_at": "2022-05-09T18:01:18Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "b7cabf8dbe60a5235559a735400d84bdab1bacf6",
"body": "Signed-off-by: Matthias Hanel <mh@synadia.com>",
"is_bot": false,
"headline": "moved attribute to account",
"author_name": "Matthias Hanel",
"author_login": "matthiashanel",
"committed_at": "2022-05-09T16:59:55Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "9f4f1d5cc9778e59a02c345580814c19d845d7a7",
"body": "change 1 out of 3 for https://github.com/nats-io/nats-server/issues/3084",
"is_bot": false,
"headline": "[add] DisallowBearerToken option to operator to disallow bearer = true",
"author_name": "Matthias Hanel",
"author_login": "matthiashanel",
"committed_at": "2022-04-29T17:51:40Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "3b8532b48b96c7b018d61c646477f7bccaf33abe",
"body": "fix validation text",
"is_bot": false,
"headline": "Merge pull request #176 from nats-io/validation-text",
"author_name": "Matthias Hanel",
"author_login": "matthiashanel",
"committed_at": "2022-04-08T19:53:10Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "d3db06c2932324d92ec66a23dcf9caac3fa272fb",
"body": "Signed-off-by: Matthias Hanel <mh@synadia.com>",
"is_bot": false,
"headline": "fix validation text",
"author_name": "Matthias Hanel",
"author_login": "matthiashanel",
"committed_at": "2022-04-08T19:06:15Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "442af02fd36a57aa5b0f6b45c28f171eb2c4596d",
"body": "Adding max_ack_pending stream limit",
"is_bot": false,
"headline": "Merge pull request #174 from nats-io/max-ack-pending",
"author_name": "Matthias Hanel",
"author_login": "matthiashanel",
"committed_at": "2022-03-30T18:01:45Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "03a6fb27606bd094a397b17f420f8b3f3446d0a2",
"body": "Signed-off-by: Matthias Hanel <mh@synadia.com>",
"is_bot": false,
"headline": "Fix go 1.16 github actions staticcheck build issues",
"author_name": "Matthias Hanel",
"author_login": "matthiashanel",
"committed_at": "2022-03-30T17:54:51Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "c11dbed5c4caf2f57047ca165571088a10a6f09c",
"body": "Signed-off-by: Matthias Hanel <mh@synadia.com>",
"is_bot": false,
"headline": "Use t.Fatalf(...) instead of t.Fatal(fmt.Sprintf(...))",
"author_name": "Matthias Hanel",
"author_login": "matthiashanel",
"committed_at": "2022-03-30T17:26:24Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "9928008f35af8ef1c1e6d7475e90c30a049159a4",
"body": "Signed-off-by: Matthias Hanel <mh@synadia.com>",
"is_bot": false,
"headline": "Adding max_ack_pending stream limit",
"author_name": "Matthias Hanel",
"author_login": "matthiashanel",
"committed_at": "2022-03-30T17:26:21Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "5efd4536dd5c01f860191a1e9908dc4cb08cc1b1",
"body": "Switching MaxStreamBytes to Disk/Memory",
"is_bot": false,
"headline": "Merge pull request #173 from nats-io/maxmaxbytes-2",
"author_name": "Matthias Hanel",
"author_login": "matthiashanel",
"committed_at": "2022-03-28T22:21:44Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "2eedfe4932b246c504e3e5b1a0562081d58537c1",
"body": "And removing dependency on MaxBytesRequired\n\nSigned-off-by: Matthias Hanel <mh@synadia.com>",
"is_bot": false,
"headline": "Switching MaxStreamBytes to Disk/Memory",
"author_name": "Matthias Hanel",
"author_login": "matthiashanel",
"committed_at": "2022-03-28T22:07:42Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "3472a33220ba06f07b27c174f3a160d7ad46d047",
"body": "Adding max_max_bytes to limit the maximum value for max bytes",
"is_bot": false,
"headline": "Merge pull request #172 from nats-io/maxmaxbytes",
"author_name": "Matthias Hanel",
"author_login": "matthiashanel",
"committed_at": "2022-03-23T19:50:37Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "30ec1f4583a95097d52d11d7c8fbd5770a9fcc8e",
"body": "Signed-off-by: Matthias Hanel <mh@synadia.com>",
"is_bot": false,
"headline": "renaminb MaxMaxBytes to MaxStreamBytes",
"author_name": "Matthias Hanel",
"author_login": "matthiashanel",
"committed_at": "2022-03-23T19:34:17Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "3c80622308f6b0227c0765536e9199cfd2f6eed5",
"body": "Signed-off-by: Matthias Hanel <mh@synadia.com>",
"is_bot": false,
"headline": "Adding max_max_bytes to limit the maximum value for max bytes",
"author_name": "Matthias Hanel",
"author_login": "matthiashanel",
"committed_at": "2022-03-23T17:36:34Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "b65a1fb60b29b3dfe00ca03a835166d33b3f1ed5",
"body": "Replace HAResources with TieredLimits",
"is_bot": false,
"headline": "Merge pull request #169 from nats-io/tiers",
"author_name": "Matthias Hanel",
"author_login": "matthiashanel",
"committed_at": "2022-03-23T01:09:31Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "a1fd29b7d5757ae6987fbee5ea4f690cc5829a35",
"body": "Signed-off-by: Matthias Hanel <mh@synadia.com>",
"is_bot": false,
"headline": "Adding check for empty tier name",
"author_name": "Matthias Hanel",
"author_login": "matthiashanel",
"committed_at": "2022-03-22T17:16:34Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "afab08bdab408e12a70ed2c57ac0c5a6d76762d4",
"body": "Signed-off-by: Matthias Hanel <mh@synadia.com>",
"is_bot": false,
"headline": "Removed IsJSEnabled from JetStreamLimits",
"author_name": "Matthias Hanel",
"author_login": "matthiashanel",
"committed_at": "2022-03-22T17:16:34Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "c7a51045b15e21de6f66cc488f829565811f27b8",
"body": "Signed-off-by: Matthias Hanel <mh@synadia.com>",
"is_bot": false,
"headline": "add IsJSEnabled to operator",
"author_name": "Matthias Hanel",
"author_login": "matthiashanel",
"committed_at": "2022-03-22T17:16:33Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "97065db7e63601cd6b27341f753955c0a729f34f",
"body": "TieredLimits are mutually exclusive with JetStream limits\n\nSigned-off-by: Matthias Hanel <mh@synadia.com>",
"is_bot": false,
"headline": "Replace HAResources with TieredLimits",
"author_name": "Matthias Hanel",
"author_login": "matthiashanel",
"committed_at": "2022-03-22T17:16:30Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "a4dc57f25ef3e0e29b2147ac2a1bf1707e02197f",
"body": "Fix test deps",
"is_bot": false,
"headline": "Merge pull request #171 from nats-io/fix-testdeps",
"author_name": "Waldemar Quevedo",
"author_login": "wallyqs",
"committed_at": "2022-03-14T19:23:52Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "c3542f5ffb33d1f6e04103b7f2bfd039240d9e55",
