nats-io/jwt має індекс здоров’я 61 зі 100, що відповідає смузі «Помірний». Найвищий показник — Sustainability & Governance (78/100), найнижчий — Community & Adoption (48/100). Останнє оновлення було 49 днів тому. Більшість нещодавньої роботи виконують 2 учасники.
61
загалом / 100
Помірний
Індекс здоров'я програмного забезпечення
Метрики згруповано у зважені категорії на шкалі 1–100. Загальна оцінка починається як їхнє середнє; коли публічні дані активують Політику юрисдикцій високого ризику, рейтинг коригується й отримує верхню межу 49 («Під ризиком»). Готовність до ШІ не входить до індексу.
61
Відмінний85-100Зразковий; відповідає практично всім перевіреним критеріям
Добрий70-84Здоровий; незначні прогалини
Помірний50-69Прийнятний, але з помітними прогалинами; рекомендовано перевірку
У зоні ризику30-49Суттєві слабкі місця; впровадження потребує обережності
Критичний1-29Серйозні проблеми (покинутий, єдиний мейнтейнер, без базової гігієни)
Профіль оцінок
Кожна вісь — окрема категорія. Форма важить більше, ніж середнє: здоровий об'єкт заповнює всю фігуру, тоді як профіль із піками та провалами означає, що сила в одному вимірі маскує ризик в іншому.
Прямі залежності без відомих сповіщень — жодна пряма залежність не має відомих сповіщень
0/25
Непрямі залежності без відомих сповіщень — транзитивний набір не відокремлюється від залежностей розробки й тестування в цьому обсязі
0/40
Немає задавнених сповіщень — жодне сповіщення не має дати публікації
Використані вхідні дані
source
osv
advisories
3
affected_packages
2
assessed_packages
5
unassessed_packages
0
affected_by_severity
critical 1, unknown 1
direct_affected_packages
0
Виключено з оцінювання (немає даних або не застосовно): Непрямі залежності без відомих сповіщень, Немає задавнених сповіщень. Залишкові ваги перенормовано. Звірено 5 резолвлених залежностей із OSV. Цей репозиторій не публікує пакета, який резолвить індекс, тож натомість оцінено граф залежностей репозиторію. Цей граф змішує закріплені версії для розробки й тестування зі справді постачаними залежностями, тож оцінюються лише задекларовані runtime-залежності; транзитивні знахідки подаються як контекст і в оцінку не входять. Досяжність не аналізується.
Наскільки репозиторій оснащений для розробки та супроводу за участі ШІ-агентів? Незалежний, експериментальний бейдж — вага 0.0, тож він подається окремо і не впливає на загальний індекс здоров'я.
Керовані розміри файлів — 0/66 файлів вихідного коду понад 60 КБ
Використані вхідні дані
primary_language
Go
largest_source_bytes
31 695
source_files_sampled
66
oversized_source_files
0
Ключові факти
88зірок GitHub
16контриб'юторів
11комітів за останні 12 місяців
49днів від останнього пушу
46релізів
2бас-фактор
13відкритих issue
Goпакетних екосистем
Докладніше
Історія зірок і форків 88 ★ / 37 ⇿
88Зірки
37Форки
46Релізи
Коли додано кожну зірку й форк — зібрано з GitHub і згруповано за днями. Кумулятивне зростання розміщено просто над денними додаваннями, з яких воно складається, тож їх видно одне проти одного: рівномірне органічне накопичення виглядає зовсім інакше, ніж різкий короткочасний сплеск. Там, де цю різницю можна виміряти, її подано як автентичність росту.
Мажорні 1Мінорні 13Патчі 32
Кожна точка охоплює 8 днів.
OpenSSF Scorecard 5.6 / 10
5.6сукупно
Незалежна, не прив'язана до інструментів оцінка безпеки від відкритого проєкту OpenSSF Scorecard. Кожна перевірка винагороджує практику безпеки, а не інструмент конкретного постачальника. Перевірки, які Scorecard не зміг визначити, позначено н/д і виключено з оцінки безпеки (вони ніколи не зараховуються як нуль).Scorecard v5.5.0 · 2026-07-22 07:18 UTC
Повний розв'язаний набір залежностей із графа залежностей GitHub: 2 прямих і 3 непрямих (транзитивних) пакетів. Транзитивне замикання є повним, коли в репозиторії закомічено lockfile.
Реєстр
Пакет
Версія
Зв'язок
Go
github.com/nats-io/nkeys
0.3.0
пряма
Go
github.com/nats-io/nkeys
v0.4.16
пряма
Go
github.com/nats-io/jwt
1.2.2
непряма
Go
golang.org/x/crypto
v0.52.0
непряма
Go
golang.org/x/sys
v0.45.0
непряма
Сповіщення про залежності 2
Цей репозиторій не публікує пакета, який розпізнає індекс, тож оцінено його власний граф залежностей — 5 пакетів, серед яких є й піниї розробки та тестування, що ніколи не постачаються: 2 мають відомі сповіщення, з них 0 прямі.
Пакет
Версія
Зв'язок
Критичність
Сповіщень
Виправлено в
github.com/nats-io/jwt
1.2.2
непряма
критична
2
2.0.1
golang.org/x/crypto
v0.52.0
непряма
невідома
1
—
Сповіщення означає, що версія, записана в графі залежностей, потрапляє в уражений діапазон. Досяжність не аналізується, а граф містить піниї розробки й тестування — знахідка може стосуватися інструментів, а не поставленого коду.
Звіт у форматі JSON машиночитний
{
"data": {
"repo": {
"topics": [],
"is_fork": false,
"size_kb": 608,
"has_wiki": true,
"homepage": null,
"languages": {
"Go": 448290,
"Shell": 977,
"Makefile": 491
},
"pushed_at": "2026-06-02T13:54:22Z",
"created_at": "2018-08-22T16:25:50Z",
"owner_type": "Organization",
"updated_at": "2026-06-07T18:00:56Z",
"description": "JWT tokens signed using NKeys for Ed25519 for the NATS ecosystem.",
"is_archived": false,
"is_disabled": false,
"license_spdx": "Apache-2.0",
"default_branch": "main",
"license_spdx_raw": "Apache-2.0",
"primary_language": "Go",
"significant_languages": [
"Go"
]
},
"owner": {
"blog": "https://nats.io",
"name": "NATS - The Edge & Cloud Native Messaging System",
"type": "Organization",
"login": "nats-io",
"company": null,
"location": null,
"followers": 2424,
"avatar_url": "https://avatars.githubusercontent.com/u/10203055?v=4",
"created_at": "2014-12-16T02:38:52Z",
"is_verified": null,
"public_repos": 131,
"account_age_days": 4236
},
"license": {
"state": "standard",
"spdx_id": "Apache-2.0",
"raw_spdx": "Apache-2.0",
"file_present": true,
"scorecard_found": true,
"profile_has_license": true
},
"activity": {
"releases": [
{
"tag": "v2.8.2",
"kind": "patch",
"published_at": "2026-06-02T13:54:22Z"
},
{
"tag": "v2.8.1",
"kind": "patch",
"published_at": "2026-03-17T13:04:32Z"
},
{
"tag": "v2.8.0",
"kind": "minor",
"published_at": "2025-08-08T14:19:25Z"
},
{
"tag": "v2.7.4",
"kind": "patch",
"published_at": "2025-04-16T14:31:01Z"
},
{
"tag": "v2.7.3",
"kind": "patch",
"published_at": "2024-12-13T16:49:52Z"
},
{
"tag": "v2.7.2",
"kind": "patch",
"published_at": "2024-10-09T20:01:27Z"
},
{
"tag": "v2.7.1",
"kind": "patch",
"published_at": "2024-10-09T19:37:43Z"
},
{
"tag": "v2.7.0",
"kind": "minor",
"published_at": "2024-09-17T17:05:09Z"
},
{
"tag": "v2.6.0",
"kind": "minor",
"published_at": "2024-09-10T23:13:08Z"
},
{
"tag": "v2.5.8",
"kind": "patch",
"published_at": "2024-07-05T14:34:37Z"
},
{
"tag": "v2.5.7",
"kind": "patch",
"published_at": "2024-05-09T16:09:54Z"
},
{
"tag": "v2.5.6",
"kind": "patch",
"published_at": "2024-04-18T15:14:55Z"
},
{
"tag": "v2.5.5",
"kind": "patch",
"published_at": "2024-02-22T16:58:21Z"
},
{
"tag": "v2.5.4",
"kind": "patch",
"published_at": "2024-02-15T17:09:38Z"
},
{
"tag": "v2.5.3",
"kind": "patch",
"published_at": "2023-10-31T16:16:39Z"
},
{
"tag": "v2.5.2",
"kind": "patch",
"published_at": "2023-09-18T15:55:58Z"
},
{
"tag": "v2.5.1",
"kind": "patch",
"published_at": "2023-09-18T15:44:06Z"
},
{
"tag": "v2.5.0",
"kind": "minor",
"published_at": "2023-08-21T16:32:42Z"
},
{
"tag": "v2.4.1",
"kind": "patch",
"published_at": "2023-03-24T16:04:04Z"
},
{
"tag": "v2.4.0",
"kind": "minor",
"published_at": "2023-03-21T15:31:28Z"
},
{
"tag": "v2.3.0",
"kind": "minor",
"published_at": "2022-06-28T20:52:42Z"
},
{
"tag": "v2.2.0",
"kind": "minor",
"published_at": "2021-11-15T18:05:31Z"
},
{
"tag": "v2.1.0",
"kind": "minor",
"published_at": "2021-09-28T20:09:40Z"
},
{
"tag": "v2.0.3",
"kind": "patch",
"published_at": "2021-08-02T15:43:13Z"
},
{
"tag": "v2.0.2",
"kind": "patch",
"published_at": "2021-05-04T16:10:13Z"
},
{
"tag": "v2.0.1",
"kind": "patch",
"published_at": "2021-03-14T23:13:04Z"
},
{
"tag": "v2.0.0",
"kind": "major",
"published_at": "2021-03-14T19:53:51Z"
},
{
"tag": "v1.2.2",
"kind": "patch",
"published_at": "2020-11-30T16:49:20Z"
},
{
"tag": "v1.2.0",
"kind": "minor",
"published_at": "2020-10-30T23:40:28Z"
},
{
"tag": "v1.1.0",
"kind": "minor",
"published_at": "2020-10-21T15:51:26Z"
},
{
"tag": "v1.0.1",
"kind": "patch",
"published_at": "2020-05-29T19:52:32Z"
},
{
"tag": "v0.3.2",
"kind": "patch",
"published_at": "2019-11-14T21:48:39Z"
},
{
"tag": "v0.3.0",
"kind": "minor",
"published_at": "2019-09-20T17:04:31Z"
},
{
"tag": "v0.2.16",
"kind": "patch",
"published_at": "2019-09-18T15:07:30Z"
},
{
"tag": "v0.2.14",
"kind": "patch",
"published_at": "2019-08-14T16:24:45Z"
},
{
"tag": "v0.2.12",
"kind": "patch",
"published_at": "2019-07-24T20:08:40Z"
},
{
"tag": "v0.2.10",
"kind": "patch",
"published_at": "2019-07-16T13:10:53Z"
},
{
"tag": "v0.2.8",
"kind": "patch",
"published_at": "2019-06-21T16:36:23Z"
},
{
"tag": "v0.2.6",
"kind": "patch",
"published_at": "2019-05-22T14:19:08Z"
},
{
"tag": "v0.2.4",
"kind": "patch",
"published_at": "2019-04-18T17:58:28Z"
},
{
"tag": "v0.2.2",
"kind": "patch",
"published_at": "2019-04-11T23:37:05Z"
},
{
"tag": "v0.2.0",
"kind": "minor",
"published_at": "2019-04-11T20:49:26Z"
},
{
"tag": "v0.1.0",
"kind": "minor",
"published_at": "2019-04-09T23:41:13Z"
},
{
"tag": "v0.0.8",
"kind": "patch",
"published_at": "2018-12-13T04:28:38Z"
},
{
"tag": "v0.0.6",
"kind": "patch",
"published_at": "2018-12-08T02:04:24Z"
},
{
"tag": "v0.0.4",
"kind": "patch",
"published_at": "2018-12-04T18:47:52Z"
}
],
"recent_commits": [
{
"oid": "82017236da50e4a0173091105d82d46228b8dccf",
"body": null,
"is_bot": false,
"headline": "bumps (#251)",
"author_name": "Alberto Ricart",
"author_login": "aricart",
"committed_at": "2026-06-02T13:53:38Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "071a1dedb58e3da316084d650859d5cf6c00aaf2",
"body": "The nats-server will (only) enable JetStream on an account if `DiskStorage` and/or `MemoryStorage` is set to a non-zero value in the Account JWT Limits. This is due to legacy reasons and cannot be easily changed due to the global impact of already existing NATS clusters based on decentralized auth.\n\nIssue: https://github.com/nats-io/jwt/issues/249",
"is_bot": false,
"headline": "docs: how to enable/disable JetStream when creating AccountClaims (#250)",
"author_name": "Thobias Karlsson",
"author_login": "choufraise",
"committed_at": "2026-06-02T13:25:44Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "1e990c9a58a81981aca6da7efdc7c5b79314fea9",
"body": "* fix: added a check for the size of JWT token\n\nNote that now all JWTs are limited to 1MB - which may or not be breaking. Note that Generic JWTs could possibly have whatever size they want (this change doesn't affect GenericClaims)\n\nSigned-off-by: Alberto Ricart <alberto@synadia.com>",
"is_bot": false,
"headline": "fix: added a check for the size of JWT token (#248)",
"author_name": "Alberto Ricart",
"author_login": "aricart",
"committed_at": "2026-03-12T16:26:27Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "e6531afcdfe87a6d964693e59b1557bf3d32dfe4",
"body": "Signed-off-by: Alberto Ricart <alberto@synadia.com>",
"is_bot": false,
"headline": "fix: ensure that weighted mappings don't exceed 100 (#247)",
"author_name": "Alberto Ricart",
"author_login": "aricart",
