nats-io/jwt holds a health index of 61 out of 100, placing it in the Moderate band. It scores highest on Sustainability & Governance (78/100) and lowest on Community & Adoption (48/100). It was last updated 49 days ago. 2 contributors account for most of its recent work.
61
overall / 100
Moderate
Software health index
Metrics are grouped into weighted categories on one standardized 1–100 scale. Overall starts as their weighted mean; when public evidence triggers the High-Risk Jurisdiction Policy, the rating is adjusted and receives an At risk ceiling of 49. AI Readiness sits outside the overall score.
61
Excellent85-100Exemplary; meets essentially all checked criteria
Good70-84Healthy; minor gaps
Moderate50-69Acceptable with notable gaps; review recommended
At risk30-49Significant weaknesses; adoption warrants caution
Critical1-29Severe problems (abandoned, single-maintainer, no hygiene)
Score profile
Each axis is a category. The shape matters more than the average — a healthy subject fills the whole shape, while a spike-and-crater profile means strength in one dimension is masking risk in another.
Direct dependencies free of known advisories — no direct dependency carries a known advisory
0/25
Indirect dependencies free of known advisories — transitive set not separable from development and test dependencies in this scope
0/40
No advisories left outstanding — no advisory carries a publication date
Inputs used
source
osv
advisories
3
affected_packages
2
assessed_packages
5
unassessed_packages
0
affected_by_severity
critical 1, unknown 1
direct_affected_packages
0
Excluded from scoring (no data or not applicable): Indirect dependencies free of known advisories, No advisories left outstanding. Remaining weights renormalized. Matched 5 resolved dependencies against OSV. This repository publishes no package the index resolves, so the repository dependency graph was assessed instead. That graph mixes development and test pins with shipped dependencies, so only the declared runtime dependencies are scored; transitive findings are reported as context and excluded from the score. Reachability is not analyzed.
How well is the repo equipped to be developed and maintained with AI coding agents? An independent, experimental badge — weight 0.0, so it is surfaced on its own and does not affect the overall health score.
Manageable file sizes — 0/66 source files over 60KB
Inputs used
primary_language
Go
largest_source_bytes
31,695
source_files_sampled
66
oversized_source_files
0
Key facts
88GitHub stars
16contributors
11commits, last 12 months
49days since last push
46releases
2bus factor
13open issues
Gopackage ecosystems
More detail
Star and fork history 88 ★ / 37 ⇿
88Stars
37Forks
46Releases
When each star and fork was added, collected from GitHub and bucketed by day. Cumulative growth sits directly above the daily additions it is made of, so the two read against each other: steady organic accretion looks nothing like an abrupt, short-lived burst. Where that difference is measurable, it is reported as growth authenticity.
Major 1Minor 13Patch 32
Each point covers 8 days.
OpenSSF Scorecard 5.6 / 10
5.6aggregate
Independent, tool-agnostic security assessment from the open-source OpenSSF Scorecard. Each check rewards a security practice, not a specific vendor's tool. Checks Scorecard could not determine are marked n/a and excluded from the security score (never counted as zero).Scorecard v5.5.0 · 2026-07-22 07:18 UTC
Full resolved dependency set from the GitHub dependency graph: 2 direct and 3 indirect (transitive) packages. The transitive closure is complete when the repository commits a lockfile.
Registry
Package
Version
Relation
Go
github.com/nats-io/nkeys
0.3.0
direct
Go
github.com/nats-io/nkeys
v0.4.16
direct
Go
github.com/nats-io/jwt
1.2.2
indirect
Go
golang.org/x/crypto
v0.52.0
indirect
Go
golang.org/x/sys
v0.45.0
indirect
Dependency advisories 2
This repository publishes no package the index resolves, so its own dependency graph was assessed — 5 packages, which also include development and test pins that never ship: 2 carry known advisories, of which 0 are direct.
Package
Version
Relation
Severity
Advisories
Fixed in
github.com/nats-io/jwt
1.2.2
indirect
critical
2
2.0.1
golang.org/x/crypto
v0.52.0
indirect
unknown
1
—
An advisory means the version recorded in the dependency graph falls inside an advisory’s affected range. Reachability is not analysed, and the graph includes development and test pins — a finding may concern tooling rather than shipped software.
Raw JSON report machine-readable
{
"data": {
"repo": {
"topics": [],
"is_fork": false,
"size_kb": 608,
"has_wiki": true,
"homepage": null,
"languages": {
"Go": 448290,
"Shell": 977,
"Makefile": 491
},
"pushed_at": "2026-06-02T13:54:22Z",
"created_at": "2018-08-22T16:25:50Z",
"owner_type": "Organization",
"updated_at": "2026-06-07T18:00:56Z",
"description": "JWT tokens signed using NKeys for Ed25519 for the NATS ecosystem.",
"is_archived": false,
"is_disabled": false,
"license_spdx": "Apache-2.0",
"default_branch": "main",
"license_spdx_raw": "Apache-2.0",
"primary_language": "Go",
"significant_languages": [
"Go"
]
},
"owner": {
"blog": "https://nats.io",
"name": "NATS - The Edge & Cloud Native Messaging System",
"type": "Organization",
"login": "nats-io",
"company": null,
"location": null,
"followers": 2424,
"avatar_url": "https://avatars.githubusercontent.com/u/10203055?v=4",
"created_at": "2014-12-16T02:38:52Z",
"is_verified": null,
"public_repos": 131,
"account_age_days": 4236
},
"license": {
"state": "standard",
"spdx_id": "Apache-2.0",
"raw_spdx": "Apache-2.0",
"file_present": true,
"scorecard_found": true,
"profile_has_license": true
},
"activity": {
"releases": [
{
"tag": "v2.8.2",
"kind": "patch",
"published_at": "2026-06-02T13:54:22Z"
},
{
"tag": "v2.8.1",
"kind": "patch",
"published_at": "2026-03-17T13:04:32Z"
},
{
"tag": "v2.8.0",
"kind": "minor",
"published_at": "2025-08-08T14:19:25Z"
},
{
"tag": "v2.7.4",
"kind": "patch",
"published_at": "2025-04-16T14:31:01Z"
},
{
"tag": "v2.7.3",
"kind": "patch",
"published_at": "2024-12-13T16:49:52Z"
},
{
"tag": "v2.7.2",
"kind": "patch",
"published_at": "2024-10-09T20:01:27Z"
},
{
"tag": "v2.7.1",
"kind": "patch",
"published_at": "2024-10-09T19:37:43Z"
},
{
"tag": "v2.7.0",
"kind": "minor",
"published_at": "2024-09-17T17:05:09Z"
},
{
"tag": "v2.6.0",
"kind": "minor",
"published_at": "2024-09-10T23:13:08Z"
},
{
"tag": "v2.5.8",
"kind": "patch",
"published_at": "2024-07-05T14:34:37Z"
},
{
"tag": "v2.5.7",
"kind": "patch",
"published_at": "2024-05-09T16:09:54Z"
},
{
"tag": "v2.5.6",
"kind": "patch",
"published_at": "2024-04-18T15:14:55Z"
},
{
"tag": "v2.5.5",
"kind": "patch",
"published_at": "2024-02-22T16:58:21Z"
},
{
"tag": "v2.5.4",
"kind": "patch",
"published_at": "2024-02-15T17:09:38Z"
},
{
"tag": "v2.5.3",
"kind": "patch",
"published_at": "2023-10-31T16:16:39Z"
},
{
"tag": "v2.5.2",
"kind": "patch",
"published_at": "2023-09-18T15:55:58Z"
},
{
"tag": "v2.5.1",
"kind": "patch",
"published_at": "2023-09-18T15:44:06Z"
},
{
"tag": "v2.5.0",
"kind": "minor",
"published_at": "2023-08-21T16:32:42Z"
},
{
"tag": "v2.4.1",
"kind": "patch",
"published_at": "2023-03-24T16:04:04Z"
},
{
"tag": "v2.4.0",
"kind": "minor",
"published_at": "2023-03-21T15:31:28Z"
},
{
"tag": "v2.3.0",
"kind": "minor",
"published_at": "2022-06-28T20:52:42Z"
},
{
"tag": "v2.2.0",
"kind": "minor",
"published_at": "2021-11-15T18:05:31Z"
},
{
"tag": "v2.1.0",
"kind": "minor",
"published_at": "2021-09-28T20:09:40Z"
},
{
"tag": "v2.0.3",
"kind": "patch",
"published_at": "2021-08-02T15:43:13Z"
},
{
"tag": "v2.0.2",
"kind": "patch",
"published_at": "2021-05-04T16:10:13Z"
},
{
"tag": "v2.0.1",
"kind": "patch",
"published_at": "2021-03-14T23:13:04Z"
},
{
"tag": "v2.0.0",
"kind": "major",
"published_at": "2021-03-14T19:53:51Z"
},
{
"tag": "v1.2.2",
"kind": "patch",
"published_at": "2020-11-30T16:49:20Z"
},
{
"tag": "v1.2.0",
"kind": "minor",
"published_at": "2020-10-30T23:40:28Z"
},
{
"tag": "v1.1.0",
"kind": "minor",
"published_at": "2020-10-21T15:51:26Z"
},
{
"tag": "v1.0.1",
"kind": "patch",
"published_at": "2020-05-29T19:52:32Z"
},
{
"tag": "v0.3.2",
"kind": "patch",
"published_at": "2019-11-14T21:48:39Z"
},
{
"tag": "v0.3.0",
"kind": "minor",
"published_at": "2019-09-20T17:04:31Z"
},
{
"tag": "v0.2.16",
"kind": "patch",
"published_at": "2019-09-18T15:07:30Z"
},
{
"tag": "v0.2.14",
"kind": "patch",
"published_at": "2019-08-14T16:24:45Z"
},
{
"tag": "v0.2.12",
"kind": "patch",
"published_at": "2019-07-24T20:08:40Z"
},
{
"tag": "v0.2.10",
"kind": "patch",
"published_at": "2019-07-16T13:10:53Z"
},
{
"tag": "v0.2.8",
"kind": "patch",
"published_at": "2019-06-21T16:36:23Z"
},
{
"tag": "v0.2.6",
"kind": "patch",
"published_at": "2019-05-22T14:19:08Z"
},
{
"tag": "v0.2.4",
"kind": "patch",
"published_at": "2019-04-18T17:58:28Z"
},
{
"tag": "v0.2.2",
"kind": "patch",
"published_at": "2019-04-11T23:37:05Z"
},
{
"tag": "v0.2.0",
"kind": "minor",
"published_at": "2019-04-11T20:49:26Z"
},
{
"tag": "v0.1.0",
"kind": "minor",
"published_at": "2019-04-09T23:41:13Z"
},
{
"tag": "v0.0.8",
"kind": "patch",
"published_at": "2018-12-13T04:28:38Z"
},
{
"tag": "v0.0.6",
"kind": "patch",
"published_at": "2018-12-08T02:04:24Z"
},
{
"tag": "v0.0.4",
"kind": "patch",
"published_at": "2018-12-04T18:47:52Z"
}
],
"recent_commits": [
{
"oid": "82017236da50e4a0173091105d82d46228b8dccf",
"body": null,
"is_bot": false,
"headline": "bumps (#251)",
"author_name": "Alberto Ricart",
"author_login": "aricart",
"committed_at": "2026-06-02T13:53:38Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "071a1dedb58e3da316084d650859d5cf6c00aaf2",
"body": "The nats-server will (only) enable JetStream on an account if `DiskStorage` and/or `MemoryStorage` is set to a non-zero value in the Account JWT Limits. This is due to legacy reasons and cannot be easily changed due to the global impact of already existing NATS clusters based on decentralized auth.\n\nIssue: https://github.com/nats-io/jwt/issues/249",
"is_bot": false,
"headline": "docs: how to enable/disable JetStream when creating AccountClaims (#250)",
"author_name": "Thobias Karlsson",
"author_login": "choufraise",
"committed_at": "2026-06-02T13:25:44Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "1e990c9a58a81981aca6da7efdc7c5b79314fea9",
"body": "* fix: added a check for the size of JWT token\n\nNote that now all JWTs are limited to 1MB - which may or not be breaking. Note that Generic JWTs could possibly have whatever size they want (this change doesn't affect GenericClaims)\n\nSigned-off-by: Alberto Ricart <alberto@synadia.com>",
"is_bot": false,
"headline": "fix: added a check for the size of JWT token (#248)",
"author_name": "Alberto Ricart",
"author_login": "aricart",
"committed_at": "2026-03-12T16:26:27Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "e6531afcdfe87a6d964693e59b1557bf3d32dfe4",
"body": "Signed-off-by: Alberto Ricart <alberto@synadia.com>",
"is_bot": false,
"headline": "fix: ensure that weighted mappings don't exceed 100 (#247)",
"author_name": "Alberto Ricart",
"author_login": "aricart",
"committed_at": "2026-03-11T19:13:06Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "4cbb6cce481caba30d91a020bc25be99f1d8a791",