"body": "Signed-off-by: Waldemar Quevedo <wally@synadia.com>",
"is_bot": false,
"headline": "Add script for testing and update Makefile",
"author_name": "Waldemar Quevedo",
"author_login": "wallyqs",
"committed_at": "2022-03-14T18:24:08Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "cbc856a8beb08a926a974ee77e6104d87ea3f888",
"body": "Only used for testing\n\nSigned-off-by: Waldemar Quevedo <wally@synadia.com>",
"is_bot": false,
"headline": "Remove indirect dependency on jwt v1",
"author_name": "Waldemar Quevedo",
"author_login": "wallyqs",
"committed_at": "2022-03-14T17:28:37Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "0ebff70bb0963daa37c706e5960818b0d6ad6e3f",
"body": "Update travis to Go 1.17",
"is_bot": false,
"headline": "Merge pull request #167 from nats-io/go_1_17",
"author_name": "Ivan Kozlovic",
"author_login": "kozlovic",
"committed_at": "2022-02-16T23:03:43Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "c9f0ca9fcf07a515b599a5ffce05e67a488c6283",
"body": "rename struct member HaResources to HAResources",
"is_bot": false,
"headline": "Merge pull request #166 from nats-io/ha-resources",
"author_name": "Matthias Hanel",
"author_login": "matthiashanel",
"committed_at": "2022-02-16T19:22:39Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "5be8995e08934c19c03c5a5da099fadf56010742",
"body": "Signed-off-by: Ivan Kozlovic <ivan@synadia.com>",
"is_bot": false,
"headline": "Update travis to Go 1.17",
"author_name": "Ivan Kozlovic",
"author_login": "kozlovic",
"committed_at": "2022-02-16T19:01:34Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "1e88c50fd302b04501d43a44147296805eb1bb69",
"body": "Signed-off-by: Matthias Hanel <mh@synadia.com>",
"is_bot": false,
"headline": "rename struct member HaResources to HAResources",
"author_name": "Matthias Hanel",
"author_login": "matthiashanel",
"committed_at": "2022-02-16T18:20:53Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "4b4a1c85619d16bd2aa59e41e94d8cdf2c1b7eca",
"body": "* Adding support for HA resources",
"is_bot": false,
"headline": "Adding support for HA resources (#165)",
"author_name": "Matthias Hanel",
"author_login": "matthiashanel",
"committed_at": "2022-02-08T17:44:25Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "58e87895b29641314818a5171038b73cff3bd25a",
"body": "* [FEATURE] Adding support for js max bytes required\r\n\r\nSigned-off-by: Matthias Hanel <mh@synadia.com>",
"is_bot": false,
"headline": "[FEATURE] Adding support for js max bytes required (#164)",
"author_name": "Matthias Hanel",
"author_login": "matthiashanel",
"committed_at": "2022-01-13T02:27:32Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "b87bc9cf336d182cff5afba51e7515893da95bba",
"body": "Adr 14",
"is_bot": false,
"headline": "Merge pull request #163 from nats-io/ADR-14",
"author_name": "Jean-Noël Moyne",
"author_login": "jnmoyne",
"committed_at": "2021-12-14T20:16:57Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "b991e3474e70adc228c509ea13a2c223a510a8ba",
"body": null,
"is_bot": false,
"headline": "IssuedAt is set by encode",
"author_name": "jnmoyne",
"author_login": "jnmoyne",
"committed_at": "2021-12-07T20:13:09Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "2406b1ff49e98e94b47040b2d951dafb271882b0",
"body": "…ob/main/adr/ADR-14.md",
"is_bot": false,
"headline": "Implements https://github.com/nats-io/nats-architecture-and-design/bl…",
"author_name": "jnmoyne",
"author_login": "jnmoyne",
"committed_at": "2021-12-06T23:48:18Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "fbbb4a5843511563d15bdd483f7ff3746aed0b36",
"body": "…ob/main/adr/ADR-14.md",
"is_bot": false,
"headline": "Implements https://github.com/nats-io/nats-architecture-and-design/bl…",
"author_name": "jnmoyne",
"author_login": "jnmoyne",
"committed_at": "2021-12-06T22:37:09Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "5474835bf2710001b83cc23d8c86d07b1bb75477",
"body": "Release v2.2.0",
"is_bot": false,
"headline": "Merge pull request #162 from nats-io/release_2_2_0",
"author_name": "Ivan Kozlovic",
"author_login": "kozlovic",
"committed_at": "2021-11-15T17:56:59Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "18ec093b4302783654e28b9aeb06e8afa28459c3",
"body": "Signed-off-by: Ivan Kozlovic <ivan@synadia.com>",
"is_bot": false,
"headline": "Release v2.2.0",
"author_name": "Ivan Kozlovic",
"author_login": "kozlovic",
"committed_at": "2021-11-15T17:03:38Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "ab1121ab4151fe0c6f99880f376483a929c4c058",
"body": "[ADDED] New websocket connection types",
"is_bot": false,
"headline": "Merge pull request #161 from nats-io/add_ws_conn_types",
"author_name": "Ivan Kozlovic",
"author_login": "kozlovic",
"committed_at": "2021-11-15T16:46:47Z",
"body_truncated": false,
"is_coding_agent": false
}
],
"releases_count": 46,
"commits_last_year": 11,
"latest_release_at": "2026-06-02T13:54:22Z",
"latest_release_tag": "v2.8.2",
"releases_from_tags": false,
"days_since_last_push": 49,
"active_weeks_last_year": 4,
"days_since_latest_release": 49,
"mean_days_between_releases": 77.4
},
"community": {
"has_readme": true,
"has_license": true,
"has_description": true,
"has_contributing": false,
"health_percentage": 37,
"has_issue_template": false,
"has_code_of_conduct": false,
"has_pull_request_template": false
},
"ecosystem": {
"packages": [
{
"name": "github.com/nats-io/jwt/v2",
"exists": true,
"license": null,
"keywords": [],
"ecosystem": "go",
"matches_repo": true,
"registry_url": "https://pkg.go.dev/github.com/nats-io/jwt/v2",
"is_deprecated": false,
"latest_version": "v2.8.2",
"repository_url": "https://github.com/nats-io/jwt",
"versions_count": 27,
"total_downloads": null,
"dependents_count": null,
"deprecation_note": null,
"maintainers_count": null,
"monthly_downloads": null,
"first_published_at": null,
"latest_published_at": "2026-06-02T13:53:38Z",
"latest_version_yanked": null,
"days_since_latest_publish": 49
}
]
},
"popularity": {
"forks": 37,
"stars": 88,
"watchers": 3,
"fork_history": {
"days": [
{
"date": "2018-12-16",
"count": 1
},
{
"date": "2019-03-01",
"count": 1
},
{
"date": "2019-08-09",
"count": 1
},
{
"date": "2019-09-22",
"count": 1
},
{
"date": "2019-12-05",
"count": 1
},
{
"date": "2020-02-12",
"count": 1
},
{
"date": "2020-03-12",
"count": 1
},
{
"date": "2020-05-22",
"count": 1
},
{
"date": "2020-10-14",
"count": 1
},
{
"date": "2020-10-28",
"count": 1
},
{
"date": "2020-12-21",
"count": 1
},
{
"date": "2021-05-12",
"count": 1
},
{
"date": "2021-07-20",