"committed_at": "2026-03-11T19:13:06Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "4cbb6cce481caba30d91a020bc25be99f1d8a791",
"body": "This API is used by external tools to decorate seeds, in cases where they specify a bad input return an error\n\nSigned-off-by: Alberto Ricart <alberto@synadia.com>",
"is_bot": false,
"headline": "fix: make DecorateSeed more resilient in case of short input (#245)",
"author_name": "Alberto Ricart",
"author_login": "aricart",
"committed_at": "2026-03-11T16:36:41Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "4ee18c85bc5ed09dc41fb03b045f077bc3cdce93",
"body": "Signed-off-by: Alberto Ricart <alberto@synadia.com>",
"is_bot": false,
"headline": "ci: enable claude (#246)",
"author_name": "Alberto Ricart",
"author_login": "aricart",
"committed_at": "2026-03-11T16:12:49Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "169803d1a50f8a02e09aadf72195af3c5d716a80",
"body": "* bump dependencies, streamline test matrix\n\n* Go 1.24 vet flagged printf-style functions that passed non-constant strings as the format string\n\nSigned-off-by: Alberto Ricart <alberto@synadia.com>\n\n---------\n\nSigned-off-by: Alberto Ricart <alberto@synadia.com>",
"is_bot": false,
"headline": "bump dependencies, streamline test matrix (#244)",
"author_name": "Alberto Ricart",
"author_login": "aricart",
"committed_at": "2026-03-03T14:59:26Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "a3aa1012e08c00d189405a9313f75bed8ed84f8a",
"body": "…or the JWT provided. (#242)\n\nSigned-off-by: Alberto Ricart <alberto@synadia.com>",
"is_bot": false,
"headline": "added a check when generating creds that the specified key is valid f…",
"author_name": "Alberto Ricart",
"author_login": "aricart",
"committed_at": "2026-03-03T14:59:05Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "e4173126b32a711fcf1595d122a302ee22ff8d43",
"body": "nats-server already allows importing the same (service) subject from different account, while the jwt does not. This becomes an issue when you, for instance, source JetStreams from different accounts and need to import service `$JS.FC.>` from both. Before, this could be solved by importing e.g. `$JS\n[…]\ns-server/pull/6704\nRelated: https://github.com/nats-io/nats-server/issues/6547\nRelated: https://github.com/nats-io/nats-server/issues/6431\n\nSigned-off-by: Thobias Karlsson <thobias.karlsson@gmail.com>",
"is_bot": false,
"headline": "fix: allow import of same service subject from different accounts (#243)",
"author_name": "Thobias Karlsson",
"author_login": "choufraise",
"committed_at": "2026-02-27T22:00:12Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "a2c583b4f3719b35832df7b802db6efe1c6f066e",
"body": "Signed-off-by: Alberto Ricart <alberto@synadia.com>",
"is_bot": false,
"headline": "update build status badge to use GitHub Actions (#240)",
"author_name": "Alberto Ricart",
"author_login": "aricart",
"committed_at": "2025-08-08T14:18:41Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "953e18bb32057b7d5a08fc1a966915a9e76c9bea",
"body": "This would be used in the server to enforce that a user connects\nthrough a trusted proxy.\n\nSigned-off-by: Ivan Kozlovic <ivan@synadia.com>",
"is_bot": false,
"headline": "[ADDED] `ProxyRequired` user claims property (#239)",
"author_name": "Ivan Kozlovic",
"author_login": "kozlovic",
"committed_at": "2025-08-08T14:03:00Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "28e31bd445aeebe6a0bb93902baf91e43036c22c",
"body": "Signed-off-by: Alberto Ricart <alberto@synadia.com>",
"is_bot": false,
"headline": "bump golang.org/x/crypto fixing vulnerability (#238)",
"author_name": "Alberto Ricart",
"author_login": "aricart",
"committed_at": "2025-04-16T14:29:44Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "13f7264e0ea0eb7307d50ce4c117a4ece4f99959",
"body": "[ci skip]",
"is_bot": false,
"headline": "fix the link to go doc to go to v2 (#237)",
"author_name": "Alberto Ricart",
"author_login": "aricart",
"committed_at": "2024-12-19T17:10:44Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "a768c381b3ed3c634bfa6738ba34a4652456986d",
"body": "Upgraded `github.com/nats-io/nkeys` to v0.4.9, `golang.org/x/crypto` to v0.31.0, and `golang.org/x/sys` to v0.28.0. These updates ensure compatibility with the latest changes and include potential bug fixes and improvements. No functional changes were introduced in the codebase.\r\n\r\nSigned-off-by: Alberto Ricart <alberto@synadia.com>",
"is_bot": false,
"headline": "Update dependencies in go.mod and go.sum (#236)",
"author_name": "Alberto Ricart",
"author_login": "aricart",
"committed_at": "2024-12-13T16:48:25Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "698cd7e2aafd4e8fedefbdd5879dcade64c855eb",
"body": "* feat: Claims interface now has `EncodeWithSigner(nkeys.KeyPair`, fn: SignFn)` where signing can be delegated to a function. The `type SignFn func(pub string, data []byte) ([]byte, error)` is provided with the public key whose matching private key should be used to sign the provided payload.\r\n\r\nTh\n[…]\ning a JWT.\r\n\r\nSigned-off-by: Alberto Ricart <alberto@synadia.com>\r\n\r\n* go mod\r\n\r\nSigned-off-by: Alberto Ricart <alberto@synadia.com>\r\n\r\n---------\r\n\r\nSigned-off-by: Alberto Ricart <alberto@synadia.com>",
"is_bot": false,
"headline": "Allow external signing of JWTs (#234)",
"author_name": "Alberto Ricart",
"author_login": "aricart",
"committed_at": "2024-12-13T16:42:21Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "f9c7776a413358752942d078361ee8d13f15e2f4",
"body": "* Revert \"[CHANGE] Tags are now case-sensitive (#225)\"\r\n\r\nThis reverts commit de1f16b5781c771513bdc8de201e86bfa76f0325.\r\n\r\n* retract 2.7.0\r\n\r\nSigned-off-by: Alberto Ricart <alberto@synadia.com>\r\n\r\n---------\r\n\r\nSigned-off-by: Alberto Ricart <alberto@synadia.com>",
"is_bot": false,
"headline": "Retract case-insensitive tag functionality (#233)",
"author_name": "Alberto Ricart",
"author_login": "aricart",
"committed_at": "2024-10-09T19:35:56Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "18a60d6f7f84c2774c29cb926fe421df2deb5bc0",
"body": null,
"is_bot": false,
"headline": "[CHANGE] removing a tag that doesn't exist results in an error (#228)",
"author_name": "Alberto Ricart",
"author_login": "aricart",
"committed_at": "2024-09-17T15:32:41Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "de1f16b5781c771513bdc8de201e86bfa76f0325",
"body": "* [CHANGE] Tags (--tag and --rm-tag) are now case-sensitive. Previous versions of the library lowercased all tags. Now tags such as \"A\" and \"a\" are different.",
"is_bot": false,
"headline": "[CHANGE] Tags are now case-sensitive (#225)",
"author_name": "Alberto Ricart",
"author_login": "aricart",
"committed_at": "2024-09-17T14:09:22Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "2d9ece2f3a7a987c745e4f6d7d6ba02a74756577",
"body": "…ll need to perform some level of validation (#224)\n\n* Added validation to cluster traffic - as downstream tools like nsc will need to perform some level of validation\r\n* removed parsing of account for cluster traffic as that option will be delayed.",
"is_bot": false,
"headline": "Added validation to cluster traffic - as downstream tools like nsc wi…",
"author_name": "Alberto Ricart",
"author_login": "aricart",
"committed_at": "2024-09-13T16:28:03Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "4445fcd6be061ef9a37e02fdf5988bd80adb7d21",
"body": null,
"is_bot": false,
"headline": "Merge pull request #223 from nats-io/neil/accountnrg",
"author_name": "Neil",
"author_login": "neilalexander",
"committed_at": "2024-09-10T22:17:29Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "1378f5922cddb43d7776da60f100520aee0a6c59",
"body": "Signed-off-by: Neil Twigg <neil@nats.io>",
"is_bot": false,
"headline": "Fix lint errors, probably from new staticcheck version",
"author_name": "Neil Twigg",
"author_login": "neilalexander",
"committed_at": "2024-09-10T21:37:40Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "2e1251e5109465388c40eef4d5224c42edd03d11",
"body": "Signed-off-by: Neil Twigg <neil@nats.io>",
"is_bot": false,
"headline": "Update CI to use latest stable Go version",
"author_name": "Neil Twigg",
"author_login": "neilalexander",
"committed_at": "2024-09-10T09:32:32Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "bc9fb5fb3c2f2775b5398a43d401dc13a5668866",
"body": "For supporting nats-io/nats-server#5466.\n\nFor now expected values would be:\n* `\"system\"` - use the system account (default, as today)\n* `\"owner\"` - use the same account that owns the asset\n* `\"account:ACCNAME\"` - use a third specified `ACCNAME`\n\nSigned-off-by: Neil Twigg <neil@nats.io>",
"is_bot": false,
"headline": "Add `ClusterTraffic` to account claims",
"author_name": "Neil Twigg",
"author_login": "neilalexander",
"committed_at": "2024-09-10T09:25:22Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "ff68a3bc6bb70f166b35232159cc9c96aaca4375",
"body": "…222)\n\nFixes https://github.com/nats-io/nsc/issues/657",
"is_bot": false,
"headline": "[FIX] accounting for weights in cluster should be handled separate (#…",
"author_name": "Alberto Ricart",
"author_login": "aricart",
"committed_at": "2024-07-05T14:31:12Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "41dad79143e9cff55e4bde8af4df7a40ad49786c",
"body": "Added `ConnectionTypeInProcess` to the `UserPermissionLimits.AllowedConnectionTypes`\r\nlist of possible types.\r\n\r\nSigned-off-by: Ivan Kozlovic <ivan@synadia.com>",
"is_bot": false,
"headline": "[ADDED] Connection type \"in process\" (#221)",
"author_name": "Ivan Kozlovic",
"author_login": "kozlovic",
"committed_at": "2024-05-09T16:08:51Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "1f3ff3245e5ebd478f98bd584ad1636430246c95",
"body": "…tween same name roles (#220)",
"is_bot": false,
"headline": "[FEAT] added a description to a scope role to enable tools discern be…",
"author_name": "Alberto Ricart",
"author_login": "aricart",
"committed_at": "2024-04-18T15:09:38Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "c2d30e2ffc632a1ea64030467e5a40e02e4158be",
"body": "When an account has a `Trace` field set with a `Destination`, if\r\nan incoming message has a `traceparent` header with proper flag\r\nindicating that the message should be trace, the `Sampling` integer\r\n(value in the range of [1..100]) allows tracing only a random\r\nsample of messages. The server will p\n[…]\nm number below 100\r\nand if that number is lower or equal to this `Sampling` value\r\nthen the trace will trigger. If above, the trace will not trigger.\r\n\r\nSigned-off-by: Ivan Kozlovic <ivan@synadia.com>",
"is_bot": false,
"headline": "[ADDED] Sampling in MsgTrace structure (#219)",
"author_name": "Ivan Kozlovic",
"author_login": "kozlovic",
"committed_at": "2024-02-22T16:57:27Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "38e07c55c548c54df98b709eef943fb1cffc28b1",
"body": "Signed-off-by: Caleb Lloyd <caleb@synadia.com>",
"is_bot": false,
"headline": "add omitempty to authorization.auth_users (#218)",
"author_name": "Caleb Lloyd",
"author_login": "caleblloyd",
"committed_at": "2024-02-16T21:07:39Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "069ee3e448b5443e77f7906d391bf7761e662dcb",
"body": null,
"is_bot": false,
"headline": "[UPDATE] update deps (#217)",