"body": "This API is used by external tools to decorate seeds, in cases where they specify a bad input return an error\n\nSigned-off-by: Alberto Ricart <alberto@synadia.com>",
"is_bot": false,
"headline": "fix: make DecorateSeed more resilient in case of short input (#245)",
"author_name": "Alberto Ricart",
"author_login": "aricart",
"committed_at": "2026-03-11T16:36:41Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "4ee18c85bc5ed09dc41fb03b045f077bc3cdce93",
"body": "Signed-off-by: Alberto Ricart <alberto@synadia.com>",
"is_bot": false,
"headline": "ci: enable claude (#246)",
"author_name": "Alberto Ricart",
"author_login": "aricart",
"committed_at": "2026-03-11T16:12:49Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "169803d1a50f8a02e09aadf72195af3c5d716a80",
"body": "* bump dependencies, streamline test matrix\n\n* Go 1.24 vet flagged printf-style functions that passed non-constant strings as the format string\n\nSigned-off-by: Alberto Ricart <alberto@synadia.com>\n\n---------\n\nSigned-off-by: Alberto Ricart <alberto@synadia.com>",
"is_bot": false,
"headline": "bump dependencies, streamline test matrix (#244)",
"author_name": "Alberto Ricart",
"author_login": "aricart",
"committed_at": "2026-03-03T14:59:26Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "a3aa1012e08c00d189405a9313f75bed8ed84f8a",
"body": "…or the JWT provided. (#242)\n\nSigned-off-by: Alberto Ricart <alberto@synadia.com>",
"is_bot": false,
"headline": "added a check when generating creds that the specified key is valid f…",
"author_name": "Alberto Ricart",
"author_login": "aricart",
"committed_at": "2026-03-03T14:59:05Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "e4173126b32a711fcf1595d122a302ee22ff8d43",
"body": "nats-server already allows importing the same (service) subject from different account, while the jwt does not. This becomes an issue when you, for instance, source JetStreams from different accounts and need to import service `$JS.FC.>` from both. Before, this could be solved by importing e.g. `$JS\n[…]\ns-server/pull/6704\nRelated: https://github.com/nats-io/nats-server/issues/6547\nRelated: https://github.com/nats-io/nats-server/issues/6431\n\nSigned-off-by: Thobias Karlsson <thobias.karlsson@gmail.com>",
"is_bot": false,
"headline": "fix: allow import of same service subject from different accounts (#243)",
"author_name": "Thobias Karlsson",
"author_login": "choufraise",
"committed_at": "2026-02-27T22:00:12Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "a2c583b4f3719b35832df7b802db6efe1c6f066e",
"body": "Signed-off-by: Alberto Ricart <alberto@synadia.com>",
"is_bot": false,
"headline": "update build status badge to use GitHub Actions (#240)",
"author_name": "Alberto Ricart",
"author_login": "aricart",
"committed_at": "2025-08-08T14:18:41Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "953e18bb32057b7d5a08fc1a966915a9e76c9bea",
"body": "This would be used in the server to enforce that a user connects\nthrough a trusted proxy.\n\nSigned-off-by: Ivan Kozlovic <ivan@synadia.com>",
"is_bot": false,
"headline": "[ADDED] `ProxyRequired` user claims property (#239)",
"author_name": "Ivan Kozlovic",
"author_login": "kozlovic",
"committed_at": "2025-08-08T14:03:00Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "28e31bd445aeebe6a0bb93902baf91e43036c22c",
"body": "Signed-off-by: Alberto Ricart <alberto@synadia.com>",
"is_bot": false,
"headline": "bump golang.org/x/crypto fixing vulnerability (#238)",
"author_name": "Alberto Ricart",
"author_login": "aricart",
"committed_at": "2025-04-16T14:29:44Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "13f7264e0ea0eb7307d50ce4c117a4ece4f99959",
"body": "[ci skip]",
"is_bot": false,
"headline": "fix the link to go doc to go to v2 (#237)",
"author_name": "Alberto Ricart",
"author_login": "aricart",
"committed_at": "2024-12-19T17:10:44Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "a768c381b3ed3c634bfa6738ba34a4652456986d",
"body": "Upgraded `github.com/nats-io/nkeys` to v0.4.9, `golang.org/x/crypto` to v0.31.0, and `golang.org/x/sys` to v0.28.0. These updates ensure compatibility with the latest changes and include potential bug fixes and improvements. No functional changes were introduced in the codebase.\r\n\r\nSigned-off-by: Alberto Ricart <alberto@synadia.com>",
"is_bot": false,
"headline": "Update dependencies in go.mod and go.sum (#236)",
"author_name": "Alberto Ricart",
"author_login": "aricart",
"committed_at": "2024-12-13T16:48:25Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "698cd7e2aafd4e8fedefbdd5879dcade64c855eb",
"body": "* feat: Claims interface now has `EncodeWithSigner(nkeys.KeyPair`, fn: SignFn)` where signing can be delegated to a function. The `type SignFn func(pub string, data []byte) ([]byte, error)` is provided with the public key whose matching private key should be used to sign the provided payload.\r\n\r\nTh\n[…]\ning a JWT.\r\n\r\nSigned-off-by: Alberto Ricart <alberto@synadia.com>\r\n\r\n* go mod\r\n\r\nSigned-off-by: Alberto Ricart <alberto@synadia.com>\r\n\r\n---------\r\n\r\nSigned-off-by: Alberto Ricart <alberto@synadia.com>",
"is_bot": false,
"headline": "Allow external signing of JWTs (#234)",
"author_name": "Alberto Ricart",
"author_login": "aricart",
"committed_at": "2024-12-13T16:42:21Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "f9c7776a413358752942d078361ee8d13f15e2f4",
"body": "* Revert \"[CHANGE] Tags are now case-sensitive (#225)\"\r\n\r\nThis reverts commit de1f16b5781c771513bdc8de201e86bfa76f0325.\r\n\r\n* retract 2.7.0\r\n\r\nSigned-off-by: Alberto Ricart <alberto@synadia.com>\r\n\r\n---------\r\n\r\nSigned-off-by: Alberto Ricart <alberto@synadia.com>",
"is_bot": false,
"headline": "Retract case-insensitive tag functionality (#233)",
"author_name": "Alberto Ricart",
"author_login": "aricart",
"committed_at": "2024-10-09T19:35:56Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "18a60d6f7f84c2774c29cb926fe421df2deb5bc0",
"body": null,
"is_bot": false,
"headline": "[CHANGE] removing a tag that doesn't exist results in an error (#228)",
"author_name": "Alberto Ricart",
"author_login": "aricart",
"committed_at": "2024-09-17T15:32:41Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "de1f16b5781c771513bdc8de201e86bfa76f0325",
"body": "* [CHANGE] Tags (--tag and --rm-tag) are now case-sensitive. Previous versions of the library lowercased all tags. Now tags such as \"A\" and \"a\" are different.",
"is_bot": false,
"headline": "[CHANGE] Tags are now case-sensitive (#225)",
"author_name": "Alberto Ricart",
"author_login": "aricart",
"committed_at": "2024-09-17T14:09:22Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "2d9ece2f3a7a987c745e4f6d7d6ba02a74756577",
"body": "…ll need to perform some level of validation (#224)\n\n* Added validation to cluster traffic - as downstream tools like nsc will need to perform some level of validation\r\n* removed parsing of account for cluster traffic as that option will be delayed.",
"is_bot": false,
"headline": "Added validation to cluster traffic - as downstream tools like nsc wi…",
"author_name": "Alberto Ricart",
"author_login": "aricart",
"committed_at": "2024-09-13T16:28:03Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "4445fcd6be061ef9a37e02fdf5988bd80adb7d21",
"body": null,
"is_bot": false,
"headline": "Merge pull request #223 from nats-io/neil/accountnrg",
"author_name": "Neil",
"author_login": "neilalexander",
"committed_at": "2024-09-10T22:17:29Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "1378f5922cddb43d7776da60f100520aee0a6c59",
"body": "Signed-off-by: Neil Twigg <neil@nats.io>",
"is_bot": false,
"headline": "Fix lint errors, probably from new staticcheck version",
"author_name": "Neil Twigg",
"author_login": "neilalexander",
"committed_at": "2024-09-10T21:37:40Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "2e1251e5109465388c40eef4d5224c42edd03d11",
"body": "Signed-off-by: Neil Twigg <neil@nats.io>",
"is_bot": false,
"headline": "Update CI to use latest stable Go version",
"author_name": "Neil Twigg",
"author_login": "neilalexander",
"committed_at": "2024-09-10T09:32:32Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "bc9fb5fb3c2f2775b5398a43d401dc13a5668866",
"body": "For supporting nats-io/nats-server#5466.\n\nFor now expected values would be:\n* `\"system\"` - use the system account (default, as today)\n* `\"owner\"` - use the same account that owns the asset\n* `\"account:ACCNAME\"` - use a third specified `ACCNAME`\n\nSigned-off-by: Neil Twigg <neil@nats.io>",
"is_bot": false,
"headline": "Add `ClusterTraffic` to account claims",
"author_name": "Neil Twigg",
"author_login": "neilalexander",
"committed_at": "2024-09-10T09:25:22Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "ff68a3bc6bb70f166b35232159cc9c96aaca4375",
"body": "…222)\n\nFixes https://github.com/nats-io/nsc/issues/657",
"is_bot": false,
"headline": "[FIX] accounting for weights in cluster should be handled separate (#…",
"author_name": "Alberto Ricart",
"author_login": "aricart",
"committed_at": "2024-07-05T14:31:12Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "41dad79143e9cff55e4bde8af4df7a40ad49786c",
"body": "Added `ConnectionTypeInProcess` to the `UserPermissionLimits.AllowedConnectionTypes`\r\nlist of possible types.\r\n\r\nSigned-off-by: Ivan Kozlovic <ivan@synadia.com>",
"is_bot": false,
"headline": "[ADDED] Connection type \"in process\" (#221)",
"author_name": "Ivan Kozlovic",
"author_login": "kozlovic",
"committed_at": "2024-05-09T16:08:51Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "1f3ff3245e5ebd478f98bd584ad1636430246c95",
"body": "…tween same name roles (#220)",
"is_bot": false,
"headline": "[FEAT] added a description to a scope role to enable tools discern be…",
"author_name": "Alberto Ricart",
"author_login": "aricart",
"committed_at": "2024-04-18T15:09:38Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "c2d30e2ffc632a1ea64030467e5a40e02e4158be",
"body": "When an account has a `Trace` field set with a `Destination`, if\r\nan incoming message has a `traceparent` header with proper flag\r\nindicating that the message should be trace, the `Sampling` integer\r\n(value in the range of [1..100]) allows tracing only a random\r\nsample of messages. The server will p\n[…]\nm number below 100\r\nand if that number is lower or equal to this `Sampling` value\r\nthen the trace will trigger. If above, the trace will not trigger.\r\n\r\nSigned-off-by: Ivan Kozlovic <ivan@synadia.com>",
"is_bot": false,
"headline": "[ADDED] Sampling in MsgTrace structure (#219)",
"author_name": "Ivan Kozlovic",
"author_login": "kozlovic",
"committed_at": "2024-02-22T16:57:27Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "38e07c55c548c54df98b709eef943fb1cffc28b1",
"body": "Signed-off-by: Caleb Lloyd <caleb@synadia.com>",
"is_bot": false,
"headline": "add omitempty to authorization.auth_users (#218)",
"author_name": "Caleb Lloyd",
"author_login": "caleblloyd",
"committed_at": "2024-02-16T21:07:39Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "069ee3e448b5443e77f7906d391bf7761e662dcb",
"body": null,
"is_bot": false,
"headline": "[UPDATE] update deps (#217)",
"author_name": "Alberto Ricart",
"author_login": "aricart",