"count": 2
},
{
"date": "2021-08-06",
"count": 1
},
{
"date": "2021-08-24",
"count": 1
},
{
"date": "2021-09-28",
"count": 1
},
{
"date": "2022-03-03",
"count": 1
},
{
"date": "2022-11-30",
"count": 1
},
{
"date": "2023-01-20",
"count": 1
},
{
"date": "2023-04-03",
"count": 1
},
{
"date": "2023-07-03",
"count": 1
},
{
"date": "2023-07-20",
"count": 1
},
{
"date": "2023-08-18",
"count": 1
},
{
"date": "2023-10-24",
"count": 1
},
{
"date": "2024-10-28",
"count": 1
},
{
"date": "2025-04-26",
"count": 1
},
{
"date": "2025-04-27",
"count": 1
},
{
"date": "2025-04-29",
"count": 1
},
{
"date": "2025-07-09",
"count": 1
},
{
"date": "2025-07-11",
"count": 1
},
{
"date": "2025-08-23",
"count": 1
},
{
"date": "2026-02-17",
"count": 1
},
{
"date": "2026-02-20",
"count": 1
},
{
"date": "2026-03-05",
"count": 1
},
{
"date": "2026-06-21",
"count": 1
}
],
"complete": true,
"collected": 36,
"total_forks": 37
},
"star_history": {
"days": [
{
"date": "2018-10-15",
"count": 1
},
{
"date": "2018-12-16",
"count": 1
},
{
"date": "2018-12-21",
"count": 1
},
{
"date": "2019-03-01",
"count": 1
},
{
"date": "2019-03-24",
"count": 1
},
{
"date": "2019-04-16",
"count": 1
},
{
"date": "2019-06-17",
"count": 1
},
{
"date": "2019-07-06",
"count": 1
},
{
"date": "2019-07-20",
"count": 1
},
{
"date": "2019-07-31",
"count": 2
},
{
"date": "2019-08-01",
"count": 1
},
{
"date": "2019-08-05",
"count": 1
},
{
"date": "2019-08-14",
"count": 1
},
{
"date": "2019-08-19",
"count": 1
},
{
"date": "2019-09-04",
"count": 1
},
{
"date": "2019-09-17",
"count": 1
},
{
"date": "2019-09-18",
"count": 1
},
{
"date": "2019-09-19",
"count": 1
},
{
"date": "2019-12-03",
"count": 1
},
{
"date": "2019-12-04",
"count": 1
},
{
"date": "2019-12-05",
"count": 1
},
{
"date": "2020-01-13",
"count": 1
},
{
"date": "2020-01-19",
"count": 1
},
{
"date": "2020-03-05",
"count": 1
},
{
"date": "2020-03-15",
"count": 1
},
{
"date": "2020-03-20",
"count": 1
},
{
"date": "2020-05-08",
"count": 1
},
{
"date": "2020-05-24",
"count": 1
},
{
"date": "2020-07-05",
"count": 1
},
{
"date": "2020-09-04",
"count": 1
},
{
"date": "2020-09-27",
"count": 1
},
{
"date": "2020-10-07",
"count": 1
},
{
"date": "2020-10-31",
"count": 1
},
{
"date": "2020-12-11",
"count": 1
},
{
"date": "2020-12-13",
"count": 1
},
{
"date": "2021-01-27",
"count": 1
},
{
"date": "2021-02-05",
"count": 1
},
{
"date": "2021-03-22",
"count": 1
},
{
"date": "2021-04-25",
"count": 1
},
{
"date": "2021-05-12",
"count": 1
},
{
"date": "2021-09-29",
"count": 1
},
{
"date": "2021-10-22",
"count": 1
},
{
"date": "2021-12-20",
"count": 1
},
{
"date": "2022-01-14",
"count": 1
},
{
"date": "2022-02-21",
"count": 1
},
{
"date": "2022-03-03",
"count": 1
},
{
"date": "2022-03-22",
"count": 1
},
{
"date": "2022-03-29",
"count": 1
},
{
"date": "2022-05-03",
"count": 1
},
{
"date": "2022-07-16",
"count": 1
},
{
"date": "2022-08-14",
"count": 1
},
{
"date": "2022-09-21",
"count": 1
},
{
"date": "2022-11-04",
"count": 1
},
{
"date": "2022-12-17",
"count": 1
},
{
"date": "2023-01-16",
"count": 1
},
{
"date": "2023-01-24",
"count": 1
},
{
"date": "2023-02-22",
"count": 1
},
{
"date": "2023-03-06",
"count": 2
},
{
"date": "2023-03-21",
"count": 1
},
{
"date": "2023-03-25",
"count": 1
},
{
"date": "2023-04-24",
"count": 1
},
{
"date": "2023-08-25",
"count": 1
},
{
"date": "2023-09-07",
"count": 1
},
{
"date": "2024-03-23",
"count": 1
},
{
"date": "2024-03-25",
"count": 1
},
{
"date": "2024-04-21",
"count": 1
},
{
"date": "2024-06-17",
"count": 1
},
{
"date": "2024-06-27",
"count": 1
},
{
"date": "2024-07-10",
"count": 1
},
{
"date": "2024-07-18",
"count": 1
},
{
"date": "2024-07-27",
"count": 1
},
{
"date": "2024-09-25",
"count": 2
},
{
"date": "2025-02-03",
"count": 1
},
{
"date": "2025-03-27",
"count": 1
},
{
"date": "2025-04-04",
"count": 1
},
{
"date": "2025-04-26",
"count": 1
},
{
"date": "2025-05-20",
"count": 1
},
{
"date": "2025-06-04",
"count": 1
},
{
"date": "2025-09-09",
"count": 1
},
{
"date": "2025-10-05",
"count": 1
},
{
"date": "2025-10-28",
"count": 1
},
{
"date": "2026-01-19",
"count": 1
},
{
"date": "2026-02-23",
"count": 1
},
{
"date": "2026-06-07",
"count": 1
}
],
"complete": true,
"collected": 87,
"total_stars": 88
},
"open_issues_and_prs": 14
},
"ai_readiness": {
"has_nix": false,
"example_dirs": [],
"has_llms_txt": false,
"has_dockerfile": false,
"has_mcp_signal": false,
"bootstrap_files": [
"v2/Makefile",
"v2/v1compat/Makefile"
],
"api_schema_files": [],
"has_devcontainer": false,
"typecheck_configs": [],
"toolchain_manifests": [
"v2/go.mod"
],
"largest_source_bytes": 31695,
"source_files_sampled": 66,
"oversized_source_files": 0,
"agent_instruction_files": [],
"agent_instruction_max_bytes": null
},
"dependencies": {
"manifests": [
"v2/go.mod"
],
"advisories": {
"error": null,
"scope": "repository_graph",
"source": "osv",
"findings": [
{
"name": "github.com/nats-io/jwt",
"direct": false,
"version": "1.2.2",
"severity": "critical",
"ecosystem": "go",
"cvss_score": null,
"advisory_ids": [
"GHSA-62mh-w5cv-p88c",
"GO-2022-0386"
],
"fixed_version": "2.0.1",
"advisory_count": 2,
"oldest_advisory_days": 1618
},
{
"name": "golang.org/x/crypto",
"direct": false,
"version": "v0.52.0",
"severity": "unknown",
"ecosystem": "go",
"cvss_score": null,
"advisory_ids": [
"GO-2026-5932"
],
"fixed_version": null,
"advisory_count": 1,
"oldest_advisory_days": 14
}
],
"collected": true,
"malicious": [],
"truncated": false,
"by_severity": {
"unknown": 1,
"critical": 1
},
"advisory_count": 3,
"affected_count": 2,
"assessed_count": 5,
"malicious_count": 0,
"assessed_package": null,
"unassessed_count": 0,
"direct_affected_count": 0
},
"ecosystems": [
"go"
],
"dependencies": [
{
"name": "github.com/nats-io/nkeys",
"manifest": "v2/go.mod",
"ecosystem": "go",
"version_constraint": "v0.4.16"
}
],
"all_dependencies": {
"error": null,
"source": "github-sbom",
"packages": [
{
"name": "github.com/nats-io/nkeys",
"direct": true,
"version": "0.3.0",
"ecosystem": "go"
},
{
"name": "github.com/nats-io/nkeys",
"direct": true,
"version": "v0.4.16",
"ecosystem": "go"
},
{
"name": "github.com/nats-io/jwt",
"direct": false,
"version": "1.2.2",
"ecosystem": "go"
},
{
"name": "golang.org/x/crypto",
"direct": false,
"version": "v0.52.0",
"ecosystem": "go"
},
{
"name": "golang.org/x/sys",
"direct": false,
"version": "v0.45.0",
"ecosystem": "go"
}
],
"collected": true,
"truncated": false,
"total_count": 5,
"direct_count": 2,
"indirect_count": 3
}
},
"maintainership": {
"issues": {
"open_prs": 1,
"merged_prs": 188,