"author_name": "Alberto Ricart",
"author_login": "aricart",
"committed_at": "2024-02-15T17:08:56Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "ed3fbfa49a16cf4aced84aed9d527be532730ad4",
"body": "This is needed for the NATS Server distributed message tracing\r\nfeature.\r\n\r\nThis PR updates validation of a Subject to check for `.` at the\r\nfirst or last position and consecutive ones.\r\n\r\nThe validation of the Account.TraceDest also checks that the\r\ndestination does not have wildcards since this is\n[…]\nf-by: Ivan Kozlovic <ivan@synadia.com>\r\n\r\n* Added container for message trace options\r\n\r\nSigned-off-by: Ivan Kozlovic <ivan@synadia.com>\r\n\r\n---------\r\n\r\nSigned-off-by: Ivan Kozlovic <ivan@synadia.com>",
"is_bot": false,
"headline": "[ADDED] Import/Export.AllowTrace and Account.TraceDest (#216)",
"author_name": "Ivan Kozlovic",
"author_login": "kozlovic",
"committed_at": "2024-02-15T16:56:43Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "f923b10c0be0c8d24fdab7208733504c4887def5",
"body": "Bumps [golang.org/x/crypto](https://github.com/golang/crypto) from 0.14.0 to 0.17.0.\r\n- [Commits](https://github.com/golang/crypto/compare/v0.14.0...v0.17.0)\r\n\r\n---\r\nupdated-dependencies:\r\n- dependency-name: golang.org/x/crypto\r\n dependency-type: indirect\r\n...\r\n\r\nSigned-off-by: dependabot[bot] <support@github.com>\r\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
"is_bot": true,
"headline": "Bump golang.org/x/crypto from 0.14.0 to 0.17.0 in /v2 (#214)",
"author_name": "dependabot[bot]",
"author_login": "dependabot[bot]",
"committed_at": "2023-12-20T10:48:56Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "457367366f2ff72a3fefeed38b56a1da281476fb",
"body": null,
"is_bot": false,
"headline": "[BUMP] bump nkeys (#212)",
"author_name": "Alberto Ricart",
"author_login": "aricart",
"committed_at": "2023-10-31T16:15:48Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "012e7a3a42dce49e62a7f14662461ecf14a8d5fc",
"body": "…operations (#209)",
"is_bot": false,
"headline": "[FEAT] relax protocol names to allow for ws/wss for account resolver …",
"author_name": "Alberto Ricart",
"author_login": "aricart",
"committed_at": "2023-10-24T22:36:25Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "4b4f5502a8b3acb9fe78ecc86814dd3ec2c20a90",
"body": "… (#208)\n\nFix #200",
"is_bot": false,
"headline": "[FEAT] added convenience API GetTags() to Account/Operator/UserClaims…",
"author_name": "Alberto Ricart",
"author_login": "aricart",
"committed_at": "2023-09-18T15:52:19Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "a3a24780d2f287e5149de20aa40158045afbe868",
"body": "The discussions tab needs to be enabled.",
"is_bot": false,
"headline": "Fix issue config discussions link (#205)",
"author_name": "Byron Ruth",
"author_login": "bruth",
"committed_at": "2023-08-21T20:38:34Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "75d6d8701e5ca225078e10cf93e2e3ff98d5ecad",
"body": "Signed-off-by: Byron Ruth <byron@nats.io>",
"is_bot": false,
"headline": "Add issue forms (#204)",
"author_name": "Byron Ruth",
"author_login": "bruth",
"committed_at": "2023-08-21T20:26:01Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "44fe206dcc2696bfe1d1d53ac8da553caeaf26a0",
"body": null,
"is_bot": false,
"headline": "sort signing keys on marshal (#203)",
"author_name": "Seth Back",
"author_login": "sethjback",
"committed_at": "2023-08-21T20:24:27Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "c4f1fd0ca5889c20ba2ae5cca0e88d1cf964f60c",
"body": "…r setup that actually runs on a server (#198)",
"is_bot": false,
"headline": "[DOC] changed the main example to show a basic operator->account->use…",
"author_name": "Alberto Ricart",
"author_login": "aricart",
"committed_at": "2023-08-21T16:28:50Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "78a1bd080817e10534d03583c3e0c2569e42073e",
"body": "remove wildcard validation from mappings",
"is_bot": false,
"headline": "Merge pull request #202 from haisum/main",
"author_name": "Haisum Mussawir",
"author_login": null,
"committed_at": "2023-08-21T16:28:36Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "96b5387a7afcb092eeac24126f781fa628af2383",
"body": "Signed-off-by: haisum <haisum@synadia.com>",
"is_bot": false,
"headline": "remove wildcard validation from mappings",
"author_name": "haisum",
"author_login": null,
"committed_at": "2023-08-18T19:54:37Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "535a7674fb6149ba5d35297b3125b337ee281e13",
"body": "* [FEAT] allow callout service to generate users for any account, added constant `AnyAccount` for wildcard",
"is_bot": false,
"headline": "[FEAT] allow callout service to generate users for any account (#197)",
"author_name": "Alberto Ricart",
"author_login": "aricart",
"committed_at": "2023-03-24T16:02:18Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "11e1fdb1415310764b7678bc31a6e63c53e99edd",
"body": null,
"is_bot": false,
"headline": "Bump version for imminent release: 2.4.0",
"author_name": "Phil Pennock",
"author_login": "philpennock",
"committed_at": "2023-03-16T21:45:09Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "7018e50b6fccc7bda45d4bc692a1873f33afa879",
"body": "simplify AuthorizationResponse",
"is_bot": false,
"headline": "Merge pull request #189 from nats-io/simplify-response",
"author_name": "Waldemar Quevedo",
"author_login": "wallyqs",
"committed_at": "2023-03-16T21:41:56Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "7b33986cffa3bd7df2277d853249c385edf9315f",
"body": "- [FIX] fixed the DidSign for account claims to return true only if the signing key and the issuer account constraints met - this api is only used by nsc\n- [TEST] fixed test that used improper user JWT\n- [TEST] fixed tests that expected failure, but were out of order with a following test that now triggers the error\n\nrequired authorization claims subject to be the user public key from the request\nrequired audience in the authorization claim subject to be the public server key from the request",
"is_bot": false,
"headline": "added additional scrutiny to DidSign in the case of signing keys (#190)",
"author_name": "aricart",
"author_login": "aricart",
"committed_at": "2023-03-16T21:32:39Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "e3e39d66ad1c45611b8b058a0170b765f788d692",
"body": "Move all the top-level go code into v2/v1compat and explicitly refer to that,\r\nand with all other go.??? files removed, so that from the go module handling\r\nperspective, this is all in one Go module. This will prevent v1 code\r\nreferences from going out to Go modules and fetching old vulnerable code\n[…]\nvisible to tests in other software, such as nats-io/nats-account-server too.\r\n\r\nThis PR changes modules, imports, and CI test invocations, but makes no changes\r\nto the Go functionality of the library.",
"is_bot": false,
"headline": "overhaul jwt v2 and v1 inter-tangling (#195)",
"author_name": "Phil Pennock",
"author_login": "philpennock",
"committed_at": "2023-03-16T21:28:27Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "8d1c62fe17b1306a3fe18118b810fe45736e9d9e",
"body": "- [FIX] fixed the DidSign for account claims to return true only if the signing key and the issuer account constraints met - this api is only used by nsc\r\n- [TEST] fixed test that used improper user JWT\r\n- [TEST] fixed tests that expected failure, but were out of order with a following test that now triggers the error",
"is_bot": false,
"headline": "added additional scrutiny to DidSign in the case of signing keys (#190)",
"author_name": "Alberto Ricart",
"author_login": "aricart",
"committed_at": "2023-02-15T18:58:59Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "f135d4a5a6f99ff2705b7f1a8aca2949da33f2bb",
"body": "* [CI] github actions",
"is_bot": false,
"headline": "[chore] migrate ci to gha (#191)",
"author_name": "Alberto Ricart",
"author_login": "aricart",
"committed_at": "2023-02-15T18:49:09Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "bdf40fa3627bc5cd1f378bb94ba8ab26768a9c70",
"body": "Authorization Response and Server ID additions",
"is_bot": false,
"headline": "Merge pull request #186 from nats-io/auth-updates",
"author_name": "Derek Collison",
"author_login": "derekcollison",
"committed_at": "2022-12-27T17:05:42Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "146945d1bedc8ec8d8cda0cee8b20d2960174583",
"body": "…to a NATS server.\n\nAlso added in version, cluster and tags to the server info for an authorization request.\n\nSigned-off-by: Derek Collison <derek@nats.io>",
"is_bot": false,
"headline": "Added in a formal authorization response for propagating errors back …",
"author_name": "Derek Collison",
"author_login": "derekcollison",
"committed_at": "2022-12-26T22:45:25Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "ff7baa9e5e73489e49a6cf6062d26fc0ef0e11d9",
"body": "Force authorization requests to have a public user nkey.",
"is_bot": false,
"headline": "Merge pull request #185 from nats-io/user-nkey",
"author_name": "Derek Collison",
"author_login": "derekcollison",
"committed_at": "2022-12-14T23:34:35Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "1ddeceefd4542ce8909642ac83b71b751b329bc5",
"body": "This will be required for the user claim sent back from the authorization service to avoid replay attacks.\n\nSigned-off-by: Derek Collison <derek@nats.io>",
"is_bot": false,
"headline": "Force authorization requests to have a public user nkey.",
"author_name": "Derek Collison",
"author_login": "derekcollison",
"committed_at": "2022-12-14T21:33:16Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "a07c95dfa9e1a706fea0dadeb247a382ef6a5b54",
"body": "[ADDED] Xkeys support",
"is_bot": false,
"headline": "Merge pull request #182 from nats-io/xkeys",
"author_name": "Derek Collison",
"author_login": "derekcollison",
"committed_at": "2022-12-06T12:51:46Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "317149c3c5db01ea98dd1a5dfed4c8800826c40c",
"body": "The ServerID will now optionally include the public XKey from the server.\nAccountClaims can specify a public XKey for ExternalAuthorization that will force the server's authorization requests to be encrypted.\n\nNote go.mod changes are temporary to pull in staged xkeys PR. Once merged I will update.\n\nSigned-off-by: Derek Collison <derek@nats.io>",
"is_bot": false,
"headline": "Added in XKey support.",
"author_name": "Derek Collison",
"author_login": "derekcollison",
"committed_at": "2022-12-06T00:58:33Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "ec09c3a122ff202ed4c73f5fb272f881b36d45f9",
"body": "Some Updates",
"is_bot": false,
"headline": "Merge pull request #183 from nats-io/updates",
"author_name": "Derek Collison",
"author_login": "derekcollison",
"committed_at": "2022-12-05T23:02:55Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "c1f61ea53f7806b98d8be07917c91d70b84fe92a",
"body": "Signed-off-by: Derek Collison <derek@nats.io>",
"is_bot": false,
"headline": "Update travis.tml to go 1.19 and 1.18, update go modules version",
"author_name": "Derek Collison",
"author_login": "derekcollison",
"committed_at": "2022-12-05T22:58:02Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "4f532654e69662a82fab006a908f689970d2f79b",