"committed_at": "2024-02-15T17:08:56Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "ed3fbfa49a16cf4aced84aed9d527be532730ad4",
"body": "This is needed for the NATS Server distributed message tracing\r\nfeature.\r\n\r\nThis PR updates validation of a Subject to check for `.` at the\r\nfirst or last position and consecutive ones.\r\n\r\nThe validation of the Account.TraceDest also checks that the\r\ndestination does not have wildcards since this is\n[…]\nf-by: Ivan Kozlovic <ivan@synadia.com>\r\n\r\n* Added container for message trace options\r\n\r\nSigned-off-by: Ivan Kozlovic <ivan@synadia.com>\r\n\r\n---------\r\n\r\nSigned-off-by: Ivan Kozlovic <ivan@synadia.com>",
"is_bot": false,
"headline": "[ADDED] Import/Export.AllowTrace and Account.TraceDest (#216)",
"author_name": "Ivan Kozlovic",
"author_login": "kozlovic",
"committed_at": "2024-02-15T16:56:43Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "f923b10c0be0c8d24fdab7208733504c4887def5",
"body": "Bumps [golang.org/x/crypto](https://github.com/golang/crypto) from 0.14.0 to 0.17.0.\r\n- [Commits](https://github.com/golang/crypto/compare/v0.14.0...v0.17.0)\r\n\r\n---\r\nupdated-dependencies:\r\n- dependency-name: golang.org/x/crypto\r\n dependency-type: indirect\r\n...\r\n\r\nSigned-off-by: dependabot[bot] <support@github.com>\r\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
"is_bot": true,
"headline": "Bump golang.org/x/crypto from 0.14.0 to 0.17.0 in /v2 (#214)",
"author_name": "dependabot[bot]",
"author_login": "dependabot[bot]",
"committed_at": "2023-12-20T10:48:56Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "457367366f2ff72a3fefeed38b56a1da281476fb",
"body": null,
"is_bot": false,
"headline": "[BUMP] bump nkeys (#212)",
"author_name": "Alberto Ricart",
"author_login": "aricart",
"committed_at": "2023-10-31T16:15:48Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "012e7a3a42dce49e62a7f14662461ecf14a8d5fc",
"body": "…operations (#209)",
"is_bot": false,
"headline": "[FEAT] relax protocol names to allow for ws/wss for account resolver …",
"author_name": "Alberto Ricart",
"author_login": "aricart",
"committed_at": "2023-10-24T22:36:25Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "4b4f5502a8b3acb9fe78ecc86814dd3ec2c20a90",
"body": "… (#208)\n\nFix #200",
"is_bot": false,
"headline": "[FEAT] added convenience API GetTags() to Account/Operator/UserClaims…",
"author_name": "Alberto Ricart",
"author_login": "aricart",
"committed_at": "2023-09-18T15:52:19Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "a3a24780d2f287e5149de20aa40158045afbe868",
"body": "The discussions tab needs to be enabled.",
"is_bot": false,
"headline": "Fix issue config discussions link (#205)",
"author_name": "Byron Ruth",
"author_login": "bruth",
"committed_at": "2023-08-21T20:38:34Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "75d6d8701e5ca225078e10cf93e2e3ff98d5ecad",
"body": "Signed-off-by: Byron Ruth <byron@nats.io>",
"is_bot": false,
"headline": "Add issue forms (#204)",
"author_name": "Byron Ruth",
"author_login": "bruth",
"committed_at": "2023-08-21T20:26:01Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "44fe206dcc2696bfe1d1d53ac8da553caeaf26a0",
"body": null,
"is_bot": false,
"headline": "sort signing keys on marshal (#203)",
"author_name": "Seth Back",
"author_login": "sethjback",
"committed_at": "2023-08-21T20:24:27Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "c4f1fd0ca5889c20ba2ae5cca0e88d1cf964f60c",
"body": "…r setup that actually runs on a server (#198)",
"is_bot": false,
"headline": "[DOC] changed the main example to show a basic operator->account->use…",
"author_name": "Alberto Ricart",
"author_login": "aricart",
"committed_at": "2023-08-21T16:28:50Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "78a1bd080817e10534d03583c3e0c2569e42073e",
"body": "remove wildcard validation from mappings",
"is_bot": false,
"headline": "Merge pull request #202 from haisum/main",
"author_name": "Haisum Mussawir",
"author_login": null,
"committed_at": "2023-08-21T16:28:36Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "96b5387a7afcb092eeac24126f781fa628af2383",
"body": "Signed-off-by: haisum <haisum@synadia.com>",
"is_bot": false,
"headline": "remove wildcard validation from mappings",
"author_name": "haisum",
"author_login": null,
"committed_at": "2023-08-18T19:54:37Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "535a7674fb6149ba5d35297b3125b337ee281e13",
"body": "* [FEAT] allow callout service to generate users for any account, added constant `AnyAccount` for wildcard",
"is_bot": false,
"headline": "[FEAT] allow callout service to generate users for any account (#197)",
"author_name": "Alberto Ricart",
"author_login": "aricart",
"committed_at": "2023-03-24T16:02:18Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "11e1fdb1415310764b7678bc31a6e63c53e99edd",
"body": null,
"is_bot": false,
"headline": "Bump version for imminent release: 2.4.0",
"author_name": "Phil Pennock",
"author_login": "philpennock",
"committed_at": "2023-03-16T21:45:09Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "7018e50b6fccc7bda45d4bc692a1873f33afa879",
"body": "simplify AuthorizationResponse",
"is_bot": false,
"headline": "Merge pull request #189 from nats-io/simplify-response",
"author_name": "Waldemar Quevedo",
"author_login": "wallyqs",
"committed_at": "2023-03-16T21:41:56Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "7b33986cffa3bd7df2277d853249c385edf9315f",
"body": "- [FIX] fixed the DidSign for account claims to return true only if the signing key and the issuer account constraints met - this api is only used by nsc\n- [TEST] fixed test that used improper user JWT\n- [TEST] fixed tests that expected failure, but were out of order with a following test that now triggers the error\n\nrequired authorization claims subject to be the user public key from the request\nrequired audience in the authorization claim subject to be the public server key from the request",
"is_bot": false,
"headline": "added additional scrutiny to DidSign in the case of signing keys (#190)",
"author_name": "aricart",
"author_login": "aricart",
"committed_at": "2023-03-16T21:32:39Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "e3e39d66ad1c45611b8b058a0170b765f788d692",
"body": "Move all the top-level go code into v2/v1compat and explicitly refer to that,\r\nand with all other go.??? files removed, so that from the go module handling\r\nperspective, this is all in one Go module. This will prevent v1 code\r\nreferences from going out to Go modules and fetching old vulnerable code\n[…]\nvisible to tests in other software, such as nats-io/nats-account-server too.\r\n\r\nThis PR changes modules, imports, and CI test invocations, but makes no changes\r\nto the Go functionality of the library.",
"is_bot": false,
"headline": "overhaul jwt v2 and v1 inter-tangling (#195)",
"author_name": "Phil Pennock",
"author_login": "philpennock",
"committed_at": "2023-03-16T21:28:27Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "8d1c62fe17b1306a3fe18118b810fe45736e9d9e",
"body": "- [FIX] fixed the DidSign for account claims to return true only if the signing key and the issuer account constraints met - this api is only used by nsc\r\n- [TEST] fixed test that used improper user JWT\r\n- [TEST] fixed tests that expected failure, but were out of order with a following test that now triggers the error",
"is_bot": false,
"headline": "added additional scrutiny to DidSign in the case of signing keys (#190)",
"author_name": "Alberto Ricart",
"author_login": "aricart",
"committed_at": "2023-02-15T18:58:59Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "f135d4a5a6f99ff2705b7f1a8aca2949da33f2bb",
"body": "* [CI] github actions",
"is_bot": false,
"headline": "[chore] migrate ci to gha (#191)",
"author_name": "Alberto Ricart",
"author_login": "aricart",
"committed_at": "2023-02-15T18:49:09Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "bdf40fa3627bc5cd1f378bb94ba8ab26768a9c70",
"body": "Authorization Response and Server ID additions",
"is_bot": false,
"headline": "Merge pull request #186 from nats-io/auth-updates",
"author_name": "Derek Collison",
"author_login": "derekcollison",
"committed_at": "2022-12-27T17:05:42Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "146945d1bedc8ec8d8cda0cee8b20d2960174583",
"body": "…to a NATS server.\n\nAlso added in version, cluster and tags to the server info for an authorization request.\n\nSigned-off-by: Derek Collison <derek@nats.io>",
"is_bot": false,
"headline": "Added in a formal authorization response for propagating errors back …",
"author_name": "Derek Collison",
"author_login": "derekcollison",
"committed_at": "2022-12-26T22:45:25Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "ff7baa9e5e73489e49a6cf6062d26fc0ef0e11d9",
"body": "Force authorization requests to have a public user nkey.",
"is_bot": false,
"headline": "Merge pull request #185 from nats-io/user-nkey",
"author_name": "Derek Collison",
"author_login": "derekcollison",
"committed_at": "2022-12-14T23:34:35Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "1ddeceefd4542ce8909642ac83b71b751b329bc5",
"body": "This will be required for the user claim sent back from the authorization service to avoid replay attacks.\n\nSigned-off-by: Derek Collison <derek@nats.io>",
"is_bot": false,
"headline": "Force authorization requests to have a public user nkey.",
"author_name": "Derek Collison",
"author_login": "derekcollison",
"committed_at": "2022-12-14T21:33:16Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "a07c95dfa9e1a706fea0dadeb247a382ef6a5b54",
"body": "[ADDED] Xkeys support",
"is_bot": false,
"headline": "Merge pull request #182 from nats-io/xkeys",
"author_name": "Derek Collison",
"author_login": "derekcollison",
"committed_at": "2022-12-06T12:51:46Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "317149c3c5db01ea98dd1a5dfed4c8800826c40c",
"body": "The ServerID will now optionally include the public XKey from the server.\nAccountClaims can specify a public XKey for ExternalAuthorization that will force the server's authorization requests to be encrypted.\n\nNote go.mod changes are temporary to pull in staged xkeys PR. Once merged I will update.\n\nSigned-off-by: Derek Collison <derek@nats.io>",
"is_bot": false,
"headline": "Added in XKey support.",
"author_name": "Derek Collison",
"author_login": "derekcollison",
"committed_at": "2022-12-06T00:58:33Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "ec09c3a122ff202ed4c73f5fb272f881b36d45f9",
"body": "Some Updates",
"is_bot": false,
"headline": "Merge pull request #183 from nats-io/updates",
"author_name": "Derek Collison",
"author_login": "derekcollison",
"committed_at": "2022-12-05T23:02:55Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "c1f61ea53f7806b98d8be07917c91d70b84fe92a",
"body": "Signed-off-by: Derek Collison <derek@nats.io>",
"is_bot": false,
"headline": "Update travis.tml to go 1.19 and 1.18, update go modules version",
"author_name": "Derek Collison",
"author_login": "derekcollison",
"committed_at": "2022-12-05T22:58:02Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "4f532654e69662a82fab006a908f689970d2f79b",
"body": "Signed-off-by: Derek Collison <derek@nats.io>",
"is_bot": false,