"open_issues": 13,
"closed_ratio": 0.594,
"closed_issues": 19,
"closed_unmerged_prs": 27
},
"bus_factor": 2,
"bot_contributors": 1,
"top_contributors": [
{
"type": "User",
"login": "aricart",
"commits": 96,
"avatar_url": "https://avatars.githubusercontent.com/u/1032976?v=4"
},
{
"type": "User",
"login": "matthiashanel",
"commits": 71,
"avatar_url": "https://avatars.githubusercontent.com/u/19881388?v=4"
},
{
"type": "User",
"login": "derekcollison",
"commits": 47,
"avatar_url": "https://avatars.githubusercontent.com/u/90097?v=4"
},
{
"type": "User",
"login": "kozlovic",
"commits": 46,
"avatar_url": "https://avatars.githubusercontent.com/u/13736691?v=4"
},
{
"type": "User",
"login": "sasbury",
"commits": 10,
"avatar_url": "https://avatars.githubusercontent.com/u/3311569?v=4"
},
{
"type": "User",
"login": "wallyqs",
"commits": 8,
"avatar_url": "https://avatars.githubusercontent.com/u/26195?v=4"
},
{
"type": "User",
"login": "jnmoyne",
"commits": 4,
"avatar_url": "https://avatars.githubusercontent.com/u/7819096?v=4"
},
{
"type": "User",
"login": "neilalexander",
"commits": 4,
"avatar_url": "https://avatars.githubusercontent.com/u/310854?v=4"
},
{
"type": "User",
"login": "henryleduc",
"commits": 3,
"avatar_url": "https://avatars.githubusercontent.com/u/55436491?v=4"
},
{
"type": "User",
"login": "philpennock",
"commits": 3,
"avatar_url": "https://avatars.githubusercontent.com/u/559098?v=4"
}
],
"contributors_sampled": 16,
"top_contributor_share": 0.32
},
"quality_signals": {
"has_ci": true,
"has_tests": true,
"ci_workflows": [
"claude.yaml",
"go-test.yaml"
],
"has_docs_dir": false,
"linter_configs": [],
"has_editorconfig": false,
"has_linter_config": false,
"has_precommit_config": false
},
"security_signals": {
"lockfiles": [
"go.sum"
],
"scorecard": {
"checks": [
{
"name": "Binary-Artifacts",
"score": 10,
"reason": "no binaries found in the repo",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#binary-artifacts"
},
{
"name": "Branch-Protection",
"score": null,
"reason": "internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#branch-protection"
},
{
"name": "CI-Tests",
"score": 4,
"reason": "11 out of 27 merged PRs checked by a CI test -- score normalized to 4",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#ci-tests"
},
{
"name": "CII-Best-Practices",
"score": 0,
"reason": "no effort to earn an OpenSSF best practices badge detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#cii-best-practices"
},
{
"name": "Code-Review",
"score": 10,
"reason": "all changesets reviewed",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#code-review"
},
{
"name": "Contributors",
"score": 10,
"reason": "project has 5 contributing companies or organizations",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#contributors"
},
{
"name": "Dangerous-Workflow",
"score": 10,
"reason": "no dangerous workflow patterns detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dangerous-workflow"
},
{
"name": "Dependency-Update-Tool",
"score": 10,
"reason": "update tool detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dependency-update-tool"
},
{
"name": "Fuzzing",
"score": 0,
"reason": "project is not fuzzed",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#fuzzing"
},
{
"name": "License",
"score": 10,
"reason": "license file detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#license"
},
{
"name": "Maintained",
"score": 1,
"reason": "2 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 1",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#maintained"
},
{
"name": "Packaging",
"score": null,
"reason": "packaging workflow not detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#packaging"
},
{
"name": "Pinned-Dependencies",
"score": 0,
"reason": "dependency not pinned by hash detected -- score normalized to 0",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#pinned-dependencies"
},
{
"name": "SAST",
"score": 3,
"reason": "SAST tool is not run on all commits -- score normalized to 3",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#sast"
},
{
"name": "Security-Policy",
"score": 0,
"reason": "security policy file not detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#security-policy"
},
{
"name": "Signed-Releases",
"score": null,
"reason": "no releases found",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#signed-releases"
},
{
"name": "Token-Permissions",
"score": 0,
"reason": "detected GitHub workflow tokens with excessive permissions",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#token-permissions"
},
{
"name": "Vulnerabilities",
"score": 9,
"reason": "1 existing vulnerabilities detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#vulnerabilities"
}
],
"commit": "82017236da50e4a0173091105d82d46228b8dccf",
"ran_at": "2026-07-22T07:18:17Z",
"aggregate_score": 5.6,
"scorecard_version": "v5.5.0"
},
"has_codeql_workflow": false,
"has_security_policy": false,
"has_dependabot_config": false
},
"contribution_flow": {
"collected": true,
"ci_last_run_at": "2026-07-15T17:54:58Z",
"oldest_open_prs": [
{
"number": 210,
"created_at": "2023-10-25T18:44:30Z",
"last_comment_at": null,
"last_comment_author": null
}
],
"last_merged_pr_at": "2026-06-02T13:53:39Z",
"ci_last_conclusion": "SUCCESS",
"oldest_open_issues": [
{
"number": 30,
"created_at": "2019-04-09T23:24:12Z",
"last_comment_at": null,
"last_comment_author": null
},
{
"number": 63,
"created_at": "2019-12-19T13:44:00Z",
"last_comment_at": null,
"last_comment_author": null
},
{
"number": 65,
"created_at": "2019-12-19T13:49:31Z",
"last_comment_at": null,
"last_comment_author": null
},
{
"number": 83,
"created_at": "2020-06-24T22:22:23Z",
"last_comment_at": null,
"last_comment_author": null
},
{
"number": 84,
"created_at": "2020-06-24T22:23:32Z",
"last_comment_at": null,
"last_comment_author": null
},
{
"number": 101,
"created_at": "2020-09-22T18:09:41Z",
"last_comment_at": null,
"last_comment_author": null
},
{
"number": 112,
"created_at": "2020-10-24T02:40:51Z",
"last_comment_at": null,
"last_comment_author": null
},
{
"number": 118,
"created_at": "2020-11-24T22:50:51Z",
"last_comment_at": "2020-11-24T23:36:28Z",
"last_comment_author": "philpennock"
},
{
"number": 123,
"created_at": "2020-12-04T18:14:50Z",
"last_comment_at": null,
"last_comment_author": null
},
{
"number": 170,
"created_at": "2022-03-14T15:06:58Z",
"last_comment_at": null,
"last_comment_author": null
},
{
"number": 199,
"created_at": "2023-05-06T22:38:00Z",
"last_comment_at": "2023-12-18T12:13:31Z",