"body": "Signed-off-by: Derek Collison <derek@nats.io>",
"is_bot": false,
"headline": "Remove ioutil",
"author_name": "Derek Collison",
"author_login": "derekcollison",
"committed_at": "2022-12-05T14:32:26Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "44198ae9f41fae1d579cc9674d28f37005c7c17e",
"body": "Signed-off-by: Derek Collison <derek@nats.io>",
"is_bot": false,
"headline": "go vet and go fmt",
"author_name": "Derek Collison",
"author_login": "derekcollison",
"committed_at": "2022-12-05T14:25:30Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "83b58fd548384c16c3101c22e13da899d2361a63",
"body": "…ecified (#181)",
"is_bot": false,
"headline": "[FIX] added validation where auth user is required if accounts are sp…",
"author_name": "Alberto Ricart",
"author_login": "aricart",
"committed_at": "2022-12-02T18:04:56Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "31baa5546134db61e7c2f6242aa3f1b873ec0627",
"body": "Added in an authorization request claims.",
"is_bot": false,
"headline": "Merge pull request #180 from nats-io/auth_request",
"author_name": "Derek Collison",
"author_login": "derekcollison",
"committed_at": "2022-12-02T14:11:17Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "bf796004f40fff71aed50f3a67686f96b953ba9d",
"body": "Signed-off-by: Derek Collison <derek@nats.io>",
"is_bot": false,
"headline": "Naming updates based on review feedback",
"author_name": "Derek Collison",
"author_login": "derekcollison",
"committed_at": "2022-12-02T14:04:21Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "8721d1a30789bbb20794b68ddf53b9bc41418ff1",
"body": "…or the NATS server.\n\nSigned-off-by: Derek Collison <derek@nats.io>",
"is_bot": false,
"headline": "Added in an authorization request claim for external authentication f…",
"author_name": "Derek Collison",
"author_login": "derekcollison",
"committed_at": "2022-12-02T13:58:22Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "ca3be3cbd866ece56191ac9b8fa274302b7abc10",
"body": "Add in support for external authorization for accounts.",
"is_bot": false,
"headline": "Merge pull request #179 from nats-io/auth_callout",
"author_name": "Derek Collison",
"author_login": "derekcollison",
"committed_at": "2022-12-01T23:24:32Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "f490b9052a670880ad044ba9da794e6a348adc98",
"body": "Signed-off-by: Derek Collison <derek@nats.io>",
"is_bot": false,
"headline": "Add in support for external authorization for accounts.",
"author_name": "Derek Collison",
"author_login": "derekcollison",
"committed_at": "2022-12-01T21:51:25Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "4a8a7328f44f94e4e9d4582fbd7f439100a2cd0e",
"body": "Release v2.3.0",
"is_bot": false,
"headline": "Merge pull request #178 from nats-io/release_2_3_0",
"author_name": "Ivan Kozlovic",
"author_login": "kozlovic",
"committed_at": "2022-06-28T20:01:56Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "58dfad6b83a61716ac242c27878b5b1da299a06e",
"body": "Signed-off-by: Ivan Kozlovic <ivan@synadia.com>",
"is_bot": false,
"headline": "Release v2.3.0",
"author_name": "Ivan Kozlovic",
"author_login": "kozlovic",
"committed_at": "2022-06-28T19:52:25Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "3bcd719cc7d083d359a1fbca2acb04a25103e264",
"body": "[add] DisallowBearerToken option to operator to disallow bearer = true",
"is_bot": false,
"headline": "Merge pull request #177 from nats-io/DisallowBearerToken",
"author_name": "Matthias Hanel",
"author_login": "matthiashanel",
"committed_at": "2022-05-09T18:01:18Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "b7cabf8dbe60a5235559a735400d84bdab1bacf6",
"body": "Signed-off-by: Matthias Hanel <mh@synadia.com>",
"is_bot": false,
"headline": "moved attribute to account",
"author_name": "Matthias Hanel",
"author_login": "matthiashanel",
"committed_at": "2022-05-09T16:59:55Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "9f4f1d5cc9778e59a02c345580814c19d845d7a7",
"body": "change 1 out of 3 for https://github.com/nats-io/nats-server/issues/3084",
"is_bot": false,
"headline": "[add] DisallowBearerToken option to operator to disallow bearer = true",
"author_name": "Matthias Hanel",
"author_login": "matthiashanel",
"committed_at": "2022-04-29T17:51:40Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "3b8532b48b96c7b018d61c646477f7bccaf33abe",
"body": "fix validation text",
"is_bot": false,
"headline": "Merge pull request #176 from nats-io/validation-text",
"author_name": "Matthias Hanel",
"author_login": "matthiashanel",
"committed_at": "2022-04-08T19:53:10Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "d3db06c2932324d92ec66a23dcf9caac3fa272fb",
"body": "Signed-off-by: Matthias Hanel <mh@synadia.com>",
"is_bot": false,
"headline": "fix validation text",
"author_name": "Matthias Hanel",
"author_login": "matthiashanel",
"committed_at": "2022-04-08T19:06:15Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "442af02fd36a57aa5b0f6b45c28f171eb2c4596d",
"body": "Adding max_ack_pending stream limit",
"is_bot": false,
"headline": "Merge pull request #174 from nats-io/max-ack-pending",
"author_name": "Matthias Hanel",
"author_login": "matthiashanel",
"committed_at": "2022-03-30T18:01:45Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "03a6fb27606bd094a397b17f420f8b3f3446d0a2",
"body": "Signed-off-by: Matthias Hanel <mh@synadia.com>",
"is_bot": false,
"headline": "Fix go 1.16 github actions staticcheck build issues",
"author_name": "Matthias Hanel",
"author_login": "matthiashanel",
"committed_at": "2022-03-30T17:54:51Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "c11dbed5c4caf2f57047ca165571088a10a6f09c",
"body": "Signed-off-by: Matthias Hanel <mh@synadia.com>",
"is_bot": false,
"headline": "Use t.Fatalf(...) instead of t.Fatal(fmt.Sprintf(...))",
"author_name": "Matthias Hanel",
"author_login": "matthiashanel",
"committed_at": "2022-03-30T17:26:24Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "9928008f35af8ef1c1e6d7475e90c30a049159a4",
"body": "Signed-off-by: Matthias Hanel <mh@synadia.com>",
"is_bot": false,
"headline": "Adding max_ack_pending stream limit",
"author_name": "Matthias Hanel",
"author_login": "matthiashanel",
"committed_at": "2022-03-30T17:26:21Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "5efd4536dd5c01f860191a1e9908dc4cb08cc1b1",
"body": "Switching MaxStreamBytes to Disk/Memory",
"is_bot": false,
"headline": "Merge pull request #173 from nats-io/maxmaxbytes-2",
"author_name": "Matthias Hanel",
"author_login": "matthiashanel",
"committed_at": "2022-03-28T22:21:44Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "2eedfe4932b246c504e3e5b1a0562081d58537c1",
"body": "And removing dependency on MaxBytesRequired\n\nSigned-off-by: Matthias Hanel <mh@synadia.com>",
"is_bot": false,
"headline": "Switching MaxStreamBytes to Disk/Memory",
"author_name": "Matthias Hanel",
"author_login": "matthiashanel",
"committed_at": "2022-03-28T22:07:42Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "3472a33220ba06f07b27c174f3a160d7ad46d047",
"body": "Adding max_max_bytes to limit the maximum value for max bytes",
"is_bot": false,
"headline": "Merge pull request #172 from nats-io/maxmaxbytes",
"author_name": "Matthias Hanel",
"author_login": "matthiashanel",
"committed_at": "2022-03-23T19:50:37Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "30ec1f4583a95097d52d11d7c8fbd5770a9fcc8e",
"body": "Signed-off-by: Matthias Hanel <mh@synadia.com>",
"is_bot": false,
"headline": "renaminb MaxMaxBytes to MaxStreamBytes",
"author_name": "Matthias Hanel",
"author_login": "matthiashanel",
"committed_at": "2022-03-23T19:34:17Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "3c80622308f6b0227c0765536e9199cfd2f6eed5",
"body": "Signed-off-by: Matthias Hanel <mh@synadia.com>",
"is_bot": false,
"headline": "Adding max_max_bytes to limit the maximum value for max bytes",
"author_name": "Matthias Hanel",
"author_login": "matthiashanel",
"committed_at": "2022-03-23T17:36:34Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "b65a1fb60b29b3dfe00ca03a835166d33b3f1ed5",
"body": "Replace HAResources with TieredLimits",
"is_bot": false,
"headline": "Merge pull request #169 from nats-io/tiers",
"author_name": "Matthias Hanel",
"author_login": "matthiashanel",
"committed_at": "2022-03-23T01:09:31Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "a1fd29b7d5757ae6987fbee5ea4f690cc5829a35",
"body": "Signed-off-by: Matthias Hanel <mh@synadia.com>",
"is_bot": false,
"headline": "Adding check for empty tier name",
"author_name": "Matthias Hanel",
"author_login": "matthiashanel",
"committed_at": "2022-03-22T17:16:34Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "afab08bdab408e12a70ed2c57ac0c5a6d76762d4",
"body": "Signed-off-by: Matthias Hanel <mh@synadia.com>",
"is_bot": false,
"headline": "Removed IsJSEnabled from JetStreamLimits",
"author_name": "Matthias Hanel",
"author_login": "matthiashanel",
"committed_at": "2022-03-22T17:16:34Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "c7a51045b15e21de6f66cc488f829565811f27b8",
"body": "Signed-off-by: Matthias Hanel <mh@synadia.com>",
"is_bot": false,
"headline": "add IsJSEnabled to operator",
"author_name": "Matthias Hanel",
"author_login": "matthiashanel",
"committed_at": "2022-03-22T17:16:33Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "97065db7e63601cd6b27341f753955c0a729f34f",
"body": "TieredLimits are mutually exclusive with JetStream limits\n\nSigned-off-by: Matthias Hanel <mh@synadia.com>",
"is_bot": false,
"headline": "Replace HAResources with TieredLimits",
"author_name": "Matthias Hanel",
"author_login": "matthiashanel",
"committed_at": "2022-03-22T17:16:30Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "a4dc57f25ef3e0e29b2147ac2a1bf1707e02197f",
"body": "Fix test deps",
"is_bot": false,
"headline": "Merge pull request #171 from nats-io/fix-testdeps",
"author_name": "Waldemar Quevedo",
"author_login": "wallyqs",
"committed_at": "2022-03-14T19:23:52Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "c3542f5ffb33d1f6e04103b7f2bfd039240d9e55",
"body": "Signed-off-by: Waldemar Quevedo <wally@synadia.com>",
"is_bot": false,
"headline": "Add script for testing and update Makefile",
"author_name": "Waldemar Quevedo",
"author_login": "wallyqs",
"committed_at": "2022-03-14T18:24:08Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "cbc856a8beb08a926a974ee77e6104d87ea3f888",
"body": "Only used for testing\n\nSigned-off-by: Waldemar Quevedo <wally@synadia.com>",
"is_bot": false,
"headline": "Remove indirect dependency on jwt v1",
"author_name": "Waldemar Quevedo",
"author_login": "wallyqs",
"committed_at": "2022-03-14T17:28:37Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "0ebff70bb0963daa37c706e5960818b0d6ad6e3f",
"body": "Update travis to Go 1.17",
"is_bot": false,
"headline": "Merge pull request #167 from nats-io/go_1_17",
"author_name": "Ivan Kozlovic",
"author_login": "kozlovic",
"committed_at": "2022-02-16T23:03:43Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "c9f0ca9fcf07a515b599a5ffce05e67a488c6283",
"body": "rename struct member HaResources to HAResources",
"is_bot": false,
"headline": "Merge pull request #166 from nats-io/ha-resources",
"author_name": "Matthias Hanel",
"author_login": "matthiashanel",