"headline": "Remove ioutil",
"author_name": "Derek Collison",
"author_login": "derekcollison",
"committed_at": "2022-12-05T14:32:26Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "44198ae9f41fae1d579cc9674d28f37005c7c17e",
"body": "Signed-off-by: Derek Collison <derek@nats.io>",
"is_bot": false,
"headline": "go vet and go fmt",
"author_name": "Derek Collison",
"author_login": "derekcollison",
"committed_at": "2022-12-05T14:25:30Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "83b58fd548384c16c3101c22e13da899d2361a63",
"body": "…ecified (#181)",
"is_bot": false,
"headline": "[FIX] added validation where auth user is required if accounts are sp…",
"author_name": "Alberto Ricart",
"author_login": "aricart",
"committed_at": "2022-12-02T18:04:56Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "31baa5546134db61e7c2f6242aa3f1b873ec0627",
"body": "Added in an authorization request claims.",
"is_bot": false,
"headline": "Merge pull request #180 from nats-io/auth_request",
"author_name": "Derek Collison",
"author_login": "derekcollison",
"committed_at": "2022-12-02T14:11:17Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "bf796004f40fff71aed50f3a67686f96b953ba9d",
"body": "Signed-off-by: Derek Collison <derek@nats.io>",
"is_bot": false,
"headline": "Naming updates based on review feedback",
"author_name": "Derek Collison",
"author_login": "derekcollison",
"committed_at": "2022-12-02T14:04:21Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "8721d1a30789bbb20794b68ddf53b9bc41418ff1",
"body": "…or the NATS server.\n\nSigned-off-by: Derek Collison <derek@nats.io>",
"is_bot": false,
"headline": "Added in an authorization request claim for external authentication f…",
"author_name": "Derek Collison",
"author_login": "derekcollison",
"committed_at": "2022-12-02T13:58:22Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "ca3be3cbd866ece56191ac9b8fa274302b7abc10",
"body": "Add in support for external authorization for accounts.",
"is_bot": false,
"headline": "Merge pull request #179 from nats-io/auth_callout",
"author_name": "Derek Collison",
"author_login": "derekcollison",
"committed_at": "2022-12-01T23:24:32Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "f490b9052a670880ad044ba9da794e6a348adc98",
"body": "Signed-off-by: Derek Collison <derek@nats.io>",
"is_bot": false,
"headline": "Add in support for external authorization for accounts.",
"author_name": "Derek Collison",
"author_login": "derekcollison",
"committed_at": "2022-12-01T21:51:25Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "4a8a7328f44f94e4e9d4582fbd7f439100a2cd0e",
"body": "Release v2.3.0",
"is_bot": false,
"headline": "Merge pull request #178 from nats-io/release_2_3_0",
"author_name": "Ivan Kozlovic",
"author_login": "kozlovic",
"committed_at": "2022-06-28T20:01:56Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "58dfad6b83a61716ac242c27878b5b1da299a06e",
"body": "Signed-off-by: Ivan Kozlovic <ivan@synadia.com>",
"is_bot": false,
"headline": "Release v2.3.0",
"author_name": "Ivan Kozlovic",
"author_login": "kozlovic",
"committed_at": "2022-06-28T19:52:25Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "3bcd719cc7d083d359a1fbca2acb04a25103e264",
"body": "[add] DisallowBearerToken option to operator to disallow bearer = true",
"is_bot": false,
"headline": "Merge pull request #177 from nats-io/DisallowBearerToken",
"author_name": "Matthias Hanel",
"author_login": "matthiashanel",
"committed_at": "2022-05-09T18:01:18Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "b7cabf8dbe60a5235559a735400d84bdab1bacf6",
"body": "Signed-off-by: Matthias Hanel <mh@synadia.com>",
"is_bot": false,
"headline": "moved attribute to account",
"author_name": "Matthias Hanel",
"author_login": "matthiashanel",
"committed_at": "2022-05-09T16:59:55Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "9f4f1d5cc9778e59a02c345580814c19d845d7a7",
"body": "change 1 out of 3 for https://github.com/nats-io/nats-server/issues/3084",
"is_bot": false,
"headline": "[add] DisallowBearerToken option to operator to disallow bearer = true",
"author_name": "Matthias Hanel",
"author_login": "matthiashanel",
"committed_at": "2022-04-29T17:51:40Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "3b8532b48b96c7b018d61c646477f7bccaf33abe",
"body": "fix validation text",
"is_bot": false,
"headline": "Merge pull request #176 from nats-io/validation-text",
"author_name": "Matthias Hanel",
"author_login": "matthiashanel",
"committed_at": "2022-04-08T19:53:10Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "d3db06c2932324d92ec66a23dcf9caac3fa272fb",
"body": "Signed-off-by: Matthias Hanel <mh@synadia.com>",
"is_bot": false,
"headline": "fix validation text",
"author_name": "Matthias Hanel",
"author_login": "matthiashanel",
"committed_at": "2022-04-08T19:06:15Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "442af02fd36a57aa5b0f6b45c28f171eb2c4596d",
"body": "Adding max_ack_pending stream limit",
"is_bot": false,
"headline": "Merge pull request #174 from nats-io/max-ack-pending",
"author_name": "Matthias Hanel",
"author_login": "matthiashanel",
"committed_at": "2022-03-30T18:01:45Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "03a6fb27606bd094a397b17f420f8b3f3446d0a2",
"body": "Signed-off-by: Matthias Hanel <mh@synadia.com>",
"is_bot": false,
"headline": "Fix go 1.16 github actions staticcheck build issues",
"author_name": "Matthias Hanel",
"author_login": "matthiashanel",
"committed_at": "2022-03-30T17:54:51Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "c11dbed5c4caf2f57047ca165571088a10a6f09c",
"body": "Signed-off-by: Matthias Hanel <mh@synadia.com>",
"is_bot": false,
"headline": "Use t.Fatalf(...) instead of t.Fatal(fmt.Sprintf(...))",
"author_name": "Matthias Hanel",
"author_login": "matthiashanel",
"committed_at": "2022-03-30T17:26:24Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "9928008f35af8ef1c1e6d7475e90c30a049159a4",
"body": "Signed-off-by: Matthias Hanel <mh@synadia.com>",
"is_bot": false,
"headline": "Adding max_ack_pending stream limit",
"author_name": "Matthias Hanel",
"author_login": "matthiashanel",
"committed_at": "2022-03-30T17:26:21Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "5efd4536dd5c01f860191a1e9908dc4cb08cc1b1",
"body": "Switching MaxStreamBytes to Disk/Memory",
"is_bot": false,
"headline": "Merge pull request #173 from nats-io/maxmaxbytes-2",
"author_name": "Matthias Hanel",
"author_login": "matthiashanel",
"committed_at": "2022-03-28T22:21:44Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "2eedfe4932b246c504e3e5b1a0562081d58537c1",
"body": "And removing dependency on MaxBytesRequired\n\nSigned-off-by: Matthias Hanel <mh@synadia.com>",
"is_bot": false,
"headline": "Switching MaxStreamBytes to Disk/Memory",
"author_name": "Matthias Hanel",
"author_login": "matthiashanel",
"committed_at": "2022-03-28T22:07:42Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "3472a33220ba06f07b27c174f3a160d7ad46d047",
"body": "Adding max_max_bytes to limit the maximum value for max bytes",
"is_bot": false,
"headline": "Merge pull request #172 from nats-io/maxmaxbytes",
"author_name": "Matthias Hanel",
"author_login": "matthiashanel",
"committed_at": "2022-03-23T19:50:37Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "30ec1f4583a95097d52d11d7c8fbd5770a9fcc8e",
"body": "Signed-off-by: Matthias Hanel <mh@synadia.com>",
"is_bot": false,
"headline": "renaminb MaxMaxBytes to MaxStreamBytes",
"author_name": "Matthias Hanel",
"author_login": "matthiashanel",
"committed_at": "2022-03-23T19:34:17Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "3c80622308f6b0227c0765536e9199cfd2f6eed5",
"body": "Signed-off-by: Matthias Hanel <mh@synadia.com>",
"is_bot": false,
"headline": "Adding max_max_bytes to limit the maximum value for max bytes",
"author_name": "Matthias Hanel",
"author_login": "matthiashanel",
"committed_at": "2022-03-23T17:36:34Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "b65a1fb60b29b3dfe00ca03a835166d33b3f1ed5",
"body": "Replace HAResources with TieredLimits",
"is_bot": false,
"headline": "Merge pull request #169 from nats-io/tiers",
"author_name": "Matthias Hanel",
"author_login": "matthiashanel",
"committed_at": "2022-03-23T01:09:31Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "a1fd29b7d5757ae6987fbee5ea4f690cc5829a35",
"body": "Signed-off-by: Matthias Hanel <mh@synadia.com>",
"is_bot": false,
"headline": "Adding check for empty tier name",
"author_name": "Matthias Hanel",
"author_login": "matthiashanel",
"committed_at": "2022-03-22T17:16:34Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "afab08bdab408e12a70ed2c57ac0c5a6d76762d4",
"body": "Signed-off-by: Matthias Hanel <mh@synadia.com>",
"is_bot": false,
"headline": "Removed IsJSEnabled from JetStreamLimits",
"author_name": "Matthias Hanel",
"author_login": "matthiashanel",
"committed_at": "2022-03-22T17:16:34Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "c7a51045b15e21de6f66cc488f829565811f27b8",
"body": "Signed-off-by: Matthias Hanel <mh@synadia.com>",
"is_bot": false,
"headline": "add IsJSEnabled to operator",
"author_name": "Matthias Hanel",
"author_login": "matthiashanel",
"committed_at": "2022-03-22T17:16:33Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "97065db7e63601cd6b27341f753955c0a729f34f",
"body": "TieredLimits are mutually exclusive with JetStream limits\n\nSigned-off-by: Matthias Hanel <mh@synadia.com>",
"is_bot": false,
"headline": "Replace HAResources with TieredLimits",
"author_name": "Matthias Hanel",
"author_login": "matthiashanel",
"committed_at": "2022-03-22T17:16:30Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "a4dc57f25ef3e0e29b2147ac2a1bf1707e02197f",
"body": "Fix test deps",
"is_bot": false,
"headline": "Merge pull request #171 from nats-io/fix-testdeps",
"author_name": "Waldemar Quevedo",
"author_login": "wallyqs",
"committed_at": "2022-03-14T19:23:52Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "c3542f5ffb33d1f6e04103b7f2bfd039240d9e55",
"body": "Signed-off-by: Waldemar Quevedo <wally@synadia.com>",
"is_bot": false,
"headline": "Add script for testing and update Makefile",
"author_name": "Waldemar Quevedo",
"author_login": "wallyqs",
"committed_at": "2022-03-14T18:24:08Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "cbc856a8beb08a926a974ee77e6104d87ea3f888",
"body": "Only used for testing\n\nSigned-off-by: Waldemar Quevedo <wally@synadia.com>",
"is_bot": false,
"headline": "Remove indirect dependency on jwt v1",
"author_name": "Waldemar Quevedo",
"author_login": "wallyqs",
"committed_at": "2022-03-14T17:28:37Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "0ebff70bb0963daa37c706e5960818b0d6ad6e3f",
"body": "Update travis to Go 1.17",
"is_bot": false,
"headline": "Merge pull request #167 from nats-io/go_1_17",
"author_name": "Ivan Kozlovic",
"author_login": "kozlovic",
"committed_at": "2022-02-16T23:03:43Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "c9f0ca9fcf07a515b599a5ffce05e67a488c6283",
"body": "rename struct member HaResources to HAResources",
"is_bot": false,
"headline": "Merge pull request #166 from nats-io/ha-resources",
"author_name": "Matthias Hanel",
"author_login": "matthiashanel",
"committed_at": "2022-02-16T19:22:39Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "5be8995e08934c19c03c5a5da099fadf56010742",