"last_comment_author": "ahirner"
},
{
"number": 207,
"created_at": "2023-08-25T19:58:54Z",
"last_comment_at": "2023-08-25T20:19:04Z",
"last_comment_author": "aricart"
},
{
"number": 249,
"created_at": "2026-04-23T08:18:19Z",
"last_comment_at": "2026-04-23T13:56:26Z",
"last_comment_author": "choufraise"
}
]
}
},
"config": {
"disabled_metrics": [],
"disabled_categories": [],
"disabled_components": {}
},
"source": {
"url": "https://github.com/nats-io/jwt",
"host": "github.com",
"name": "jwt",
"owner": "nats-io"
},
"metrics": {
"overall": {
"key": "overall",
"band": "moderate",
"name": "Overall health",
"note": null,
"notes": [],
"value": 61,
"inputs": {
"security": 65,
"vitality": 56,
"community": 48,
"governance": 78,
"engineering": 54
},
"components": []
},
"categories": [
{
"key": "vitality",
"band": "moderate",
"name": "Vitality",
"value": 56,
"weight": 0.22,
"metrics": [
{
"key": "development_activity",
"band": "at_risk",
"name": "Development activity",
"note": null,
"notes": [],
"value": 32,
"inputs": {
"commits_last_year": 11,
"human_commit_share": 0.99,
"days_since_last_push": 49,
"active_weeks_last_year": 4
},
"components": [
{
"key": "push_recency",
"name": "Push recency",
"detail": "last push 49 days ago",
"points": 18,
"status": "partial",
"details": [
{
"code": "push_recency",
"params": {
"days": 49
}
}
],
"max_points": 36
},
{
"key": "commit_cadence",
"name": "Commit cadence",
"detail": "4/52 weeks with commits",
"points": 2.8,
"status": "partial",
"details": [
{
"code": "commit_cadence_weeks",
"params": {
"weeks": 4
}
}
],
"max_points": 36
},
{
"key": "commit_volume",
"name": "Commit volume",
"detail": "11 commits in the last year",
"points": 9.7,
"status": "partial",
"details": [
{
"code": "commits_last_year",
"params": {
"count": 11
}
}
],
"max_points": 18
},
{
"key": "openssf_scorecard_maintained",
"name": "OpenSSF Scorecard: Maintained",
"detail": "2 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 1",
"points": 1,
"status": "partial",
"details": [],
"max_points": 10
}
]
},
{
"key": "release_discipline",
"band": "excellent",
"name": "Release discipline",
"note": "Excluded from scoring (no data or not applicable): OpenSSF Scorecard: Signed-Releases. Remaining weights renormalized.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"openssf_scorecard_signed_releases"
]
}
},
{
"code": "weights_renormalized",
"params": {}
}
],
"value": 92,
"inputs": {
"releases_count": 46,
"latest_release_tag": "v2.8.2",
"releases_from_tags": false,
"days_since_latest_release": 49,
"mean_days_between_releases": 77.4
},
"components": [
{
"key": "ships_releases",
"name": "Ships releases",
"detail": "46 releases published",
"points": 27,
"status": "met",
"details": [
{
"code": "releases_published",
"params": {
"count": 46
}
}
],
"max_points": 27
},
{
"key": "release_recency",
"name": "Release recency",
"detail": "latest release 49 days ago",
"points": 36,
"status": "met",
"details": [
{
"code": "release_recency",
"params": {
"days": 49
}
}
],
"max_points": 36
},
{
"key": "release_cadence",
"name": "Release cadence",
"detail": "a release every ~77.4 days",
"points": 19.8,
"status": "partial",
"details": [
{
"code": "release_cadence",
"params": {
"gap": 77.4
}
}
],
"max_points": 27
},
{
"key": "openssf_scorecard_signed_releases",
"name": "OpenSSF Scorecard: Signed-Releases",
"detail": "no releases found",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_data",
"params": {}
}
],
"max_points": 10
}
]
},
{
"key": "abandonment",
"band": "excellent",
"name": "Abandonment",
"note": null,
"notes": [],
"value": 100,
"inputs": {
"cap": null,
"state": "maintained",
"guards": [],
"signals": [],
"red_flag": false,
"multiplier_pct": 100,
"declared_reason": null,
"unverified_reason": null,
"unanswered_open_prs": null,
"unanswered_open_issues": null,
"days_since_last_merged_pr": null,
"days_since_last_human_commit": 49,
"days_since_last_human_commit_is_floor": false
},
"components": [
{
"key": "project_is_still_maintained",
"name": "Project is still maintained",
"detail": "last human commit 49 days ago",
"points": 100,
"status": "met",
"details": [
{
"code": "abandonment_maintained",
"params": {
"days": 49
}
}
],
"max_points": 100
}
]
}
],
"description": "Is the project alive — is code being written and are releases shipping?"
},
{
"key": "community",
"band": "at_risk",
"name": "Community & Adoption",
"value": 48,
"weight": 0.18,
"metrics": [
{
"key": "popularity",
"band": "at_risk",
"name": "Popularity & adoption",
"note": null,
"notes": [],
"value": 46,
"inputs": {
"forks": 37,
"stars": 88,
"watchers": 3,
"growth_state": "unverified",
"growth_factor_pct": 100,
"growth_unverified_reason": "below_threshold"
},
"components": [
{
"key": "stars",
"name": "Stars",
"detail": "88 stars",
"points": 31.5,
"status": "partial",
"details": [
{
"code": "stars",
"params": {
"count": 88
}
}
],
"max_points": 60
},
{
"key": "forks",
"name": "Forks",
"detail": "37 forks",
"points": 13,
"status": "partial",
"details": [
{
"code": "forks",
"params": {
"count": 37
}
}
],
"max_points": 25
},
{
"key": "watchers",
"name": "Watchers",
"detail": "3 watchers",
"points": 1.7,
"status": "partial",
"details": [
{
"code": "watchers",
"params": {
"count": 3
}
}
],
"max_points": 15
}
]
},
{
"key": "community_health",
"band": "moderate",
"name": "Community health",
"note": null,
"notes": [],
"value": 50,
"inputs": {
"has_readme": true,
"has_license": true,
"has_contributing": false,
"has_issue_template": false,
"has_code_of_conduct": false,
"has_pull_request_template": false
},
"components": [
{
"key": "readme",
"name": "README",
"detail": null,
"points": 22.5,
"status": "met",
"details": [],
"max_points": 22.5
},
{
"key": "license",
"name": "License",
"detail": "recognized license (Apache-2.0)",
"points": 22.5,
"status": "met",
"details": [
{
"code": "license_standard",
"params": {}
},
{
"code": "license_spdx",
"params": {
"spdx": "Apache-2.0"
}
}
],
"max_points": 22.5
},
{
"key": "contributing_guide",
"name": "CONTRIBUTING guide",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 18
},
{
"key": "code_of_conduct",
"name": "Code of conduct",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 13.5
},
{
"key": "issue_template",
"name": "Issue template",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.2
},
{
"key": "pr_template",
"name": "PR template",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 6.3
}
]
}
],
"description": "Does the project have users, downloads, attention, and a welcoming setup for contributors?"