"committed_at": "2022-02-16T19:22:39Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "5be8995e08934c19c03c5a5da099fadf56010742",
"body": "Signed-off-by: Ivan Kozlovic <ivan@synadia.com>",
"is_bot": false,
"headline": "Update travis to Go 1.17",
"author_name": "Ivan Kozlovic",
"author_login": "kozlovic",
"committed_at": "2022-02-16T19:01:34Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "1e88c50fd302b04501d43a44147296805eb1bb69",
"body": "Signed-off-by: Matthias Hanel <mh@synadia.com>",
"is_bot": false,
"headline": "rename struct member HaResources to HAResources",
"author_name": "Matthias Hanel",
"author_login": "matthiashanel",
"committed_at": "2022-02-16T18:20:53Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "4b4a1c85619d16bd2aa59e41e94d8cdf2c1b7eca",
"body": "* Adding support for HA resources",
"is_bot": false,
"headline": "Adding support for HA resources (#165)",
"author_name": "Matthias Hanel",
"author_login": "matthiashanel",
"committed_at": "2022-02-08T17:44:25Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "58e87895b29641314818a5171038b73cff3bd25a",
"body": "* [FEATURE] Adding support for js max bytes required\r\n\r\nSigned-off-by: Matthias Hanel <mh@synadia.com>",
"is_bot": false,
"headline": "[FEATURE] Adding support for js max bytes required (#164)",
"author_name": "Matthias Hanel",
"author_login": "matthiashanel",
"committed_at": "2022-01-13T02:27:32Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "b87bc9cf336d182cff5afba51e7515893da95bba",
"body": "Adr 14",
"is_bot": false,
"headline": "Merge pull request #163 from nats-io/ADR-14",
"author_name": "Jean-Noël Moyne",
"author_login": "jnmoyne",
"committed_at": "2021-12-14T20:16:57Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "b991e3474e70adc228c509ea13a2c223a510a8ba",
"body": null,
"is_bot": false,
"headline": "IssuedAt is set by encode",
"author_name": "jnmoyne",
"author_login": "jnmoyne",
"committed_at": "2021-12-07T20:13:09Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "2406b1ff49e98e94b47040b2d951dafb271882b0",
"body": "…ob/main/adr/ADR-14.md",
"is_bot": false,
"headline": "Implements https://github.com/nats-io/nats-architecture-and-design/bl…",
"author_name": "jnmoyne",
"author_login": "jnmoyne",
"committed_at": "2021-12-06T23:48:18Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "fbbb4a5843511563d15bdd483f7ff3746aed0b36",
"body": "…ob/main/adr/ADR-14.md",
"is_bot": false,
"headline": "Implements https://github.com/nats-io/nats-architecture-and-design/bl…",
"author_name": "jnmoyne",
"author_login": "jnmoyne",
"committed_at": "2021-12-06T22:37:09Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "5474835bf2710001b83cc23d8c86d07b1bb75477",
"body": "Release v2.2.0",
"is_bot": false,
"headline": "Merge pull request #162 from nats-io/release_2_2_0",
"author_name": "Ivan Kozlovic",
"author_login": "kozlovic",
"committed_at": "2021-11-15T17:56:59Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "18ec093b4302783654e28b9aeb06e8afa28459c3",
"body": "Signed-off-by: Ivan Kozlovic <ivan@synadia.com>",
"is_bot": false,
"headline": "Release v2.2.0",
"author_name": "Ivan Kozlovic",
"author_login": "kozlovic",
"committed_at": "2021-11-15T17:03:38Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "ab1121ab4151fe0c6f99880f376483a929c4c058",
"body": "[ADDED] New websocket connection types",
"is_bot": false,
"headline": "Merge pull request #161 from nats-io/add_ws_conn_types",
"author_name": "Ivan Kozlovic",
"author_login": "kozlovic",
"committed_at": "2021-11-15T16:46:47Z",
"body_truncated": false,
"is_coding_agent": false
}
],
"releases_count": 46,
"commits_last_year": 11,
"latest_release_at": "2026-06-02T13:54:22Z",
"latest_release_tag": "v2.8.2",
"releases_from_tags": false,
"days_since_last_push": 49,
"active_weeks_last_year": 4,
"days_since_latest_release": 49,
"mean_days_between_releases": 77.4
},
"community": {
"has_readme": true,
"has_license": true,
"has_description": true,
"has_contributing": false,
"health_percentage": 37,
"has_issue_template": false,
"has_code_of_conduct": false,
"has_pull_request_template": false
},
"ecosystem": {
"packages": [
{
"name": "github.com/nats-io/jwt/v2",
"exists": true,
"license": null,
"keywords": [],
"ecosystem": "go",
"matches_repo": true,
"registry_url": "https://pkg.go.dev/github.com/nats-io/jwt/v2",
"is_deprecated": false,
"latest_version": "v2.8.2",
"repository_url": "https://github.com/nats-io/jwt",
"versions_count": 27,
"total_downloads": null,
"dependents_count": null,
"deprecation_note": null,
"maintainers_count": null,
"monthly_downloads": null,
"first_published_at": null,
"latest_published_at": "2026-06-02T13:53:38Z",
"latest_version_yanked": null,
"days_since_latest_publish": 49
}
]
},
"popularity": {
"forks": 37,
"stars": 88,
"watchers": 3,
"fork_history": {
"days": [
{
"date": "2018-12-16",
"count": 1
},
{
"date": "2019-03-01",
"count": 1
},
{
"date": "2019-08-09",
"count": 1
},
{
"date": "2019-09-22",
"count": 1
},
{
"date": "2019-12-05",
"count": 1
},
{
"date": "2020-02-12",
"count": 1
},
{
"date": "2020-03-12",
"count": 1
},
{
"date": "2020-05-22",
"count": 1
},
{
"date": "2020-10-14",
"count": 1
},
{
"date": "2020-10-28",
"count": 1
},
{
"date": "2020-12-21",
"count": 1
},
{
"date": "2021-05-12",
"count": 1
},
{
"date": "2021-07-20",
"count": 2
},
{
"date": "2021-08-06",
"count": 1
},
{
"date": "2021-08-24",
"count": 1
},
{
"date": "2021-09-28",
"count": 1
},
{
"date": "2022-03-03",
"count": 1
},
{
"date": "2022-11-30",
"count": 1
},
{
"date": "2023-01-20",
"count": 1
},
{
"date": "2023-04-03",
"count": 1
},
{
"date": "2023-07-03",
"count": 1
},
{
"date": "2023-07-20",
"count": 1
},
{
"date": "2023-08-18",
"count": 1
},
{
"date": "2023-10-24",
"count": 1
},
{
"date": "2024-10-28",
"count": 1
},
{
"date": "2025-04-26",
"count": 1
},
{
"date": "2025-04-27",
"count": 1
},
{
"date": "2025-04-29",
"count": 1
},
{
"date": "2025-07-09",
"count": 1
},
{
"date": "2025-07-11",
"count": 1
},
{
"date": "2025-08-23",
"count": 1
},
{
"date": "2026-02-17",
"count": 1
},
{
"date": "2026-02-20",
"count": 1
},
{
"date": "2026-03-05",
"count": 1
},
{
"date": "2026-06-21",
"count": 1
}
],
"complete": true,
"collected": 36,
"total_forks": 37
},
"star_history": {
"days": [
{
"date": "2018-10-15",
"count": 1
},
{
"date": "2018-12-16",
"count": 1
},
{
"date": "2018-12-21",
"count": 1
},
{
"date": "2019-03-01",
"count": 1
},
{
"date": "2019-03-24",
"count": 1
},
{
"date": "2019-04-16",
"count": 1
},
{
"date": "2019-06-17",
"count": 1
},
{
"date": "2019-07-06",
"count": 1
},
{
"date": "2019-07-20",
"count": 1
},
{
"date": "2019-07-31",
"count": 2
},
{
"date": "2019-08-01",
"count": 1
},
{
"date": "2019-08-05",
"count": 1
},
{
"date": "2019-08-14",
"count": 1
},
{
"date": "2019-08-19",
"count": 1
},
{
"date": "2019-09-04",
"count": 1
},
{
"date": "2019-09-17",
"count": 1
},
{
"date": "2019-09-18",
"count": 1
},
{
"date": "2019-09-19",
"count": 1
},
{
"date": "2019-12-03",
"count": 1
},
{
"date": "2019-12-04",
"count": 1
},
{
"date": "2019-12-05",
"count": 1
},
{
"date": "2020-01-13",
"count": 1
},
{
"date": "2020-01-19",
"count": 1
},
{
"date": "2020-03-05",
"count": 1
},
{
"date": "2020-03-15",
"count": 1
},
{
"date": "2020-03-20",
"count": 1
},
{
"date": "2020-05-08",
"count": 1
},
{
"date": "2020-05-24",
"count": 1
},
{
"date": "2020-07-05",
"count": 1
},
{
"date": "2020-09-04",
"count": 1
},
{
"date": "2020-09-27",
"count": 1
},
{
"date": "2020-10-07",
"count": 1
},
{
"date": "2020-10-31",
"count": 1
},
{
"date": "2020-12-11",
"count": 1
},
{
"date": "2020-12-13",
"count": 1
},
{
"date": "2021-01-27",
"count": 1
},
{
"date": "2021-02-05",
"count": 1
},
{
"date": "2021-03-22",
"count": 1
},
{
"date": "2021-04-25",
"count": 1
},
{
"date": "2021-05-12",
"count": 1
},
{
"date": "2021-09-29",
"count": 1
},
{
"date": "2021-10-22",
"count": 1
},
{
"date": "2021-12-20",
"count": 1
},
{
"date": "2022-01-14",
"count": 1
},
{
"date": "2022-02-21",
"count": 1
},
{
"date": "2022-03-03",
"count": 1
},
{
"date": "2022-03-22",
"count": 1
},
{
"date": "2022-03-29",
"count": 1
},
{
"date": "2022-05-03",
"count": 1
},
{
"date": "2022-07-16",
"count": 1
},
{
"date": "2022-08-14",
"count": 1
},
{
"date": "2022-09-21",
"count": 1
},
{
"date": "2022-11-04",
"count": 1
},
{
"date": "2022-12-17",
"count": 1
},
{
"date": "2023-01-16",
"count": 1
},
{
"date": "2023-01-24",
"count": 1
},
{
"date": "2023-02-22",
"count": 1
},
{
"date": "2023-03-06",
"count": 2
},
{
"date": "2023-03-21",
"count": 1
},
{
"date": "2023-03-25",
"count": 1
},
{
"date": "2023-04-24",
"count": 1
},
{
"date": "2023-08-25",
"count": 1
},
{
"date": "2023-09-07",
"count": 1
},
{
"date": "2024-03-23",
"count": 1
},
{
"date": "2024-03-25",
"count": 1
},
{
"date": "2024-04-21",
"count": 1
},
{
"date": "2024-06-17",
"count": 1
},
{
"date": "2024-06-27",
"count": 1
},
{
"date": "2024-07-10",
"count": 1
},
{
"date": "2024-07-18",
"count": 1
},
{
"date": "2024-07-27",
"count": 1
},
{
"date": "2024-09-25",
"count": 2
},
{
"date": "2025-02-03",
"count": 1
},
{
"date": "2025-03-27",
"count": 1
},
{
"date": "2025-04-04",
"count": 1
},
{
"date": "2025-04-26",
"count": 1
},
{
"date": "2025-05-20",
"count": 1
},
{
"date": "2025-06-04",
"count": 1
},
{
"date": "2025-09-09",
"count": 1
},
{
"date": "2025-10-05",
"count": 1
},
{
"date": "2025-10-28",
"count": 1
},
{
"date": "2026-01-19",
"count": 1
},
{
"date": "2026-02-23",
"count": 1
},
{
"date": "2026-06-07",
"count": 1
}
],
"complete": true,
"collected": 87,
"total_stars": 88
},
"open_issues_and_prs": 14
},
"ai_readiness": {
"has_nix": false,
"example_dirs": [],
"has_llms_txt": false,
"has_dockerfile": false,
"has_mcp_signal": false,
"bootstrap_files": [
"v2/Makefile",
"v2/v1compat/Makefile"
],
"api_schema_files": [],
"has_devcontainer": false,
"typecheck_configs": [],
"toolchain_manifests": [
"v2/go.mod"
],
"largest_source_bytes": 31695,
"source_files_sampled": 66,
"oversized_source_files": 0,
"agent_instruction_files": [],
"agent_instruction_max_bytes": null
},
"dependencies": {
"manifests": [
"v2/go.mod"
],
"advisories": {
"error": null,
"scope": "repository_graph",
"source": "osv",
"findings": [
{
"name": "github.com/nats-io/jwt",
"direct": false,
"version": "1.2.2",
"severity": "critical",
"ecosystem": "go",
"cvss_score": null,
"advisory_ids": [
"GHSA-62mh-w5cv-p88c",
"GO-2022-0386"
],
"fixed_version": "2.0.1",
"advisory_count": 2,
"oldest_advisory_days": 1618
},
{
"name": "golang.org/x/crypto",
"direct": false,
"version": "v0.52.0",
"severity": "unknown",
"ecosystem": "go",
"cvss_score": null,
"advisory_ids": [
"GO-2026-5932"
],
"fixed_version": null,
"advisory_count": 1,
"oldest_advisory_days": 14
}
],
"collected": true,
"malicious": [],
"truncated": false,
"by_severity": {
"unknown": 1,
"critical": 1
},
"advisory_count": 3,
"affected_count": 2,
"assessed_count": 5,
"malicious_count": 0,
"assessed_package": null,
"unassessed_count": 0,
"direct_affected_count": 0
},
"ecosystems": [
"go"
],
"dependencies": [
{
"name": "github.com/nats-io/nkeys",
"manifest": "v2/go.mod",
"ecosystem": "go",
"version_constraint": "v0.4.16"
}
],
"all_dependencies": {
"error": null,
"source": "github-sbom",
"packages": [
{
"name": "github.com/nats-io/nkeys",
"direct": true,
"version": "0.3.0",
"ecosystem": "go"
},
{
"name": "github.com/nats-io/nkeys",
"direct": true,