"body": "Signed-off-by: Ivan Kozlovic <ivan@synadia.com>",
"is_bot": false,
"headline": "Update travis to Go 1.17",
"author_name": "Ivan Kozlovic",
"author_login": "kozlovic",
"committed_at": "2022-02-16T19:01:34Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "1e88c50fd302b04501d43a44147296805eb1bb69",
"body": "Signed-off-by: Matthias Hanel <mh@synadia.com>",
"is_bot": false,
"headline": "rename struct member HaResources to HAResources",
"author_name": "Matthias Hanel",
"author_login": "matthiashanel",
"committed_at": "2022-02-16T18:20:53Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "4b4a1c85619d16bd2aa59e41e94d8cdf2c1b7eca",
"body": "* Adding support for HA resources",
"is_bot": false,
"headline": "Adding support for HA resources (#165)",
"author_name": "Matthias Hanel",
"author_login": "matthiashanel",
"committed_at": "2022-02-08T17:44:25Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "58e87895b29641314818a5171038b73cff3bd25a",
"body": "* [FEATURE] Adding support for js max bytes required\r\n\r\nSigned-off-by: Matthias Hanel <mh@synadia.com>",
"is_bot": false,
"headline": "[FEATURE] Adding support for js max bytes required (#164)",
"author_name": "Matthias Hanel",
"author_login": "matthiashanel",
"committed_at": "2022-01-13T02:27:32Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "b87bc9cf336d182cff5afba51e7515893da95bba",
"body": "Adr 14",
"is_bot": false,
"headline": "Merge pull request #163 from nats-io/ADR-14",
"author_name": "Jean-Noël Moyne",
"author_login": "jnmoyne",
"committed_at": "2021-12-14T20:16:57Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "b991e3474e70adc228c509ea13a2c223a510a8ba",
"body": null,
"is_bot": false,
"headline": "IssuedAt is set by encode",
"author_name": "jnmoyne",
"author_login": "jnmoyne",
"committed_at": "2021-12-07T20:13:09Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "2406b1ff49e98e94b47040b2d951dafb271882b0",
"body": "…ob/main/adr/ADR-14.md",
"is_bot": false,
"headline": "Implements https://github.com/nats-io/nats-architecture-and-design/bl…",
"author_name": "jnmoyne",
"author_login": "jnmoyne",
"committed_at": "2021-12-06T23:48:18Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "fbbb4a5843511563d15bdd483f7ff3746aed0b36",
"body": "…ob/main/adr/ADR-14.md",
"is_bot": false,
"headline": "Implements https://github.com/nats-io/nats-architecture-and-design/bl…",
"author_name": "jnmoyne",
"author_login": "jnmoyne",
"committed_at": "2021-12-06T22:37:09Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "5474835bf2710001b83cc23d8c86d07b1bb75477",
"body": "Release v2.2.0",
"is_bot": false,
"headline": "Merge pull request #162 from nats-io/release_2_2_0",
"author_name": "Ivan Kozlovic",
"author_login": "kozlovic",
"committed_at": "2021-11-15T17:56:59Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "18ec093b4302783654e28b9aeb06e8afa28459c3",
"body": "Signed-off-by: Ivan Kozlovic <ivan@synadia.com>",
"is_bot": false,
"headline": "Release v2.2.0",
"author_name": "Ivan Kozlovic",
"author_login": "kozlovic",
"committed_at": "2021-11-15T17:03:38Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "ab1121ab4151fe0c6f99880f376483a929c4c058",
"body": "[ADDED] New websocket connection types",
"is_bot": false,
"headline": "Merge pull request #161 from nats-io/add_ws_conn_types",
"author_name": "Ivan Kozlovic",
"author_login": "kozlovic",
"committed_at": "2021-11-15T16:46:47Z",
"body_truncated": false,
"is_coding_agent": false
}
],
"releases_count": 46,
"commits_last_year": 11,
"latest_release_at": "2026-06-02T13:54:22Z",
"latest_release_tag": "v2.8.2",
"releases_from_tags": false,
"days_since_last_push": 49,
"active_weeks_last_year": 4,
"days_since_latest_release": 49,
"mean_days_between_releases": 77.4
},
"community": {
"has_readme": true,
"has_license": true,
"has_description": true,
"has_contributing": false,
"health_percentage": 37,
"has_issue_template": false,
"has_code_of_conduct": false,
"has_pull_request_template": false
},
"ecosystem": {
"packages": [
{
"name": "github.com/nats-io/jwt/v2",
"exists": true,
"license": null,
"keywords": [],
"ecosystem": "go",
"matches_repo": true,
"registry_url": "https://pkg.go.dev/github.com/nats-io/jwt/v2",
"is_deprecated": false,
"latest_version": "v2.8.2",
"repository_url": "https://github.com/nats-io/jwt",
"versions_count": 27,
"total_downloads": null,
"dependents_count": null,
"deprecation_note": null,
"maintainers_count": null,
"monthly_downloads": null,
"first_published_at": null,
"latest_published_at": "2026-06-02T13:53:38Z",
"latest_version_yanked": null,
"days_since_latest_publish": 49
}
]
},
"popularity": {
"forks": 37,
"stars": 88,
"watchers": 3,
"fork_history": {
"days": [
{
"date": "2018-12-16",
"count": 1
},
{
"date": "2019-03-01",
"count": 1
},
{
"date": "2019-08-09",
"count": 1
},
{
"date": "2019-09-22",
"count": 1
},
{
"date": "2019-12-05",
"count": 1
},
{
"date": "2020-02-12",
"count": 1
},
{
"date": "2020-03-12",
"count": 1
},
{
"date": "2020-05-22",
"count": 1
},
{
"date": "2020-10-14",
"count": 1
},
{
"date": "2020-10-28",
"count": 1
},
{
"date": "2020-12-21",
"count": 1
},
{
"date": "2021-05-12",
"count": 1
},
{
"date": "2021-07-20",
"count": 2
},
{
"date": "2021-08-06",
"count": 1
},
{
"date": "2021-08-24",
"count": 1
},
{
"date": "2021-09-28",
"count": 1
},
{
"date": "2022-03-03",
"count": 1
},
{
"date": "2022-11-30",
"count": 1
},
{
"date": "2023-01-20",
"count": 1
},
{
"date": "2023-04-03",
"count": 1
},
{
"date": "2023-07-03",
"count": 1
},
{
"date": "2023-07-20",
"count": 1
},
{
"date": "2023-08-18",
"count": 1
},
{
"date": "2023-10-24",
"count": 1
},
{
"date": "2024-10-28",
"count": 1
},
{
"date": "2025-04-26",
"count": 1
},
{
"date": "2025-04-27",
"count": 1
},
{
"date": "2025-04-29",
"count": 1
},
{
"date": "2025-07-09",
"count": 1
},
{
"date": "2025-07-11",
"count": 1
},
{
"date": "2025-08-23",
"count": 1
},
{
"date": "2026-02-17",
"count": 1
},
{
"date": "2026-02-20",
"count": 1
},
{
"date": "2026-03-05",
"count": 1
},
{
"date": "2026-06-21",
"count": 1
}
],
"complete": true,
"collected": 36,
"total_forks": 37
},
"star_history": {
"days": [
{
"date": "2018-10-15",
"count": 1
},
{
"date": "2018-12-16",
"count": 1
},
{
"date": "2018-12-21",
"count": 1
},
{
"date": "2019-03-01",
"count": 1
},
{
"date": "2019-03-24",
"count": 1
},
{
"date": "2019-04-16",
"count": 1
},
{
"date": "2019-06-17",
"count": 1
},
{
"date": "2019-07-06",
"count": 1
},
{
"date": "2019-07-20",
"count": 1
},
{
"date": "2019-07-31",
"count": 2
},
{
"date": "2019-08-01",
"count": 1
},
{
"date": "2019-08-05",
"count": 1
},
{
"date": "2019-08-14",
"count": 1
},
{
"date": "2019-08-19",
"count": 1
},
{
"date": "2019-09-04",
"count": 1
},
{
"date": "2019-09-17",
"count": 1
},
{
"date": "2019-09-18",
"count": 1
},
{
"date": "2019-09-19",
"count": 1
},
{
"date": "2019-12-03",
"count": 1
},
{
"date": "2019-12-04",
"count": 1
},
{
"date": "2019-12-05",
"count": 1
},
{
"date": "2020-01-13",
"count": 1
},
{
"date": "2020-01-19",
"count": 1
},
{
"date": "2020-03-05",
"count": 1
},
{
"date": "2020-03-15",
"count": 1
},
{
"date": "2020-03-20",
"count": 1
},
{
"date": "2020-05-08",
"count": 1
},
{
"date": "2020-05-24",
"count": 1
},
{
"date": "2020-07-05",
"count": 1
},
{
"date": "2020-09-04",
"count": 1
},
{
"date": "2020-09-27",
"count": 1
},
{
"date": "2020-10-07",
"count": 1
},
{
"date": "2020-10-31",
"count": 1
},
{
"date": "2020-12-11",
"count": 1
},
{
"date": "2020-12-13",
"count": 1
},
{
"date": "2021-01-27",
"count": 1
},
{
"date": "2021-02-05",
"count": 1
},
{
"date": "2021-03-22",
"count": 1
},
{
"date": "2021-04-25",
"count": 1
},
{
"date": "2021-05-12",
"count": 1
},
{
"date": "2021-09-29",
"count": 1
},
{
"date": "2021-10-22",
"count": 1
},
{
"date": "2021-12-20",
"count": 1
},
{
"date": "2022-01-14",
"count": 1
},
{
"date": "2022-02-21",
"count": 1
},
{
"date": "2022-03-03",
"count": 1
},
{
"date": "2022-03-22",
"count": 1
},
{
"date": "2022-03-29",
"count": 1
},
{
"date": "2022-05-03",
"count": 1
},
{
"date": "2022-07-16",
"count": 1
},
{
"date": "2022-08-14",
"count": 1
},
{
"date": "2022-09-21",
"count": 1
},
{
"date": "2022-11-04",
"count": 1
},
{
"date": "2022-12-17",
"count": 1
},
{
"date": "2023-01-16",
"count": 1
},
{
"date": "2023-01-24",
"count": 1
},
{
"date": "2023-02-22",
"count": 1
},
{
"date": "2023-03-06",
"count": 2
},
{
"date": "2023-03-21",
"count": 1
},
{
"date": "2023-03-25",
"count": 1
},
{
"date": "2023-04-24",
"count": 1
},
{
"date": "2023-08-25",
"count": 1
},
{
"date": "2023-09-07",
"count": 1
},
{
"date": "2024-03-23",
"count": 1
},
{
"date": "2024-03-25",
"count": 1
},
{
"date": "2024-04-21",
"count": 1
},
{
"date": "2024-06-17",
"count": 1
},
{
"date": "2024-06-27",
"count": 1
},
{
"date": "2024-07-10",
"count": 1
},
{
"date": "2024-07-18",
"count": 1
},
{
"date": "2024-07-27",
"count": 1
},
{
"date": "2024-09-25",
"count": 2
},
{
"date": "2025-02-03",
"count": 1
},
{
"date": "2025-03-27",
"count": 1
},
{
"date": "2025-04-04",
"count": 1
},
{
"date": "2025-04-26",
"count": 1
},
{
"date": "2025-05-20",
"count": 1
},
{
"date": "2025-06-04",
"count": 1
},
{
"date": "2025-09-09",
"count": 1
},
{
"date": "2025-10-05",
"count": 1
},
{
"date": "2025-10-28",
"count": 1
},
{
"date": "2026-01-19",
"count": 1
},
{
"date": "2026-02-23",
"count": 1
},
{
"date": "2026-06-07",
"count": 1
}
],
"complete": true,
"collected": 87,
"total_stars": 88
},
"open_issues_and_prs": 14
},
"ai_readiness": {
"has_nix": false,
"example_dirs": [],
"has_llms_txt": false,
"has_dockerfile": false,
"has_mcp_signal": false,
"bootstrap_files": [
"v2/Makefile",
"v2/v1compat/Makefile"
],
"api_schema_files": [],
"has_devcontainer": false,
"typecheck_configs": [],
"toolchain_manifests": [
"v2/go.mod"
],
"largest_source_bytes": 31695,
"source_files_sampled": 66,
"oversized_source_files": 0,
"agent_instruction_files": [],
"agent_instruction_max_bytes": null
},
"dependencies": {
"manifests": [
"v2/go.mod"
],
"advisories": {
"error": null,
"scope": "repository_graph",
"source": "osv",
"findings": [
{
"name": "github.com/nats-io/jwt",
"direct": false,
"version": "1.2.2",
"severity": "critical",
"ecosystem": "go",
"cvss_score": null,
"advisory_ids": [
"GHSA-62mh-w5cv-p88c",
"GO-2022-0386"
],
"fixed_version": "2.0.1",
"advisory_count": 2,
"oldest_advisory_days": 1618
},
{
"name": "golang.org/x/crypto",
"direct": false,
"version": "v0.52.0",
"severity": "unknown",
"ecosystem": "go",
"cvss_score": null,
"advisory_ids": [
"GO-2026-5932"
],
"fixed_version": null,
"advisory_count": 1,
"oldest_advisory_days": 14
}
],
"collected": true,
"malicious": [],
"truncated": false,
"by_severity": {
"unknown": 1,
"critical": 1
},
"advisory_count": 3,
"affected_count": 2,
"assessed_count": 5,
"malicious_count": 0,
"assessed_package": null,
"unassessed_count": 0,
"direct_affected_count": 0
},
"ecosystems": [
"go"
],
"dependencies": [
{
"name": "github.com/nats-io/nkeys",
"manifest": "v2/go.mod",
"ecosystem": "go",
"version_constraint": "v0.4.16"
}
],
"all_dependencies": {
"error": null,
"source": "github-sbom",
"packages": [
{
"name": "github.com/nats-io/nkeys",
"direct": true,
"version": "0.3.0",
"ecosystem": "go"
},
{
"name": "github.com/nats-io/nkeys",
"direct": true,
"version": "v0.4.16",
"ecosystem": "go"