},
{
"key": "governance",
"band": "good",
"name": "Sustainability & Governance",
"value": 78,
"weight": 0.24,
"metrics": [
{
"key": "maintainer_resilience",
"band": "moderate",
"name": "Maintainer resilience (bus factor)",
"note": null,
"notes": [],
"value": 64,
"inputs": {
"bus_factor": 2,
"contributors_sampled": 16,
"top_contributor_share": 0.32
},
"components": [
{
"key": "bus_factor",
"name": "Bus factor",
"detail": "2 contributor(s) cover half of all commits",
"points": 25.2,
"status": "partial",
"details": [
{
"code": "bus_factor",
"params": {
"count": 2
}
}
],
"max_points": 54
},
{
"key": "commit_distribution",
"name": "Commit distribution",
"detail": "top contributor authored 32% of commits",
"points": 15.3,
"status": "partial",
"details": [
{
"code": "top_contributor_share",
"params": {
"share": 32
}
}
],
"max_points": 22.5
},
{
"key": "contributor_breadth",
"name": "Contributor breadth",
"detail": "16 contributors",
"points": 13.5,
"status": "met",
"details": [
{
"code": "contributors_sampled",
"params": {
"count": 16
}
}
],
"max_points": 13.5
},
{
"key": "openssf_scorecard_contributors",
"name": "OpenSSF Scorecard: Contributors",
"detail": "project has 5 contributing companies or organizations",
"points": 10,
"status": "met",
"details": [],
"max_points": 10
}
]
},
{
"key": "responsiveness",
"band": "good",
"name": "Issue & PR responsiveness",
"note": null,
"notes": [],
"value": 76,
"inputs": {
"merged_prs": 188,
"open_issues": 13,
"closed_issues": 19,
"issue_closed_ratio": 0.594,
"closed_unmerged_prs": 27
},
"components": [
{
"key": "issue_resolution",
"name": "Issue resolution",
"detail": "59% of issues closed",
"points": 27.8,
"status": "partial",
"details": [
{
"code": "issues_closed_share",
"params": {
"share": 59
}
}
],
"max_points": 46.75
},
{
"key": "pr_acceptance",
"name": "PR acceptance",
"detail": "188/215 decided PRs merged",
"points": 33.4,
"status": "partial",
"details": [
{
"code": "decided_prs_merged",
"params": {
"merged": 188,
"decided": 215
}
}
],
"max_points": 38.25
},
{
"key": "openssf_scorecard_code_review",
"name": "OpenSSF Scorecard: Code-Review",
"detail": "all changesets reviewed",
"points": 15,
"status": "met",
"details": [],
"max_points": 15
}
]
},
{
"key": "stewardship",
"band": "good",
"name": "Ownership & stewardship",
"note": null,
"notes": [],
"value": 79,
"inputs": {
"followers": 2424,
"owner_type": "Organization",
"is_verified": null,
"owner_login": "nats-io",
"public_repos": 131,
"account_age_days": 4236
},
"components": [
{
"key": "ownership_backing",
"name": "Ownership backing",
"detail": "organization-owned",
"points": 30,
"status": "met",
"details": [
{
"code": "owner_organization",
"params": {}
}
],
"max_points": 30
},
{
"key": "verified_domain",
"name": "Verified domain",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 20
},
{
"key": "owner_reach",
"name": "Owner reach",
"detail": "2,424 followers of nats-io",
"points": 24.3,
"status": "partial",
"details": [
{
"code": "owner_followers",
"params": {
"count": 2424,
"login": "nats-io"
}
}
],
"max_points": 25
},
{
"key": "track_record",
"name": "Track record",
"detail": "131 public repos, account ~11 yr old",
"points": 25,
"status": "met",
"details": [
{
"code": "public_repos",
"params": {
"count": 131
}
},
{
"code": "account_age_years",
"params": {
"years": 11
}
}
],
"max_points": 25
}
]
},
{
"key": "package_maintenance",
"band": "excellent",
"name": "Package maintenance",
"note": null,
"notes": [],
"value": 100,
"inputs": {
"packages": [
"github.com/nats-io/jwt/v2"
],
"ecosystems": "go",
"any_deprecated": false,
"min_days_since_publish": 49
},
"components": [
{
"key": "published_resolvable",
"name": "Published & resolvable",
"detail": "1 package(s) on go",
"points": 25,
"status": "met",
"details": [
{
"code": "packages_published",
"params": {
"count": 1,
"ecosystems": "go"
}
}
],
"max_points": 25
},
{
"key": "publish_recency",
"name": "Publish recency",
"detail": "latest publish 49 days ago",
"points": 35,
"status": "met",
"details": [
{
"code": "publish_recency",
"params": {
"days": 49
}
}
],
"max_points": 35
},
{
"key": "version_history",
"name": "Version history",
"detail": "27 published versions",
"points": 20,
"status": "met",
"details": [
{
"code": "published_versions",
"params": {
"count": 27
}
}
],
"max_points": 20
},
{
"key": "not_deprecated",
"name": "Not deprecated",
"detail": "active, not deprecated or yanked",
"points": 20,
"status": "met",
"details": [
{
"code": "package_not_deprecated",
"params": {}
}
],
"max_points": 20
}
]
}
],
"description": "Will the project survive its people — bus factor, responsiveness, who backs it, and package upkeep?"
},
{
"key": "engineering",
"band": "moderate",
"name": "Engineering Quality",
"value": 54,
"weight": 0.2,
"metrics": [
{
"key": "engineering_practices",
"band": "moderate",
"name": "Engineering practices",
"note": null,
"notes": [],
"value": 56,
"inputs": {
"has_ci": true,
"has_tests": true,
"has_editorconfig": false,
"has_linter_config": false,
"has_precommit_config": false
},
"components": [
{
"key": "ci_workflows",
"name": "CI workflows",
"detail": "2 workflow(s)",
"points": 24,
"status": "met",
"details": [
{
"code": "ci_workflows",
"params": {
"count": 2
}
}
],
"max_points": 24
},
{
"key": "tests_present",
"name": "Tests present",
"detail": null,
"points": 24,
"status": "met",
"details": [],
"max_points": 24
},
{
"key": "linter_config",
"name": "Linter config",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 16
},
{
"key": "pre_commit_hooks",
"name": "Pre-commit hooks",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 9.6
},
{
"key": "editorconfig",
"name": ".editorconfig",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 6.4
},
{
"key": "openssf_scorecard_ci_tests",
"name": "OpenSSF Scorecard: CI-Tests",
"detail": "11 out of 27 merged PRs checked by a CI test -- score normalized to 4",
"points": 8,
"status": "partial",
"details": [],
"max_points": 20
}
]
},
{
"key": "documentation",
"band": "moderate",
"name": "Documentation",
"note": null,
"notes": [],
"value": 50,
"inputs": {
"topics": [],
"has_wiki": true,
"homepage": null,
"has_readme": true,
"has_docs_dir": false,
"has_description": true
},
"components": [
{
"key": "readme",
"name": "README",
"detail": null,
"points": 30,
"status": "met",
"details": [],
"max_points": 30
},
{
"key": "documentation_directory",
"name": "Documentation directory",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 25
},
{
"key": "documentation_homepage_site",
"name": "Documentation / homepage site",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 15
},
{
"key": "repository_description",
"name": "Repository description",
"detail": null,
"points": 10,
"status": "met",
"details": [],
"max_points": 10
},
{
"key": "topics",
"name": "Topics",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 10
},
{
"key": "wiki",
"name": "Wiki",
"detail": null,
"points": 10,
"status": "met",
"details": [],
"max_points": 10
}
]
}
],
"description": "Are baseline engineering and documentation practices in place?"