"version": "v0.4.16",
"ecosystem": "go"
},
{
"name": "github.com/nats-io/jwt",
"direct": false,
"version": "1.2.2",
"ecosystem": "go"
},
{
"name": "golang.org/x/crypto",
"direct": false,
"version": "v0.52.0",
"ecosystem": "go"
},
{
"name": "golang.org/x/sys",
"direct": false,
"version": "v0.45.0",
"ecosystem": "go"
}
],
"collected": true,
"truncated": false,
"total_count": 5,
"direct_count": 2,
"indirect_count": 3
}
},
"maintainership": {
"issues": {
"open_prs": 1,
"merged_prs": 188,
"open_issues": 13,
"closed_ratio": 0.594,
"closed_issues": 19,
"closed_unmerged_prs": 27
},
"bus_factor": 2,
"bot_contributors": 1,
"top_contributors": [
{
"type": "User",
"login": "aricart",
"commits": 96,
"avatar_url": "https://avatars.githubusercontent.com/u/1032976?v=4"
},
{
"type": "User",
"login": "matthiashanel",
"commits": 71,
"avatar_url": "https://avatars.githubusercontent.com/u/19881388?v=4"
},
{
"type": "User",
"login": "derekcollison",
"commits": 47,
"avatar_url": "https://avatars.githubusercontent.com/u/90097?v=4"
},
{
"type": "User",
"login": "kozlovic",
"commits": 46,
"avatar_url": "https://avatars.githubusercontent.com/u/13736691?v=4"
},
{
"type": "User",
"login": "sasbury",
"commits": 10,
"avatar_url": "https://avatars.githubusercontent.com/u/3311569?v=4"
},
{
"type": "User",
"login": "wallyqs",
"commits": 8,
"avatar_url": "https://avatars.githubusercontent.com/u/26195?v=4"
},
{
"type": "User",
"login": "jnmoyne",
"commits": 4,
"avatar_url": "https://avatars.githubusercontent.com/u/7819096?v=4"
},
{
"type": "User",
"login": "neilalexander",
"commits": 4,
"avatar_url": "https://avatars.githubusercontent.com/u/310854?v=4"
},
{
"type": "User",
"login": "henryleduc",
"commits": 3,
"avatar_url": "https://avatars.githubusercontent.com/u/55436491?v=4"
},
{
"type": "User",
"login": "philpennock",
"commits": 3,
"avatar_url": "https://avatars.githubusercontent.com/u/559098?v=4"
}
],
"contributors_sampled": 16,
"top_contributor_share": 0.32
},
"quality_signals": {
"has_ci": true,
"has_tests": true,
"ci_workflows": [
"claude.yaml",
"go-test.yaml"
],
"has_docs_dir": false,
"linter_configs": [],
"has_editorconfig": false,
"has_linter_config": false,
"has_precommit_config": false
},
"security_signals": {
"lockfiles": [
"go.sum"
],
"scorecard": {
"checks": [
{
"name": "Binary-Artifacts",
"score": 10,
"reason": "no binaries found in the repo",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#binary-artifacts"
},
{
"name": "Branch-Protection",
"score": null,
"reason": "internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#branch-protection"
},
{
"name": "CI-Tests",
"score": 4,
"reason": "11 out of 27 merged PRs checked by a CI test -- score normalized to 4",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#ci-tests"
},
{
"name": "CII-Best-Practices",
"score": 0,
"reason": "no effort to earn an OpenSSF best practices badge detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#cii-best-practices"
},
{
"name": "Code-Review",
"score": 10,
"reason": "all changesets reviewed",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#code-review"
},
{
"name": "Contributors",
"score": 10,
"reason": "project has 5 contributing companies or organizations",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#contributors"
},
{
"name": "Dangerous-Workflow",
"score": 10,
"reason": "no dangerous workflow patterns detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dangerous-workflow"
},
{
"name": "Dependency-Update-Tool",
"score": 10,
"reason": "update tool detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dependency-update-tool"
},
{
"name": "Fuzzing",
"score": 0,
"reason": "project is not fuzzed",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#fuzzing"
},
{
"name": "License",
"score": 10,
"reason": "license file detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#license"
},
{
"name": "Maintained",
"score": 1,
"reason": "2 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 1",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#maintained"
},
{
"name": "Packaging",
"score": null,
"reason": "packaging workflow not detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#packaging"
},
{
"name": "Pinned-Dependencies",
"score": 0,
"reason": "dependency not pinned by hash detected -- score normalized to 0",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#pinned-dependencies"
},
{
"name": "SAST",
"score": 3,
"reason": "SAST tool is not run on all commits -- score normalized to 3",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#sast"
},
{
"name": "Security-Policy",
"score": 0,
"reason": "security policy file not detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#security-policy"
},
{
"name": "Signed-Releases",
"score": null,
"reason": "no releases found",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#signed-releases"
},
{
"name": "Token-Permissions",
"score": 0,
"reason": "detected GitHub workflow tokens with excessive permissions",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#token-permissions"
},
{
"name": "Vulnerabilities",
"score": 9,
"reason": "1 existing vulnerabilities detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#vulnerabilities"
}
],
"commit": "82017236da50e4a0173091105d82d46228b8dccf",
"ran_at": "2026-07-22T07:18:17Z",
"aggregate_score": 5.6,
"scorecard_version": "v5.5.0"
},
"has_codeql_workflow": false,
"has_security_policy": false,
"has_dependabot_config": false
},
"contribution_flow": {
"collected": true,
"ci_last_run_at": "2026-07-15T17:54:58Z",
"oldest_open_prs": [
{
"number": 210,
"created_at": "2023-10-25T18:44:30Z",
"last_comment_at": null,
"last_comment_author": null
}
],
"last_merged_pr_at": "2026-06-02T13:53:39Z",
"ci_last_conclusion": "SUCCESS",
"oldest_open_issues": [
{
"number": 30,
"created_at": "2019-04-09T23:24:12Z",
"last_comment_at": null,
"last_comment_author": null
},
{
"number": 63,
"created_at": "2019-12-19T13:44:00Z",
"last_comment_at": null,
"last_comment_author": null
},
{
"number": 65,
"created_at": "2019-12-19T13:49:31Z",
"last_comment_at": null,
"last_comment_author": null
},
{
"number": 83,
"created_at": "2020-06-24T22:22:23Z",
"last_comment_at": null,
"last_comment_author": null
},
{
"number": 84,
"created_at": "2020-06-24T22:23:32Z",
"last_comment_at": null,
"last_comment_author": null
},
{
"number": 101,
"created_at": "2020-09-22T18:09:41Z",
"last_comment_at": null,
"last_comment_author": null
},
{
"number": 112,
"created_at": "2020-10-24T02:40:51Z",
"last_comment_at": null,
"last_comment_author": null
},
{
"number": 118,
"created_at": "2020-11-24T22:50:51Z",
"last_comment_at": "2020-11-24T23:36:28Z",
"last_comment_author": "philpennock"
},
{
"number": 123,
"created_at": "2020-12-04T18:14:50Z",
"last_comment_at": null,
"last_comment_author": null
},
{
"number": 170,
"created_at": "2022-03-14T15:06:58Z",
"last_comment_at": null,
"last_comment_author": null
},
{
"number": 199,
"created_at": "2023-05-06T22:38:00Z",
"last_comment_at": "2023-12-18T12:13:31Z",
"last_comment_author": "ahirner"
},
{
"number": 207,
"created_at": "2023-08-25T19:58:54Z",
"last_comment_at": "2023-08-25T20:19:04Z",
"last_comment_author": "aricart"
},
{
"number": 249,
"created_at": "2026-04-23T08:18:19Z",
"last_comment_at": "2026-04-23T13:56:26Z",
"last_comment_author": "choufraise"
}
]
}
},
"config": {
"disabled_metrics": [],
"disabled_categories": [],
"disabled_components": {}
},
"source": {
"url": "https://github.com/nats-io/jwt",
"host": "github.com",
"name": "jwt",
"owner": "nats-io"
},
"metrics": {
"overall": {
"key": "overall",
"band": "moderate",
"name": "Overall health",
"note": null,
"notes": [],
"value": 61,
"inputs": {
"security": 65,
"vitality": 56,
"community": 48,
"governance": 78,
"engineering": 54
},
"components": []
},
"categories": [
{
"key": "vitality",
"band": "moderate",
"name": "Vitality",
"value": 56,
"weight": 0.22,
"metrics": [
{
"key": "development_activity",
"band": "at_risk",
"name": "Development activity",
"note": null,
"notes": [],
"value": 32,
"inputs": {
"commits_last_year": 11,
"human_commit_share": 0.99,
"days_since_last_push": 49,
"active_weeks_last_year": 4
},
"components": [
{
"key": "push_recency",
"name": "Push recency",
"detail": "last push 49 days ago",
"points": 18,
"status": "partial",
"details": [
{
"code": "push_recency",
"params": {
"days": 49
}
}
],
"max_points": 36
},
{
"key": "commit_cadence",
"name": "Commit cadence",
"detail": "4/52 weeks with commits",
"points": 2.8,
"status": "partial",
"details": [
{
"code": "commit_cadence_weeks",
"params": {
"weeks": 4
}
}
],
"max_points": 36
},
{
"key": "commit_volume",
"name": "Commit volume",
"detail": "11 commits in the last year",
"points": 9.7,
"status": "partial",
"details": [
{
"code": "commits_last_year",
"params": {
"count": 11
}
}
],
"max_points": 18
},
{
"key": "openssf_scorecard_maintained",
"name": "OpenSSF Scorecard: Maintained",
"detail": "2 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 1",
"points": 1,
"status": "partial",
"details": [],
"max_points": 10
}
]
},
{
"key": "release_discipline",
"band": "excellent",
"name": "Release discipline",
"note": "Excluded from scoring (no data or not applicable): OpenSSF Scorecard: Signed-Releases. Remaining weights renormalized.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"openssf_scorecard_signed_releases"
]
}
},
{
"code": "weights_renormalized",
"params": {}
}
],
"value": 92,
"inputs": {
"releases_count": 46,
"latest_release_tag": "v2.8.2",
"releases_from_tags": false,
"days_since_latest_release": 49,
"mean_days_between_releases": 77.4
},
"components": [
{
"key": "ships_releases",
"name": "Ships releases",
"detail": "46 releases published",
"points": 27,
"status": "met",
"details": [
{
"code": "releases_published",
"params": {
"count": 46
}
}
],
"max_points": 27
},
{
"key": "release_recency",
"name": "Release recency",
"detail": "latest release 49 days ago",
"points": 36,
"status": "met",
"details": [
{
"code": "release_recency",
"params": {
"days": 49
}
}
],
"max_points": 36
},
{
"key": "release_cadence",
"name": "Release cadence",
"detail": "a release every ~77.4 days",
"points": 19.8,
"status": "partial",
"details": [
{
"code": "release_cadence",
"params": {
"gap": 77.4
}
}
],
"max_points": 27
},
{
"key": "openssf_scorecard_signed_releases",
"name": "OpenSSF Scorecard: Signed-Releases",
"detail": "no releases found",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_data",
"params": {}
}
],
"max_points": 10
}
]
},
{
"key": "abandonment",
"band": "excellent",
"name": "Abandonment",
"note": null,
"notes": [],
"value": 100,
"inputs": {
"cap": null,
"state": "maintained",
"guards": [],
"signals": [],
"red_flag": false,
"multiplier_pct": 100,
"declared_reason": null,
"unverified_reason": null,
"unanswered_open_prs": null,
"unanswered_open_issues": null,
"days_since_last_merged_pr": null,
"days_since_last_human_commit": 49,
"days_since_last_human_commit_is_floor": false
},
"components": [
{
"key": "project_is_still_maintained",
"name": "Project is still maintained",
"detail": "last human commit 49 days ago",
"points": 100,
"status": "met",
"details": [
{
"code": "abandonment_maintained",
"params": {
"days": 49
}
}
],
"max_points": 100
}
]
}
],
"description": "Is the project alive — is code being written and are releases shipping?"