},
{
"name": "github.com/nats-io/jwt",
"direct": false,
"version": "1.2.2",
"ecosystem": "go"
},
{
"name": "golang.org/x/crypto",
"direct": false,
"version": "v0.52.0",
"ecosystem": "go"
},
{
"name": "golang.org/x/sys",
"direct": false,
"version": "v0.45.0",
"ecosystem": "go"
}
],
"collected": true,
"truncated": false,
"total_count": 5,
"direct_count": 2,
"indirect_count": 3
}
},
"maintainership": {
"issues": {
"open_prs": 1,
"merged_prs": 188,
"open_issues": 13,
"closed_ratio": 0.594,
"closed_issues": 19,
"closed_unmerged_prs": 27
},
"bus_factor": 2,
"bot_contributors": 1,
"top_contributors": [
{
"type": "User",
"login": "aricart",
"commits": 96,
"avatar_url": "https://avatars.githubusercontent.com/u/1032976?v=4"
},
{
"type": "User",
"login": "matthiashanel",
"commits": 71,
"avatar_url": "https://avatars.githubusercontent.com/u/19881388?v=4"
},
{
"type": "User",
"login": "derekcollison",
"commits": 47,
"avatar_url": "https://avatars.githubusercontent.com/u/90097?v=4"
},
{
"type": "User",
"login": "kozlovic",
"commits": 46,
"avatar_url": "https://avatars.githubusercontent.com/u/13736691?v=4"
},
{
"type": "User",
"login": "sasbury",
"commits": 10,
"avatar_url": "https://avatars.githubusercontent.com/u/3311569?v=4"
},
{
"type": "User",
"login": "wallyqs",
"commits": 8,
"avatar_url": "https://avatars.githubusercontent.com/u/26195?v=4"
},
{
"type": "User",
"login": "jnmoyne",
"commits": 4,
"avatar_url": "https://avatars.githubusercontent.com/u/7819096?v=4"
},
{
"type": "User",
"login": "neilalexander",
"commits": 4,
"avatar_url": "https://avatars.githubusercontent.com/u/310854?v=4"
},
{
"type": "User",
"login": "henryleduc",
"commits": 3,
"avatar_url": "https://avatars.githubusercontent.com/u/55436491?v=4"
},
{
"type": "User",
"login": "philpennock",
"commits": 3,
"avatar_url": "https://avatars.githubusercontent.com/u/559098?v=4"
}
],
"contributors_sampled": 16,
"top_contributor_share": 0.32
},
"quality_signals": {
"has_ci": true,
"has_tests": true,
"ci_workflows": [
"claude.yaml",
"go-test.yaml"
],
"has_docs_dir": false,
"linter_configs": [],
"has_editorconfig": false,
"has_linter_config": false,
"has_precommit_config": false
},
"security_signals": {
"lockfiles": [
"go.sum"
],
"scorecard": {
"checks": [
{
"name": "Binary-Artifacts",
"score": 10,
"reason": "no binaries found in the repo",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#binary-artifacts"
},
{
"name": "Branch-Protection",
"score": null,
"reason": "internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#branch-protection"
},
{
"name": "CI-Tests",
"score": 4,
"reason": "11 out of 27 merged PRs checked by a CI test -- score normalized to 4",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#ci-tests"
},
{
"name": "CII-Best-Practices",
"score": 0,
"reason": "no effort to earn an OpenSSF best practices badge detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#cii-best-practices"
},
{
"name": "Code-Review",
"score": 10,
"reason": "all changesets reviewed",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#code-review"
},
{
"name": "Contributors",
"score": 10,
"reason": "project has 5 contributing companies or organizations",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#contributors"
},
{
"name": "Dangerous-Workflow",
"score": 10,
"reason": "no dangerous workflow patterns detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dangerous-workflow"
},
{
"name": "Dependency-Update-Tool",
"score": 10,
"reason": "update tool detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dependency-update-tool"
},
{
"name": "Fuzzing",
"score": 0,
"reason": "project is not fuzzed",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#fuzzing"
},
{
"name": "License",
"score": 10,
"reason": "license file detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#license"
},
{
"name": "Maintained",
"score": 1,
"reason": "2 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 1",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#maintained"
},
{
"name": "Packaging",
"score": null,
"reason": "packaging workflow not detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#packaging"
},
{
"name": "Pinned-Dependencies",
"score": 0,
"reason": "dependency not pinned by hash detected -- score normalized to 0",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#pinned-dependencies"
},
{
"name": "SAST",
"score": 3,
"reason": "SAST tool is not run on all commits -- score normalized to 3",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#sast"
},
{
"name": "Security-Policy",
"score": 0,
"reason": "security policy file not detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#security-policy"
},
{
"name": "Signed-Releases",
"score": null,
"reason": "no releases found",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#signed-releases"
},
{
"name": "Token-Permissions",
"score": 0,
"reason": "detected GitHub workflow tokens with excessive permissions",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#token-permissions"
},
{
"name": "Vulnerabilities",
"score": 9,
"reason": "1 existing vulnerabilities detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#vulnerabilities"
}
],
"commit": "82017236da50e4a0173091105d82d46228b8dccf",
"ran_at": "2026-07-22T07:18:17Z",
"aggregate_score": 5.6,
"scorecard_version": "v5.5.0"
},
"has_codeql_workflow": false,
"has_security_policy": false,
"has_dependabot_config": false
},
"contribution_flow": {
"collected": true,
"ci_last_run_at": "2026-07-15T17:54:58Z",
"oldest_open_prs": [
{
"number": 210,
"created_at": "2023-10-25T18:44:30Z",
"last_comment_at": null,
"last_comment_author": null
}
],
"last_merged_pr_at": "2026-06-02T13:53:39Z",
"ci_last_conclusion": "SUCCESS",
"oldest_open_issues": [
{
"number": 30,
"created_at": "2019-04-09T23:24:12Z",
"last_comment_at": null,
"last_comment_author": null
},
{
"number": 63,
"created_at": "2019-12-19T13:44:00Z",
"last_comment_at": null,
"last_comment_author": null
},
{
"number": 65,
"created_at": "2019-12-19T13:49:31Z",
"last_comment_at": null,
"last_comment_author": null
},
{
"number": 83,
"created_at": "2020-06-24T22:22:23Z",
"last_comment_at": null,
"last_comment_author": null
},
{
"number": 84,
"created_at": "2020-06-24T22:23:32Z",
"last_comment_at": null,
"last_comment_author": null
},
{
"number": 101,
"created_at": "2020-09-22T18:09:41Z",
"last_comment_at": null,
"last_comment_author": null
},
{
"number": 112,
"created_at": "2020-10-24T02:40:51Z",
"last_comment_at": null,
"last_comment_author": null
},
{
"number": 118,
"created_at": "2020-11-24T22:50:51Z",
"last_comment_at": "2020-11-24T23:36:28Z",
"last_comment_author": "philpennock"
},
{
"number": 123,
"created_at": "2020-12-04T18:14:50Z",
"last_comment_at": null,
"last_comment_author": null
},
{
"number": 170,
"created_at": "2022-03-14T15:06:58Z",
"last_comment_at": null,
"last_comment_author": null
},
{
"number": 199,
"created_at": "2023-05-06T22:38:00Z",
"last_comment_at": "2023-12-18T12:13:31Z",
"last_comment_author": "ahirner"
},
{
"number": 207,
"created_at": "2023-08-25T19:58:54Z",
"last_comment_at": "2023-08-25T20:19:04Z",
"last_comment_author": "aricart"
},
{
"number": 249,
"created_at": "2026-04-23T08:18:19Z",
"last_comment_at": "2026-04-23T13:56:26Z",
"last_comment_author": "choufraise"
}
]
}
},
"config": {
"disabled_metrics": [],
"disabled_categories": [],
"disabled_components": {}
},
"source": {
"url": "https://github.com/nats-io/jwt",
"host": "github.com",
"name": "jwt",
"owner": "nats-io"
},
"metrics": {
"overall": {
"key": "overall",
"band": "moderate",
"name": "Overall health",
"note": null,
"notes": [],
"value": 61,
"inputs": {
"security": 65,
"vitality": 56,
"community": 48,
"governance": 78,
"engineering": 54
},
"components": []
},
"categories": [
{
"key": "vitality",
"band": "moderate",
"name": "Vitality",
"value": 56,
"weight": 0.22,
"metrics": [
{
"key": "development_activity",
"band": "at_risk",
"name": "Development activity",
"note": null,
"notes": [],
"value": 32,
"inputs": {
"commits_last_year": 11,
"human_commit_share": 0.99,
"days_since_last_push": 49,
"active_weeks_last_year": 4
},
"components": [
{
"key": "push_recency",
"name": "Push recency",
"detail": "last push 49 days ago",
"points": 18,
"status": "partial",
"details": [
{
"code": "push_recency",
"params": {
"days": 49
}
}
],
"max_points": 36
},
{
"key": "commit_cadence",
"name": "Commit cadence",
"detail": "4/52 weeks with commits",
"points": 2.8,
"status": "partial",
"details": [
{
"code": "commit_cadence_weeks",
"params": {
"weeks": 4
}
}
],
"max_points": 36
},
{
"key": "commit_volume",
"name": "Commit volume",
"detail": "11 commits in the last year",
"points": 9.7,
"status": "partial",
"details": [
{
"code": "commits_last_year",
"params": {
"count": 11
}
}
],
"max_points": 18
},
{
"key": "openssf_scorecard_maintained",
"name": "OpenSSF Scorecard: Maintained",
"detail": "2 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 1",
"points": 1,
"status": "partial",
"details": [],
"max_points": 10
}
]
},
{
"key": "release_discipline",
"band": "excellent",
"name": "Release discipline",
"note": "Excluded from scoring (no data or not applicable): OpenSSF Scorecard: Signed-Releases. Remaining weights renormalized.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"openssf_scorecard_signed_releases"
]
}
},
{
"code": "weights_renormalized",
"params": {}
}
],
"value": 92,
"inputs": {
"releases_count": 46,
"latest_release_tag": "v2.8.2",
"releases_from_tags": false,
"days_since_latest_release": 49,
"mean_days_between_releases": 77.4
},
"components": [
{
"key": "ships_releases",
"name": "Ships releases",
"detail": "46 releases published",
"points": 27,
"status": "met",
"details": [
{
"code": "releases_published",
"params": {
"count": 46
}
}
],
"max_points": 27
},
{
"key": "release_recency",
"name": "Release recency",
"detail": "latest release 49 days ago",
"points": 36,
"status": "met",
"details": [
{
"code": "release_recency",
"params": {
"days": 49
}
}
],
"max_points": 36
},
{
"key": "release_cadence",
"name": "Release cadence",
"detail": "a release every ~77.4 days",
"points": 19.8,
"status": "partial",
"details": [
{
"code": "release_cadence",
"params": {
"gap": 77.4
}
}
],
"max_points": 27
},
{
"key": "openssf_scorecard_signed_releases",
"name": "OpenSSF Scorecard: Signed-Releases",
"detail": "no releases found",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_data",
"params": {}
}
],
"max_points": 10
}
]
},
{
"key": "abandonment",
"band": "excellent",
"name": "Abandonment",
"note": null,
"notes": [],
"value": 100,
"inputs": {
"cap": null,
"state": "maintained",
"guards": [],
"signals": [],
"red_flag": false,
"multiplier_pct": 100,
"declared_reason": null,
"unverified_reason": null,
"unanswered_open_prs": null,
"unanswered_open_issues": null,
"days_since_last_merged_pr": null,
"days_since_last_human_commit": 49,
"days_since_last_human_commit_is_floor": false
},
"components": [
{
"key": "project_is_still_maintained",
"name": "Project is still maintained",
"detail": "last human commit 49 days ago",
"points": 100,
"status": "met",
"details": [
{
"code": "abandonment_maintained",
"params": {
"days": 49
}
}
],
"max_points": 100
}
]
}
],
"description": "Is the project alive — is code being written and are releases shipping?"