},
{
"key": "security",
"band": "moderate",
"name": "Security",
"value": 65,
"weight": 0.16,
"metrics": [
{
"key": "security_posture",
"band": "moderate",
"name": "Security posture",
"note": "Excluded from scoring (no data or not applicable): Branch-Protection, Packaging, Signed-Releases. Remaining weights renormalized.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"branch_protection",
"packaging",
"signed_releases"
]
}
},
{
"code": "weights_renormalized",
"params": {}
}
],
"value": 56,
"inputs": {
"source": "openssf_scorecard",
"checks_evaluated": 15,
"scorecard_version": "v5.5.0",
"checks_inconclusive": 3,
"scorecard_aggregate": 5.6
},
"components": [
{
"key": "binary_artifacts",
"name": "Binary-Artifacts",
"detail": "no binaries found in the repo",
"points": 7.5,
"status": "met",
"details": [],
"max_points": 7.5
},
{
"key": "branch_protection",
"name": "Branch-Protection",
"detail": "internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_data",
"params": {}
}
],
"max_points": 7.5
},
{
"key": "ci_tests",
"name": "CI-Tests",
"detail": "11 out of 27 merged PRs checked by a CI test -- score normalized to 4",
"points": 1,
"status": "partial",
"details": [],
"max_points": 2.5
},
{
"key": "cii_best_practices",
"name": "CII-Best-Practices",
"detail": "no effort to earn an OpenSSF best practices badge detected",
"points": 0,
"status": "missed",
"details": [],
"max_points": 2.5
},
{
"key": "code_review",
"name": "Code-Review",
"detail": "all changesets reviewed",
"points": 7.5,
"status": "met",
"details": [],
"max_points": 7.5
},
{
"key": "contributors",
"name": "Contributors",
"detail": "project has 5 contributing companies or organizations",
"points": 2.5,
"status": "met",
"details": [],
"max_points": 2.5
},
{
"key": "dangerous_workflow",
"name": "Dangerous-Workflow",
"detail": "no dangerous workflow patterns detected",
"points": 10,
"status": "met",
"details": [],
"max_points": 10
},
{
"key": "dependency_update_tool",
"name": "Dependency-Update-Tool",
"detail": "update tool detected",
"points": 7.5,
"status": "met",
"details": [],
"max_points": 7.5
},
{
"key": "fuzzing",
"name": "Fuzzing",
"detail": "project is not fuzzed",
"points": 0,
"status": "missed",
"details": [],
"max_points": 5
},
{
"key": "license",
"name": "License",
"detail": "license file detected",
"points": 2.5,
"status": "met",
"details": [],
"max_points": 2.5
},
{
"key": "maintained",
"name": "Maintained",
"detail": "2 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 1",
"points": 0.8,
"status": "partial",
"details": [],
"max_points": 7.5
},
{
"key": "packaging",
"name": "Packaging",
"detail": "packaging workflow not detected",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_data",
"params": {}
}
],
"max_points": 5
},
{
"key": "pinned_dependencies",
"name": "Pinned-Dependencies",
"detail": "dependency not pinned by hash detected -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 5
},
{
"key": "sast",
"name": "SAST",
"detail": "SAST tool is not run on all commits -- score normalized to 3",
"points": 1.5,
"status": "partial",
"details": [],
"max_points": 5
},
{
"key": "security_policy",
"name": "Security-Policy",
"detail": "security policy file not detected",
"points": 0,
"status": "missed",
"details": [],
"max_points": 5
},
{
"key": "signed_releases",
"name": "Signed-Releases",
"detail": "no releases found",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_data",
"params": {}
}
],
"max_points": 7.5
},
{
"key": "token_permissions",
"name": "Token-Permissions",
"detail": "detected GitHub workflow tokens with excessive permissions",
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.5
},
{
"key": "vulnerabilities",
"name": "Vulnerabilities",
"detail": "1 existing vulnerabilities detected",
"points": 6.8,
"status": "partial",
"details": [],
"max_points": 7.5
}
]
},
{
"key": "dependency_advisories",
"band": "excellent",
"name": "Dependency advisories",
"note": "Excluded from scoring (no data or not applicable): Indirect dependencies free of known advisories, No advisories left outstanding. Remaining weights renormalized. Matched 5 resolved dependencies against OSV. This repository publishes no package the index resolves, so the repository dependency graph was assessed instead. That graph mixes development and test pins with shipped dependencies, so only the declared runtime dependencies are scored; transitive findings are reported as context and excluded from the score. Reachability is not analyzed.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"indirect_dependencies_free_of_known_advisories",
"no_advisories_left_outstanding"
]
}
},
{
"code": "weights_renormalized",
"params": {}
},
{
"code": "advisories_scope_repository",
"params": {
"assessed": 5
}
},
{
"code": "advisories_repo_graph_caveat",
"params": {}
},
{
"code": "advisories_reachability",
"params": {}
}
],
"value": 100,
"inputs": {
"source": "osv",
"advisories": 3,
"affected_packages": 2,
"assessed_packages": 5,
"unassessed_packages": 0,
"affected_by_severity": "critical 1, unknown 1",
"direct_affected_packages": 0
},
"components": [
{
"key": "direct_dependencies_free_of_known_advisories",
"name": "Direct dependencies free of known advisories",
"detail": "no direct dependency carries a known advisory",
"points": 35,
"status": "met",
"details": [
{
"code": "no_direct_advisories",
"params": {}
}
],
"max_points": 35
},
{
"key": "indirect_dependencies_free_of_known_advisories",
"name": "Indirect dependencies free of known advisories",
"detail": "transitive set not separable from development and test dependencies in this scope",
"points": 0,
"status": "excluded",
"details": [
{
"code": "advisories_scope_not_separable",
"params": {}
}
],
"max_points": 25
},
{
"key": "no_advisories_left_outstanding",
"name": "No advisories left outstanding",
"detail": "no advisory carries a publication date",
"points": 0,
"status": "excluded",
"details": [
{
"code": "advisories_no_publication_date",
"params": {}
}
],
"max_points": 40
}
]
},
{
"key": "malicious_dependencies",
"band": "excellent",
"name": "Malicious dependencies",
"note": null,
"notes": [],
"value": 100,
"inputs": {
"source": "osv",
"meaning": "reported as a malicious package by the OpenSSF corpus; the remedy is removal or moving off the compromised name, never an upgrade of the same artifact. Versions the registry has since pulled are listed but not scored",
"packages": [],
"red_flag": false,
"assessed_packages": 5,
"malicious_packages": 0,
"direct_malicious_packages": 0,
"withdrawn_malicious_packages": 0,
"installable_malicious_packages": 0
},
"components": [
{
"key": "no_dependency_reported_as_a_malicious_package",
"name": "No dependency reported as a malicious package",
"detail": "no dependency is reported as a malicious package",
"points": 100,
"status": "met",
"details": [
{
"code": "no_malicious_dependencies",
"params": {}
}
],
"max_points": 100
}
]
},
{
"key": "high_risk_jurisdiction_exposure",
"band": "excellent",
"name": "High-Risk Jurisdiction Exposure",
"note": "Only high-confidence self-published location evidence affects this multiplier. Ambiguous matches are review-only; country evidence is not proof of nationality, citizenship, legal registration, malicious intent, or sanctions status.",
"notes": [
{
"code": "jurisdiction_evidence_limits",
"params": {}
}
],
"value": 100,
"inputs": {
"meaning": "self-published location evidence; not nationality or citizenship",
"red_flag": false,
"exposures": [],
"policy_countries": [
"Russia",
"Iran",
"North Korea"
],
"review_only_matches": 0,
"assessed_self_published_locations": 13
},
"components": [
{
"key": "policy_exposure_multiplier",
"name": "Policy exposure multiplier",
"detail": "no confirmed policy-scope location match",
"points": 100,
"status": "met",
"details": [
{
"code": "jurisdiction_no_match",
"params": {}
}
],
"max_points": 100
}
]
}
],
"description": "Are visible security and supply-chain practices strong, with no malicious dependency and no unresolved high-risk jurisdiction exposure?"