},
{
"key": "community",
"band": "at_risk",
"name": "Community & Adoption",
"value": 48,
"weight": 0.18,
"metrics": [
{
"key": "popularity",
"band": "at_risk",
"name": "Popularity & adoption",
"note": null,
"notes": [],
"value": 46,
"inputs": {
"forks": 37,
"stars": 88,
"watchers": 3,
"growth_state": "unverified",
"growth_factor_pct": 100,
"growth_unverified_reason": "below_threshold"
},
"components": [
{
"key": "stars",
"name": "Stars",
"detail": "88 stars",
"points": 31.5,
"status": "partial",
"details": [
{
"code": "stars",
"params": {
"count": 88
}
}
],
"max_points": 60
},
{
"key": "forks",
"name": "Forks",
"detail": "37 forks",
"points": 13,
"status": "partial",
"details": [
{
"code": "forks",
"params": {
"count": 37
}
}
],
"max_points": 25
},
{
"key": "watchers",
"name": "Watchers",
"detail": "3 watchers",
"points": 1.7,
"status": "partial",
"details": [
{
"code": "watchers",
"params": {
"count": 3
}
}
],
"max_points": 15
}
]
},
{
"key": "community_health",
"band": "moderate",
"name": "Community health",
"note": null,
"notes": [],
"value": 50,
"inputs": {
"has_readme": true,
"has_license": true,
"has_contributing": false,
"has_issue_template": false,
"has_code_of_conduct": false,
"has_pull_request_template": false
},
"components": [
{
"key": "readme",
"name": "README",
"detail": null,
"points": 22.5,
"status": "met",
"details": [],
"max_points": 22.5
},
{
"key": "license",
"name": "License",
"detail": "recognized license (Apache-2.0)",
"points": 22.5,
"status": "met",
"details": [
{
"code": "license_standard",
"params": {}
},
{
"code": "license_spdx",
"params": {
"spdx": "Apache-2.0"
}
}
],
"max_points": 22.5
},
{
"key": "contributing_guide",
"name": "CONTRIBUTING guide",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 18
},
{
"key": "code_of_conduct",
"name": "Code of conduct",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 13.5
},
{
"key": "issue_template",
"name": "Issue template",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.2
},
{
"key": "pr_template",
"name": "PR template",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 6.3
}
]
}
],
"description": "Does the project have users, downloads, attention, and a welcoming setup for contributors?"
},
{
"key": "governance",
"band": "good",
"name": "Sustainability & Governance",
"value": 78,
"weight": 0.24,
"metrics": [
{
"key": "maintainer_resilience",
"band": "moderate",
"name": "Maintainer resilience (bus factor)",
"note": null,
"notes": [],
"value": 64,
"inputs": {
"bus_factor": 2,
"contributors_sampled": 16,
"top_contributor_share": 0.32
},
"components": [
{
"key": "bus_factor",
"name": "Bus factor",
"detail": "2 contributor(s) cover half of all commits",
"points": 25.2,
"status": "partial",
"details": [
{
"code": "bus_factor",
"params": {
"count": 2
}
}
],
"max_points": 54
},
{
"key": "commit_distribution",
"name": "Commit distribution",
"detail": "top contributor authored 32% of commits",
"points": 15.3,
"status": "partial",
"details": [
{
"code": "top_contributor_share",
"params": {
"share": 32
}
}
],
"max_points": 22.5
},
{
"key": "contributor_breadth",
"name": "Contributor breadth",
"detail": "16 contributors",
"points": 13.5,
"status": "met",
"details": [
{
"code": "contributors_sampled",
"params": {
"count": 16
}
}
],
"max_points": 13.5
},
{
"key": "openssf_scorecard_contributors",
"name": "OpenSSF Scorecard: Contributors",
"detail": "project has 5 contributing companies or organizations",
"points": 10,
"status": "met",
"details": [],
"max_points": 10
}
]
},
{
"key": "responsiveness",
"band": "good",
"name": "Issue & PR responsiveness",
"note": null,
"notes": [],
"value": 76,
"inputs": {
"merged_prs": 188,
"open_issues": 13,
"closed_issues": 19,
"issue_closed_ratio": 0.594,
"closed_unmerged_prs": 27
},
"components": [
{
"key": "issue_resolution",
"name": "Issue resolution",
"detail": "59% of issues closed",
"points": 27.8,
"status": "partial",
"details": [
{
"code": "issues_closed_share",
"params": {
"share": 59
}
}
],
"max_points": 46.75
},
{
"key": "pr_acceptance",
"name": "PR acceptance",
"detail": "188/215 decided PRs merged",
"points": 33.4,
"status": "partial",
"details": [
{
"code": "decided_prs_merged",
"params": {
"merged": 188,
"decided": 215
}
}
],
"max_points": 38.25
},
{
"key": "openssf_scorecard_code_review",
"name": "OpenSSF Scorecard: Code-Review",
"detail": "all changesets reviewed",
"points": 15,
"status": "met",
"details": [],
"max_points": 15
}
]
},
{
"key": "stewardship",
"band": "good",
"name": "Ownership & stewardship",
"note": null,
"notes": [],
"value": 79,
"inputs": {
"followers": 2424,
"owner_type": "Organization",
"is_verified": null,
"owner_login": "nats-io",
"public_repos": 131,
"account_age_days": 4236
},
"components": [
{
"key": "ownership_backing",
"name": "Ownership backing",
"detail": "organization-owned",
"points": 30,
"status": "met",
"details": [
{
"code": "owner_organization",
"params": {}
}
],
"max_points": 30
},
{
"key": "verified_domain",
"name": "Verified domain",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 20
},
{
"key": "owner_reach",
"name": "Owner reach",
"detail": "2,424 followers of nats-io",
"points": 24.3,
"status": "partial",
"details": [
{
"code": "owner_followers",
"params": {
"count": 2424,
"login": "nats-io"
}
}
],
"max_points": 25
},
{
"key": "track_record",
"name": "Track record",
"detail": "131 public repos, account ~11 yr old",
"points": 25,
"status": "met",
"details": [
{
"code": "public_repos",
"params": {
"count": 131
}
},
{
"code": "account_age_years",
"params": {
"years": 11
}
}
],
"max_points": 25
}
]
},
{
"key": "package_maintenance",
"band": "excellent",
"name": "Package maintenance",
"note": null,
"notes": [],
"value": 100,
"inputs": {
"packages": [
"github.com/nats-io/jwt/v2"
],
"ecosystems": "go",
"any_deprecated": false,
"min_days_since_publish": 49
},
"components": [
{
"key": "published_resolvable",
"name": "Published & resolvable",
"detail": "1 package(s) on go",
"points": 25,
"status": "met",
"details": [
{
"code": "packages_published",
"params": {
"count": 1,
"ecosystems": "go"
}
}
],
"max_points": 25
},
{
"key": "publish_recency",
"name": "Publish recency",
"detail": "latest publish 49 days ago",
"points": 35,
"status": "met",
"details": [
{
"code": "publish_recency",
"params": {
"days": 49
}
}
],
"max_points": 35
},
{
"key": "version_history",
"name": "Version history",
"detail": "27 published versions",
"points": 20,
"status": "met",
"details": [
{
"code": "published_versions",
"params": {
"count": 27
}
}
],
"max_points": 20
},
{
"key": "not_deprecated",
"name": "Not deprecated",
"detail": "active, not deprecated or yanked",
"points": 20,
"status": "met",
"details": [
{
"code": "package_not_deprecated",
"params": {}
}
],
"max_points": 20
}
]
}
],
"description": "Will the project survive its people — bus factor, responsiveness, who backs it, and package upkeep?"
},
{
"key": "engineering",
"band": "moderate",
"name": "Engineering Quality",
"value": 54,
"weight": 0.2,
"metrics": [
{
"key": "engineering_practices",
"band": "moderate",
"name": "Engineering practices",
"note": null,
"notes": [],
"value": 56,
"inputs": {
"has_ci": true,
"has_tests": true,
"has_editorconfig": false,
"has_linter_config": false,
"has_precommit_config": false
},
"components": [
{
"key": "ci_workflows",
"name": "CI workflows",
"detail": "2 workflow(s)",
"points": 24,
"status": "met",
"details": [
{
"code": "ci_workflows",
"params": {
"count": 2
}
}
],
"max_points": 24
},
{
"key": "tests_present",
"name": "Tests present",
"detail": null,
"points": 24,
"status": "met",
"details": [],
"max_points": 24
},
{
"key": "linter_config",
"name": "Linter config",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 16
},
{
"key": "pre_commit_hooks",
"name": "Pre-commit hooks",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 9.6
},
{
"key": "editorconfig",
"name": ".editorconfig",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 6.4
},
{
"key": "openssf_scorecard_ci_tests",
"name": "OpenSSF Scorecard: CI-Tests",
"detail": "11 out of 27 merged PRs checked by a CI test -- score normalized to 4",
"points": 8,
"status": "partial",
"details": [],
"max_points": 20
}
]
},
{
"key": "documentation",
"band": "moderate",
"name": "Documentation",
"note": null,
"notes": [],
"value": 50,
"inputs": {
"topics": [],
"has_wiki": true,
"homepage": null,
"has_readme": true,
"has_docs_dir": false,
"has_description": true
},
"components": [
{
"key": "readme",
"name": "README",
"detail": null,
"points": 30,
"status": "met",
"details": [],
"max_points": 30
},
{
"key": "documentation_directory",
"name": "Documentation directory",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 25
},
{
"key": "documentation_homepage_site",
"name": "Documentation / homepage site",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 15
},
{
"key": "repository_description",
"name": "Repository description",
"detail": null,
"points": 10,
"status": "met",
"details": [],
"max_points": 10
},
{
"key": "topics",
"name": "Topics",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 10
},
{
"key": "wiki",
"name": "Wiki",
"detail": null,
"points": 10,
"status": "met",
"details": [],
"max_points": 10
}
]
}
],
"description": "Are baseline engineering and documentation practices in place?"