},
{
"key": "community",
"band": "at_risk",
"name": "Community & Adoption",
"value": 48,
"weight": 0.18,
"metrics": [
{
"key": "popularity",
"band": "at_risk",
"name": "Popularity & adoption",
"note": null,
"notes": [],
"value": 46,
"inputs": {
"forks": 37,
"stars": 88,
"watchers": 3,
"growth_state": "unverified",
"growth_factor_pct": 100,
"growth_unverified_reason": "below_threshold"
},
"components": [
{
"key": "stars",
"name": "Stars",
"detail": "88 stars",
"points": 31.5,
"status": "partial",
"details": [
{
"code": "stars",
"params": {
"count": 88
}
}
],
"max_points": 60
},
{
"key": "forks",
"name": "Forks",
"detail": "37 forks",
"points": 13,
"status": "partial",
"details": [
{
"code": "forks",
"params": {
"count": 37
}
}
],
"max_points": 25
},
{
"key": "watchers",
"name": "Watchers",
"detail": "3 watchers",
"points": 1.7,
"status": "partial",
"details": [
{
"code": "watchers",
"params": {
"count": 3
}
}
],
"max_points": 15
}
]
},
{
"key": "community_health",
"band": "moderate",
"name": "Community health",
"note": null,
"notes": [],
"value": 50,
"inputs": {
"has_readme": true,
"has_license": true,
"has_contributing": false,
"has_issue_template": false,
"has_code_of_conduct": false,
"has_pull_request_template": false
},
"components": [
{
"key": "readme",
"name": "README",
"detail": null,
"points": 22.5,
"status": "met",
"details": [],
"max_points": 22.5
},
{
"key": "license",
"name": "License",
"detail": "recognized license (Apache-2.0)",
"points": 22.5,
"status": "met",
"details": [
{
"code": "license_standard",
"params": {}
},
{
"code": "license_spdx",
"params": {
"spdx": "Apache-2.0"
}
}
],
"max_points": 22.5
},
{
"key": "contributing_guide",
"name": "CONTRIBUTING guide",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 18
},
{
"key": "code_of_conduct",
"name": "Code of conduct",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 13.5
},
{
"key": "issue_template",
"name": "Issue template",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.2
},
{
"key": "pr_template",
"name": "PR template",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 6.3
}
]
}
],
"description": "Does the project have users, downloads, attention, and a welcoming setup for contributors?"
},
{
"key": "governance",
"band": "good",
"name": "Sustainability & Governance",
"value": 78,
"weight": 0.24,
"metrics": [
{
"key": "maintainer_resilience",
"band": "moderate",
"name": "Maintainer resilience (bus factor)",
"note": null,
"notes": [],
"value": 64,
"inputs": {
"bus_factor": 2,
"contributors_sampled": 16,
"top_contributor_share": 0.32
},
"components": [
{
"key": "bus_factor",
"name": "Bus factor",
"detail": "2 contributor(s) cover half of all commits",
"points": 25.2,
"status": "partial",
"details": [
{
"code": "bus_factor",
"params": {
"count": 2
}
}
],
"max_points": 54
},
{
"key": "commit_distribution",
"name": "Commit distribution",
"detail": "top contributor authored 32% of commits",
"points": 15.3,
"status": "partial",
"details": [
{
"code": "top_contributor_share",
"params": {
"share": 32
}
}
],
"max_points": 22.5
},
{
"key": "contributor_breadth",
"name": "Contributor breadth",
"detail": "16 contributors",
"points": 13.5,
"status": "met",
"details": [
{
"code": "contributors_sampled",
"params": {
"count": 16
}
}
],
"max_points": 13.5
},
{
"key": "openssf_scorecard_contributors",
"name": "OpenSSF Scorecard: Contributors",
"detail": "project has 5 contributing companies or organizations",
"points": 10,
"status": "met",
"details": [],
"max_points": 10
}
]
},
{
"key": "responsiveness",
"band": "good",
"name": "Issue & PR responsiveness",
"note": null,
"notes": [],
"value": 76,
"inputs": {
"merged_prs": 188,
"open_issues": 13,
"closed_issues": 19,
"issue_closed_ratio": 0.594,
"closed_unmerged_prs": 27
},
"components": [
{
"key": "issue_resolution",
"name": "Issue resolution",
"detail": "59% of issues closed",
"points": 27.8,
"status": "partial",
"details": [
{
"code": "issues_closed_share",
"params": {
"share": 59
}
}
],
"max_points": 46.75
},
{
"key": "pr_acceptance",
"name": "PR acceptance",
"detail": "188/215 decided PRs merged",
"points": 33.4,
"status": "partial",
"details": [
{
"code": "decided_prs_merged",
"params": {
"merged": 188,
"decided": 215
}
}
],
"max_points": 38.25
},
{
"key": "openssf_scorecard_code_review",
"name": "OpenSSF Scorecard: Code-Review",
"detail": "all changesets reviewed",
"points": 15,
"status": "met",
"details": [],
"max_points": 15
}
]
},
{
"key": "stewardship",
"band": "good",
"name": "Ownership & stewardship",
"note": null,
"notes": [],
"value": 79,
"inputs": {
"followers": 2424,
"owner_type": "Organization",
"is_verified": null,
"owner_login": "nats-io",
"public_repos": 131,
"account_age_days": 4236
},
"components": [
{
"key": "ownership_backing",
"name": "Ownership backing",
"detail": "organization-owned",
"points": 30,
"status": "met",
"details": [
{
"code": "owner_organization",
"params": {}
}
],
"max_points": 30
},
{
"key": "verified_domain",
"name": "Verified domain",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 20
},
{
"key": "owner_reach",
"name": "Owner reach",
"detail": "2,424 followers of nats-io",
"points": 24.3,
"status": "partial",
"details": [
{
"code": "owner_followers",
"params": {
"count": 2424,
"login": "nats-io"
}
}
],
"max_points": 25
},
{
"key": "track_record",
"name": "Track record",
"detail": "131 public repos, account ~11 yr old",
"points": 25,
"status": "met",
"details": [
{
"code": "public_repos",
"params": {
"count": 131
}
},
{
"code": "account_age_years",
"params": {
"years": 11
}
}
],
"max_points": 25
}
]
},
{
"key": "package_maintenance",
"band": "excellent",
"name": "Package maintenance",
"note": null,
"notes": [],
"value": 100,
"inputs": {
"packages": [
"github.com/nats-io/jwt/v2"
],
"ecosystems": "go",
"any_deprecated": false,
"min_days_since_publish": 49
},
"components": [
{
"key": "published_resolvable",
"name": "Published & resolvable",
"detail": "1 package(s) on go",
"points": 25,
"status": "met",
"details": [
{
"code": "packages_published",
"params": {
"count": 1,
"ecosystems": "go"
}
}
],
"max_points": 25
},
{
"key": "publish_recency",
"name": "Publish recency",
"detail": "latest publish 49 days ago",
"points": 35,
"status": "met",
"details": [
{
"code": "publish_recency",
"params": {
"days": 49
}
}
],
"max_points": 35
},
{
"key": "version_history",
"name": "Version history",
"detail": "27 published versions",
"points": 20,
"status": "met",
"details": [
{
"code": "published_versions",
"params": {
"count": 27
}
}
],
"max_points": 20
},
{
"key": "not_deprecated",
"name": "Not deprecated",
"detail": "active, not deprecated or yanked",
"points": 20,
"status": "met",
"details": [
{
"code": "package_not_deprecated",
"params": {}
}
],
"max_points": 20
}
]
}
],
"description": "Will the project survive its people — bus factor, responsiveness, who backs it, and package upkeep?"
},
{
"key": "engineering",
"band": "moderate",
"name": "Engineering Quality",
"value": 54,
"weight": 0.2,
"metrics": [
{
"key": "engineering_practices",
"band": "moderate",
"name": "Engineering practices",
"note": null,
"notes": [],
"value": 56,
"inputs": {
"has_ci": true,
"has_tests": true,
"has_editorconfig": false,
"has_linter_config": false,
"has_precommit_config": false
},
"components": [
{
"key": "ci_workflows",
"name": "CI workflows",
"detail": "2 workflow(s)",
"points": 24,
"status": "met",
"details": [
{
"code": "ci_workflows",
"params": {
"count": 2
}
}
],
"max_points": 24
},
{
"key": "tests_present",
"name": "Tests present",
"detail": null,
"points": 24,
"status": "met",
"details": [],
"max_points": 24
},
{
"key": "linter_config",
"name": "Linter config",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 16
},
{
"key": "pre_commit_hooks",
"name": "Pre-commit hooks",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 9.6
},
{
"key": "editorconfig",
"name": ".editorconfig",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 6.4
},
{
"key": "openssf_scorecard_ci_tests",
"name": "OpenSSF Scorecard: CI-Tests",
"detail": "11 out of 27 merged PRs checked by a CI test -- score normalized to 4",
"points": 8,
"status": "partial",
"details": [],
"max_points": 20
}
]
},
{
"key": "documentation",
"band": "moderate",
"name": "Documentation",
"note": null,
"notes": [],
"value": 50,
"inputs": {
"topics": [],
"has_wiki": true,
"homepage": null,
"has_readme": true,
"has_docs_dir": false,
"has_description": true
},
"components": [
{
"key": "readme",
"name": "README",
"detail": null,
"points": 30,
"status": "met",
"details": [],
"max_points": 30
},
{
"key": "documentation_directory",
"name": "Documentation directory",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 25
},
{
"key": "documentation_homepage_site",
"name": "Documentation / homepage site",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 15
},
{
"key": "repository_description",
"name": "Repository description",
"detail": null,
"points": 10,
"status": "met",
"details": [],
"max_points": 10
},
{
"key": "topics",
"name": "Topics",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 10
},
{
"key": "wiki",
"name": "Wiki",
"detail": null,
"points": 10,
"status": "met",
"details": [],
"max_points": 10
}
]
}
],
"description": "Are baseline engineering and documentation practices in place?"