},
{
"key": "ai_readiness",
"band": "moderate",
"name": "AI Readiness",
"value": 62,
"weight": 0,
"metrics": [
{
"key": "ai_agent_context",
"band": "at_risk",
"name": "Agent context & guidance",
"note": null,
"notes": [],
"value": 34,
"inputs": {
"has_llms_txt": false,
"legible_history_share": 0.636,
"agent_instruction_files": [],
"agent_instruction_max_bytes": null
},
"components": [
{
"key": "agent_instructions",
"name": "Agent instructions",
"detail": "no CLAUDE.md / AGENTS.md / editor rules",
"points": 0,
"status": "missed",
"details": [
{
"code": "no_agent_instructions",
"params": {}
}
],
"max_points": 45
},
{
"key": "machine_readable_docs_llms_txt",
"name": "Machine-readable docs (llms.txt)",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 15
},
{
"key": "legible_commit_history",
"name": "Legible commit history",
"detail": "63 of 99 human commits state their intent (structured subject or explanatory body)",
"points": 33.9,
"status": "partial",
"details": [
{
"code": "legible_history",
"params": {
"legible": 63,
"sampled": 99
}
}
],
"max_points": 40
}
]
},
{
"key": "ai_verify_loop",
"band": "moderate",
"name": "Verify loop (build / test / typecheck)",
"note": null,
"notes": [],
"value": 69,
"inputs": {
"has_nix": false,
"has_tests": true,
"lockfiles": [
"go.sum"
],
"has_dockerfile": false,
"typed_language": true,
"bootstrap_files": [
"v2/Makefile",
"v2/v1compat/Makefile"
],
"has_devcontainer": false,
"has_linter_config": false,
"typecheck_configs": [],
"agent_commit_share": 0,
"toolchain_manifests": [
"v2/go.mod"
],
"dependency_bot_commit_share": 0.01
},
"components": [
{
"key": "one_command_bootstrap",
"name": "One-command bootstrap",
"detail": "v2/Makefile, v2/v1compat/Makefile",
"points": 18,
"status": "met",
"details": [
{
"code": "file_list",
"params": {
"files": "v2/Makefile, v2/v1compat/Makefile"
}
}
],
"max_points": 18
},
{
"key": "automated_tests",
"name": "Automated tests",
"detail": null,
"points": 22,
"status": "met",
"details": [],
"max_points": 22
},
{
"key": "lint_format_config",
"name": "Lint / format config",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 11
},
{
"key": "static_type_checking",
"name": "Static type checking",
"detail": "Go (statically typed)",
"points": 11,
"status": "met",
"details": [
{
"code": "statically_typed_language",
"params": {
"language": "Go"
}
}
],
"max_points": 11
},
{
"key": "reproducible_environment",
"name": "Reproducible environment",
"detail": "lockfile",
"points": 10,
"status": "met",
"details": [
{
"code": "file_list",
"params": {
"files": "lockfile"
}
}
],
"max_points": 10
},
{
"key": "demonstrated_agent_practice",
"name": "Demonstrated agent practice",
"detail": "no agent-authored commits among the last 100",
"points": 0,
"status": "missed",
"details": [
{
"code": "no_agent_authored_commits",
"params": {
"sampled": 100
}
}
],
"max_points": 10
},
{
"key": "automated_maintenance",
"name": "Automated maintenance",
"detail": "1 of the last 100 commits are automated dependency updates",
"points": 8,
"status": "met",
"details": [
{
"code": "dependency_bot_commits",
"params": {
"count": 1,
"sampled": 100
}
}
],
"max_points": 8
},
{
"key": "openssf_scorecard_pinned_dependencies",
"name": "OpenSSF Scorecard: Pinned-Dependencies",
"detail": "dependency not pinned by hash detected -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 10
}
]
},
{
"key": "ai_code_legibility",
"band": "excellent",
"name": "Code legibility for models",
"note": null,
"notes": [],
"value": 100,
"inputs": {
"primary_language": "Go",
"largest_source_bytes": 31695,
"source_files_sampled": 66,
"oversized_source_files": 0
},
"components": [
{
"key": "type_checkable_code",
"name": "Type-checkable code",
"detail": "Go (statically typed)",
"points": 45,
"status": "met",
"details": [
{
"code": "statically_typed_language",
"params": {
"language": "Go"
}
}
],
"max_points": 45
},
{
"key": "manageable_file_sizes",
"name": "Manageable file sizes",
"detail": "0/66 source files over 60KB",
"points": 55,
"status": "met",
"details": [
{
"code": "oversized_source_files",
"params": {
"kb": 60,
"sampled": 66,
"oversized": 0
}
}
],
"max_points": 55
}
]
}
],
"description": "How well is the repo equipped to be developed and maintained with AI coding agents? An independent, experimental badge — weight 0.0, so it is surfaced on its own and does not affect the overall health score."
}
],
"metrics_version": "1.13.0"
},
"warnings": [],
"report_type": "repository",
"generated_at": "2026-07-22T07:18:40.889999Z",
"schema_version": "0.26.0",
"badge_url": "https://raw.githubusercontent.com/inspect-software/badges/main/v1/n/nats-io/jwt.svg",
"full_name": "nats-io/jwt",
"license_state": "standard",
"license_spdx": "Apache-2.0"
}
Registros relacionados
Repositorios inspeccionados que comparten etiquetas de catálogo o ecosistemas con nats-io/jwt. Leer en paralelo →
Las puntuaciones son señales, no garantías. Reflejan prácticas públicamente visibles en GitHub; no son una auditoría de código ni una garantía de seguridad.
Los datos ausentes se excluyen y los pesos se renormalizan; nunca se puntúan como cero. La metodología es versionada y abierta: métricas v1.13.0, esquema v0.26.0 — metodología completa · wiki de métricas.