},
{
"key": "security",
"band": "moderate",
"name": "Security",
"value": 65,
"weight": 0.16,
"metrics": [
{
"key": "security_posture",
"band": "moderate",
"name": "Security posture",
"note": "Excluded from scoring (no data or not applicable): Branch-Protection, Packaging, Signed-Releases. Remaining weights renormalized.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"branch_protection",
"packaging",
"signed_releases"
]
}
},
{
"code": "weights_renormalized",
"params": {}
}
],
"value": 56,
"inputs": {
"source": "openssf_scorecard",
"checks_evaluated": 15,
"scorecard_version": "v5.5.0",
"checks_inconclusive": 3,
"scorecard_aggregate": 5.6
},
"components": [
{
"key": "binary_artifacts",
"name": "Binary-Artifacts",
"detail": "no binaries found in the repo",
"points": 7.5,
"status": "met",
"details": [],
"max_points": 7.5
},
{
"key": "branch_protection",
"name": "Branch-Protection",
"detail": "internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_data",
"params": {}
}
],
"max_points": 7.5
},
{
"key": "ci_tests",
"name": "CI-Tests",
"detail": "11 out of 27 merged PRs checked by a CI test -- score normalized to 4",
"points": 1,
"status": "partial",
"details": [],
"max_points": 2.5
},
{
"key": "cii_best_practices",
"name": "CII-Best-Practices",
"detail": "no effort to earn an OpenSSF best practices badge detected",
"points": 0,
"status": "missed",
"details": [],
"max_points": 2.5
},
{
"key": "code_review",
"name": "Code-Review",
"detail": "all changesets reviewed",
"points": 7.5,
"status": "met",
"details": [],
"max_points": 7.5
},
{
"key": "contributors",
"name": "Contributors",
"detail": "project has 5 contributing companies or organizations",
"points": 2.5,
"status": "met",
"details": [],
"max_points": 2.5
},
{
"key": "dangerous_workflow",
"name": "Dangerous-Workflow",
"detail": "no dangerous workflow patterns detected",
"points": 10,
"status": "met",
"details": [],
"max_points": 10
},
{
"key": "dependency_update_tool",
"name": "Dependency-Update-Tool",
"detail": "update tool detected",
"points": 7.5,
"status": "met",
"details": [],
"max_points": 7.5
},
{
"key": "fuzzing",
"name": "Fuzzing",
"detail": "project is not fuzzed",
"points": 0,
"status": "missed",
"details": [],
"max_points": 5
},
{
"key": "license",
"name": "License",
"detail": "license file detected",
"points": 2.5,
"status": "met",
"details": [],
"max_points": 2.5
},
{
"key": "maintained",
"name": "Maintained",
"detail": "2 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 1",
"points": 0.8,
"status": "partial",
"details": [],
"max_points": 7.5
},
{
"key": "packaging",
"name": "Packaging",
"detail": "packaging workflow not detected",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_data",
"params": {}
}
],
"max_points": 5
},
{
"key": "pinned_dependencies",
"name": "Pinned-Dependencies",
"detail": "dependency not pinned by hash detected -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 5
},
{
"key": "sast",
"name": "SAST",
"detail": "SAST tool is not run on all commits -- score normalized to 3",
"points": 1.5,
"status": "partial",
"details": [],
"max_points": 5
},
{
"key": "security_policy",
"name": "Security-Policy",
"detail": "security policy file not detected",
"points": 0,
"status": "missed",
"details": [],
"max_points": 5
},
{
"key": "signed_releases",
"name": "Signed-Releases",
"detail": "no releases found",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_data",
"params": {}
}
],
"max_points": 7.5
},
{
"key": "token_permissions",
"name": "Token-Permissions",
"detail": "detected GitHub workflow tokens with excessive permissions",
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.5
},
{
"key": "vulnerabilities",
"name": "Vulnerabilities",
"detail": "1 existing vulnerabilities detected",
"points": 6.8,
"status": "partial",
"details": [],
"max_points": 7.5
}
]
},
{
"key": "dependency_advisories",
"band": "excellent",
"name": "Dependency advisories",
"note": "Excluded from scoring (no data or not applicable): Indirect dependencies free of known advisories, No advisories left outstanding. Remaining weights renormalized. Matched 5 resolved dependencies against OSV. This repository publishes no package the index resolves, so the repository dependency graph was assessed instead. That graph mixes development and test pins with shipped dependencies, so only the declared runtime dependencies are scored; transitive findings are reported as context and excluded from the score. Reachability is not analyzed.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"indirect_dependencies_free_of_known_advisories",
"no_advisories_left_outstanding"
]
}
},
{
"code": "weights_renormalized",
"params": {}
},
{
"code": "advisories_scope_repository",
"params": {
"assessed": 5
}
},
{
"code": "advisories_repo_graph_caveat",
"params": {}
},
{
"code": "advisories_reachability",
"params": {}
}
],
"value": 100,
"inputs": {
"source": "osv",
"advisories": 3,
"affected_packages": 2,
"assessed_packages": 5,
"unassessed_packages": 0,
"affected_by_severity": "critical 1, unknown 1",
"direct_affected_packages": 0
},
"components": [
{
"key": "direct_dependencies_free_of_known_advisories",
"name": "Direct dependencies free of known advisories",
"detail": "no direct dependency carries a known advisory",
"points": 35,
"status": "met",
"details": [
{
"code": "no_direct_advisories",
"params": {}
}
],
"max_points": 35
},
{
"key": "indirect_dependencies_free_of_known_advisories",
"name": "Indirect dependencies free of known advisories",
"detail": "transitive set not separable from development and test dependencies in this scope",
"points": 0,
"status": "excluded",
"details": [
{
"code": "advisories_scope_not_separable",
"params": {}
}
],
"max_points": 25
},
{
"key": "no_advisories_left_outstanding",
"name": "No advisories left outstanding",
"detail": "no advisory carries a publication date",
"points": 0,
"status": "excluded",
"details": [
{
"code": "advisories_no_publication_date",
"params": {}
}
],
"max_points": 40
}
]
},
{
"key": "malicious_dependencies",
"band": "excellent",
"name": "Malicious dependencies",
"note": null,
"notes": [],
"value": 100,
"inputs": {
"source": "osv",
"meaning": "reported as a malicious package by the OpenSSF corpus; the remedy is removal or moving off the compromised name, never an upgrade of the same artifact. Versions the registry has since pulled are listed but not scored",
"packages": [],
"red_flag": false,
"assessed_packages": 5,
"malicious_packages": 0,
"direct_malicious_packages": 0,
"withdrawn_malicious_packages": 0,
"installable_malicious_packages": 0
},
"components": [
{
"key": "no_dependency_reported_as_a_malicious_package",
"name": "No dependency reported as a malicious package",
"detail": "no dependency is reported as a malicious package",
"points": 100,
"status": "met",
"details": [
{
"code": "no_malicious_dependencies",
"params": {}
}
],
"max_points": 100
}
]
},
{
"key": "high_risk_jurisdiction_exposure",
"band": "excellent",
"name": "High-Risk Jurisdiction Exposure",
"note": "Only high-confidence self-published location evidence affects this multiplier. Ambiguous matches are review-only; country evidence is not proof of nationality, citizenship, legal registration, malicious intent, or sanctions status.",
"notes": [
{
"code": "jurisdiction_evidence_limits",
"params": {}
}
],
"value": 100,
"inputs": {
"meaning": "self-published location evidence; not nationality or citizenship",
"red_flag": false,
"exposures": [],
"policy_countries": [
"Russia",
"Iran",
"North Korea"
],
"review_only_matches": 0,
"assessed_self_published_locations": 13
},
"components": [
{
"key": "policy_exposure_multiplier",
"name": "Policy exposure multiplier",
"detail": "no confirmed policy-scope location match",
"points": 100,
"status": "met",
"details": [
{
"code": "jurisdiction_no_match",
"params": {}
}
],
"max_points": 100
}
]
}
],
"description": "Are visible security and supply-chain practices strong, with no malicious dependency and no unresolved high-risk jurisdiction exposure?"
},
{
"key": "ai_readiness",
"band": "moderate",
"name": "AI Readiness",
"value": 62,
"weight": 0,
"metrics": [
{
"key": "ai_agent_context",
"band": "at_risk",
"name": "Agent context & guidance",
"note": null,
"notes": [],
"value": 34,
"inputs": {
"has_llms_txt": false,
"legible_history_share": 0.636,
"agent_instruction_files": [],
"agent_instruction_max_bytes": null
},
"components": [
{
"key": "agent_instructions",
"name": "Agent instructions",
"detail": "no CLAUDE.md / AGENTS.md / editor rules",
"points": 0,
"status": "missed",
"details": [
{
"code": "no_agent_instructions",
"params": {}
}
],
"max_points": 45
},
{
"key": "machine_readable_docs_llms_txt",
"name": "Machine-readable docs (llms.txt)",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 15
},
{
"key": "legible_commit_history",
"name": "Legible commit history",
"detail": "63 of 99 human commits state their intent (structured subject or explanatory body)",
"points": 33.9,
"status": "partial",
"details": [
{
"code": "legible_history",
"params": {
"legible": 63,
"sampled": 99
}
}
],
"max_points": 40
}
]
},
{
"key": "ai_verify_loop",
"band": "moderate",
"name": "Verify loop (build / test / typecheck)",
"note": null,
"notes": [],
"value": 69,
"inputs": {
"has_nix": false,
"has_tests": true,
"lockfiles": [
"go.sum"
],
"has_dockerfile": false,
"typed_language": true,
"bootstrap_files": [
"v2/Makefile",
"v2/v1compat/Makefile"
],
"has_devcontainer": false,
"has_linter_config": false,
"typecheck_configs": [],
"agent_commit_share": 0,
"toolchain_manifests": [
"v2/go.mod"
],
"dependency_bot_commit_share": 0.01
},
"components": [
{
"key": "one_command_bootstrap",
"name": "One-command bootstrap",
"detail": "v2/Makefile, v2/v1compat/Makefile",
"points": 18,
"status": "met",
"details": [
{
"code": "file_list",
"params": {
"files": "v2/Makefile, v2/v1compat/Makefile"
}
}
],
"max_points": 18
},
{
"key": "automated_tests",
"name": "Automated tests",
"detail": null,
"points": 22,
"status": "met",
"details": [],
"max_points": 22
},
{
"key": "lint_format_config",
"name": "Lint / format config",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 11
},
{
"key": "static_type_checking",
"name": "Static type checking",
"detail": "Go (statically typed)",
"points": 11,
"status": "met",
"details": [
{
"code": "statically_typed_language",
"params": {
"language": "Go"
}
}
],
"max_points": 11
},
{
"key": "reproducible_environment",
"name": "Reproducible environment",
"detail": "lockfile",
"points": 10,
"status": "met",
"details": [
{
"code": "file_list",
"params": {
"files": "lockfile"
}
}
],
"max_points": 10
},
{
"key": "demonstrated_agent_practice",
"name": "Demonstrated agent practice",
"detail": "no agent-authored commits among the last 100",
"points": 0,
"status": "missed",
"details": [
{
"code": "no_agent_authored_commits",
"params": {
"sampled": 100
}
}
],
"max_points": 10
},
{
"key": "automated_maintenance",
"name": "Automated maintenance",
"detail": "1 of the last 100 commits are automated dependency updates",
"points": 8,
"status": "met",
"details": [
{
"code": "dependency_bot_commits",
"params": {
"count": 1,
"sampled": 100
}
}
],
"max_points": 8
},
{
"key": "openssf_scorecard_pinned_dependencies",
"name": "OpenSSF Scorecard: Pinned-Dependencies",
"detail": "dependency not pinned by hash detected -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 10
}
]
},
{
"key": "ai_code_legibility",
"band": "excellent",
"name": "Code legibility for models",
"note": null,
"notes": [],
"value": 100,
"inputs": {
"primary_language": "Go",
"largest_source_bytes": 31695,
"source_files_sampled": 66,
"oversized_source_files": 0
},
"components": [
{
"key": "type_checkable_code",
"name": "Type-checkable code",
"detail": "Go (statically typed)",
"points": 45,
"status": "met",
"details": [
{
"code": "statically_typed_language",
"params": {
"language": "Go"
}
}
],
"max_points": 45
},
{
"key": "manageable_file_sizes",
"name": "Manageable file sizes",
"detail": "0/66 source files over 60KB",
"points": 55,
"status": "met",
"details": [
{
"code": "oversized_source_files",
"params": {
"kb": 60,
"sampled": 66,
"oversized": 0
}
}
],
"max_points": 55
}
]
}
],
"description": "How well is the repo equipped to be developed and maintained with AI coding agents? An independent, experimental badge — weight 0.0, so it is surfaced on its own and does not affect the overall health score."
}
],
"metrics_version": "1.13.0"
},
"warnings": [],
"report_type": "repository",
"generated_at": "2026-07-22T07:18:40.889999Z",
"schema_version": "0.26.0",
"badge_url": "https://raw.githubusercontent.com/inspect-software/badges/main/v1/n/nats-io/jwt.svg",
"full_name": "nats-io/jwt",
"license_state": "standard",
"license_spdx": "Apache-2.0"
}
Пов’язані записи
Перевірені репозиторії, що мають спільні каталожні теги або екосистеми з nats-io/jwt. Читати поруч →
Оцінки — це сигнали, а не гарантії. Вони відображають публічно видимі практики на GitHub — це не аудит коду й не гарантія безпеки.
Відсутні дані виключаються, а ваги перенормовуються — нуль за відсутність ніколи не ставиться. Методологія версіонована й відкрита: метрики v1.13.0, схема v0.26.0 — повна методологія · вікі метрик.