},
{
"key": "security",
"band": "moderate",
"name": "Security",
"value": 65,
"weight": 0.16,
"metrics": [
{
"key": "security_posture",
"band": "moderate",
"name": "Security posture",
"note": "Excluded from scoring (no data or not applicable): Branch-Protection, Packaging, Signed-Releases. Remaining weights renormalized.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"branch_protection",
"packaging",
"signed_releases"
]
}
},
{
"code": "weights_renormalized",
"params": {}
}
],
"value": 56,
"inputs": {
"source": "openssf_scorecard",
"checks_evaluated": 15,
"scorecard_version": "v5.5.0",
"checks_inconclusive": 3,
"scorecard_aggregate": 5.6
},
"components": [
{
"key": "binary_artifacts",
"name": "Binary-Artifacts",
"detail": "no binaries found in the repo",
"points": 7.5,
"status": "met",
"details": [],
"max_points": 7.5
},
{
"key": "branch_protection",
"name": "Branch-Protection",
"detail": "internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_data",
"params": {}
}
],
"max_points": 7.5
},
{
"key": "ci_tests",
"name": "CI-Tests",
"detail": "11 out of 27 merged PRs checked by a CI test -- score normalized to 4",
"points": 1,
"status": "partial",
"details": [],
"max_points": 2.5
},
{
"key": "cii_best_practices",
"name": "CII-Best-Practices",
"detail": "no effort to earn an OpenSSF best practices badge detected",
"points": 0,
"status": "missed",
"details": [],
"max_points": 2.5
},
{
"key": "code_review",
"name": "Code-Review",
"detail": "all changesets reviewed",
"points": 7.5,
"status": "met",
"details": [],
"max_points": 7.5
},
{
"key": "contributors",
"name": "Contributors",
"detail": "project has 5 contributing companies or organizations",
"points": 2.5,
"status": "met",
"details": [],
"max_points": 2.5
},
{
"key": "dangerous_workflow",
"name": "Dangerous-Workflow",
"detail": "no dangerous workflow patterns detected",
"points": 10,
"status": "met",
"details": [],
"max_points": 10
},
{
"key": "dependency_update_tool",
"name": "Dependency-Update-Tool",
"detail": "update tool detected",
"points": 7.5,
"status": "met",
"details": [],
"max_points": 7.5
},
{
"key": "fuzzing",
"name": "Fuzzing",
"detail": "project is not fuzzed",
"points": 0,
"status": "missed",
"details": [],
"max_points": 5
},
{
"key": "license",
"name": "License",
"detail": "license file detected",
"points": 2.5,
"status": "met",
"details": [],
"max_points": 2.5
},
{
"key": "maintained",
"name": "Maintained",
"detail": "2 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 1",
"points": 0.8,
"status": "partial",
"details": [],
"max_points": 7.5
},
{
"key": "packaging",
"name": "Packaging",
"detail": "packaging workflow not detected",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_data",
"params": {}
}
],
"max_points": 5
},
{
"key": "pinned_dependencies",
"name": "Pinned-Dependencies",
"detail": "dependency not pinned by hash detected -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 5
},
{
"key": "sast",
"name": "SAST",
"detail": "SAST tool is not run on all commits -- score normalized to 3",
"points": 1.5,
"status": "partial",
"details": [],
"max_points": 5
},
{
"key": "security_policy",
"name": "Security-Policy",
"detail": "security policy file not detected",
"points": 0,
"status": "missed",
"details": [],
"max_points": 5
},
{
"key": "signed_releases",
"name": "Signed-Releases",
"detail": "no releases found",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_data",
"params": {}
}
],
"max_points": 7.5
},
{
"key": "token_permissions",
"name": "Token-Permissions",
"detail": "detected GitHub workflow tokens with excessive permissions",
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.5
},
{
"key": "vulnerabilities",
"name": "Vulnerabilities",
"detail": "1 existing vulnerabilities detected",
"points": 6.8,
"status": "partial",
"details": [],
"max_points": 7.5
}
]
},
{
"key": "dependency_advisories",
"band": "excellent",
"name": "Dependency advisories",
"note": "Excluded from scoring (no data or not applicable): Indirect dependencies free of known advisories, No advisories left outstanding. Remaining weights renormalized. Matched 5 resolved dependencies against OSV. This repository publishes no package the index resolves, so the repository dependency graph was assessed instead. That graph mixes development and test pins with shipped dependencies, so only the declared runtime dependencies are scored; transitive findings are reported as context and excluded from the score. Reachability is not analyzed.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"indirect_dependencies_free_of_known_advisories",
"no_advisories_left_outstanding"
]
}
},
{
"code": "weights_renormalized",
"params": {}
},
{
"code": "advisories_scope_repository",
"params": {
"assessed": 5
}
},
{
"code": "advisories_repo_graph_caveat",
"params": {}
},
{
"code": "advisories_reachability",
"params": {}
}
],
"value": 100,
"inputs": {
"source": "osv",
"advisories": 3,
"affected_packages": 2,
"assessed_packages": 5,
"unassessed_packages": 0,
"affected_by_severity": "critical 1, unknown 1",
"direct_affected_packages": 0
},
"components": [
{
"key": "direct_dependencies_free_of_known_advisories",
"name": "Direct dependencies free of known advisories",
"detail": "no direct dependency carries a known advisory",
"points": 35,
"status": "met",
"details": [
{
"code": "no_direct_advisories",
"params": {}
}
],
"max_points": 35
},
{
"key": "indirect_dependencies_free_of_known_advisories",
"name": "Indirect dependencies free of known advisories",
"detail": "transitive set not separable from development and test dependencies in this scope",
"points": 0,
"status": "excluded",
"details": [
{
"code": "advisories_scope_not_separable",
"params": {}
}
],
"max_points": 25
},
{
"key": "no_advisories_left_outstanding",
"name": "No advisories left outstanding",
"detail": "no advisory carries a publication date",
"points": 0,
"status": "excluded",
"details": [
{
"code": "advisories_no_publication_date",
"params": {}
}
],
"max_points": 40
}
]
},
{
"key": "malicious_dependencies",
"band": "excellent",
"name": "Malicious dependencies",
"note": null,
"notes": [],
"value": 100,
"inputs": {
"source": "osv",
"meaning": "reported as a malicious package by the OpenSSF corpus; the remedy is removal or moving off the compromised name, never an upgrade of the same artifact. Versions the registry has since pulled are listed but not scored",
"packages": [],
"red_flag": false,
"assessed_packages": 5,
"malicious_packages": 0,
"direct_malicious_packages": 0,
"withdrawn_malicious_packages": 0,
"installable_malicious_packages": 0
},
"components": [
{
"key": "no_dependency_reported_as_a_malicious_package",
"name": "No dependency reported as a malicious package",
"detail": "no dependency is reported as a malicious package",
"points": 100,
"status": "met",
"details": [
{
"code": "no_malicious_dependencies",
"params": {}
}
],
"max_points": 100
}
]
},
{
"key": "high_risk_jurisdiction_exposure",
"band": "excellent",
"name": "High-Risk Jurisdiction Exposure",
"note": "Only high-confidence self-published location evidence affects this multiplier. Ambiguous matches are review-only; country evidence is not proof of nationality, citizenship, legal registration, malicious intent, or sanctions status.",
"notes": [
{
"code": "jurisdiction_evidence_limits",
"params": {}
}
],
"value": 100,
"inputs": {
"meaning": "self-published location evidence; not nationality or citizenship",
"red_flag": false,
"exposures": [],
"policy_countries": [
"Russia",
"Iran",
"North Korea"
],
"review_only_matches": 0,
"assessed_self_published_locations": 13
},
"components": [
{
"key": "policy_exposure_multiplier",
"name": "Policy exposure multiplier",
"detail": "no confirmed policy-scope location match",
"points": 100,
"status": "met",
"details": [
{
"code": "jurisdiction_no_match",
"params": {}
}
],
"max_points": 100
}
]
}
],
"description": "Are visible security and supply-chain practices strong, with no malicious dependency and no unresolved high-risk jurisdiction exposure?"
},
{
"key": "ai_readiness",
"band": "moderate",
"name": "AI Readiness",
"value": 62,
"weight": 0,
"metrics": [
{
"key": "ai_agent_context",
"band": "at_risk",
"name": "Agent context & guidance",
"note": null,
"notes": [],
"value": 34,
"inputs": {
"has_llms_txt": false,
"legible_history_share": 0.636,
"agent_instruction_files": [],
"agent_instruction_max_bytes": null
},
"components": [
{
"key": "agent_instructions",
"name": "Agent instructions",
"detail": "no CLAUDE.md / AGENTS.md / editor rules",
"points": 0,
"status": "missed",
"details": [
{
"code": "no_agent_instructions",
"params": {}
}
],
"max_points": 45
},
{
"key": "machine_readable_docs_llms_txt",
"name": "Machine-readable docs (llms.txt)",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 15
},
{
"key": "legible_commit_history",
"name": "Legible commit history",
"detail": "63 of 99 human commits state their intent (structured subject or explanatory body)",
"points": 33.9,
"status": "partial",
"details": [
{
"code": "legible_history",
"params": {
"legible": 63,
"sampled": 99
}
}
],
"max_points": 40
}
]
},
{
"key": "ai_verify_loop",
"band": "moderate",
"name": "Verify loop (build / test / typecheck)",
"note": null,
"notes": [],
"value": 69,
"inputs": {
"has_nix": false,
"has_tests": true,
"lockfiles": [
"go.sum"
],
"has_dockerfile": false,
"typed_language": true,
"bootstrap_files": [
"v2/Makefile",
"v2/v1compat/Makefile"
],
"has_devcontainer": false,
"has_linter_config": false,
"typecheck_configs": [],
"agent_commit_share": 0,
"toolchain_manifests": [
"v2/go.mod"
],
"dependency_bot_commit_share": 0.01
},
"components": [
{
"key": "one_command_bootstrap",
"name": "One-command bootstrap",
"detail": "v2/Makefile, v2/v1compat/Makefile",
"points": 18,
"status": "met",
"details": [
{
"code": "file_list",
"params": {
"files": "v2/Makefile, v2/v1compat/Makefile"
}
}
],
"max_points": 18
},
{
"key": "automated_tests",
"name": "Automated tests",
"detail": null,
"points": 22,
"status": "met",
"details": [],
"max_points": 22
},
{
"key": "lint_format_config",
"name": "Lint / format config",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 11
},
{
"key": "static_type_checking",
"name": "Static type checking",
"detail": "Go (statically typed)",
"points": 11,
"status": "met",
"details": [
{
"code": "statically_typed_language",
"params": {
"language": "Go"
}
}
],
"max_points": 11
},
{
"key": "reproducible_environment",
"name": "Reproducible environment",
"detail": "lockfile",
"points": 10,
"status": "met",
"details": [
{
"code": "file_list",
"params": {
"files": "lockfile"
}
}
],
"max_points": 10
},
{
"key": "demonstrated_agent_practice",
"name": "Demonstrated agent practice",
"detail": "no agent-authored commits among the last 100",
"points": 0,
"status": "missed",
"details": [
{
"code": "no_agent_authored_commits",
"params": {
"sampled": 100
}
}
],
"max_points": 10
},
{
"key": "automated_maintenance",
"name": "Automated maintenance",
"detail": "1 of the last 100 commits are automated dependency updates",
"points": 8,
"status": "met",
"details": [
{
"code": "dependency_bot_commits",
"params": {
"count": 1,
"sampled": 100
}
}
],
"max_points": 8
},
{
"key": "openssf_scorecard_pinned_dependencies",
"name": "OpenSSF Scorecard: Pinned-Dependencies",
"detail": "dependency not pinned by hash detected -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 10
}
]
},
{
"key": "ai_code_legibility",
"band": "excellent",
"name": "Code legibility for models",
"note": null,
"notes": [],
"value": 100,
"inputs": {
"primary_language": "Go",
"largest_source_bytes": 31695,
"source_files_sampled": 66,
"oversized_source_files": 0
},
"components": [
{
"key": "type_checkable_code",
"name": "Type-checkable code",
"detail": "Go (statically typed)",
"points": 45,
"status": "met",
"details": [
{
"code": "statically_typed_language",
"params": {
"language": "Go"
}
}
],
"max_points": 45
},
{
"key": "manageable_file_sizes",
"name": "Manageable file sizes",
"detail": "0/66 source files over 60KB",
"points": 55,
"status": "met",
"details": [
{
"code": "oversized_source_files",
"params": {
"kb": 60,
"sampled": 66,
"oversized": 0
}
}
],
"max_points": 55
}
]
}
],
"description": "How well is the repo equipped to be developed and maintained with AI coding agents? An independent, experimental badge — weight 0.0, so it is surfaced on its own and does not affect the overall health score."
}
],
"metrics_version": "1.13.0"
},
"warnings": [],
"report_type": "repository",
"generated_at": "2026-07-22T07:18:40.889999Z",
"schema_version": "0.26.0",
"badge_url": "https://raw.githubusercontent.com/inspect-software/badges/main/v1/n/nats-io/jwt.svg",
"full_name": "nats-io/jwt",
"license_state": "standard",
"license_spdx": "Apache-2.0"
}
Related records
Inspected repositories sharing catalogue tags or ecosystems with nats-io/jwt. Read them side by side →
Scores are signals, not warranties. They reflect publicly visible practices on GitHub — not a code audit, and not a security guarantee.
Missing data is excluded and weights renormalized, never scored as zero. Methodology is versioned and open: metrics v1.13.0, schema v0.26.0 — full methodology · metrics wiki.
