nlohmann / json
Repository health
Security, maintenance, dependencies and license for nlohmann/json.
Security
1 dependency checked (1 direct), pypi, via deps.dev. Findings apply only to the packages and versions checked.
OpenSSF Scorecard · 8.6/10
Checks sorted from strongest to weakest.
- Recent activity30 commits and 24 issue activity found in the last 90 days10/10
- Security policySecurity policy file detected10/10
- Automated dependency updatesUpdate tool detected10/10
- No risky CI workflowsNo dangerous workflow patterns detected10/10
- No binaries in the repositoryNo binaries found in the repo10/10
- Least-privilege CI tokensGitHub workflow tokens follow principle of least privilege10/10
- Fuzz testingProject is fuzzed10/10
- License fileLicense file detected10/10
- Contributors from several organisationsProject has 47 contributing companies or organizations10/10
- Pinned dependenciesDependency not pinned by hash detected8/10
- Static analysis on commitsSAST tool detected but not run on all commits8/10
- Signed releases5 out of the last 5 releases have a total of 5 signed artifacts.8/10
- Code review before mergeFound 16/26 approved changesets6/10
- No known vulnerabilities4 existing vulnerabilities detected6/10
- Tests run on pull requests15 out of 30 merged PRs checked by a CI test5/10
- OpenSSF best-practices badgeBadge detected: InProgress2/10
- Published through a build pipelinePackaging workflow not detectednot scored
- Branch protectionScorecard could not run this check.not scored
Maintenance
Outside contributions: 0 of 4 external pull requests merged (0% of those decided).From the 84 most recently updated pull requests, bots excluded.
Pull requests
- Open
- 6
- 0 stale (60+ days, no update in 30)
- Merged
- 23
- of the 30 latest
- Median time to merge
- 1 day
- From bots
- 5
- not listed below
Open
- #5890 json_view: comparison without temporaries and a faster image float checknlohmann · opened 2 days ago
- #5601 Recover from parse errors when parse_error() returns truenlohmann · opened 26 days ago
- #5892 docs: cross-reference json_view and json_document for 3.13.0nlohmann · opened 2 days ago
- #5902 from_json: number-first dispatch for arithmetic types, loop for std::arraynlohmann · opened 1 day ago
- #5901 Consolidate duplicated detail helpers and bodies (#5891)nlohmann · opened 1 day ago
Recently merged
- #5882 Make the DOM parser cheaper per container and per membernlohmann · merged 24 Oct 2026
- #5888 json_view: faster reading, indexing and C-stream parsingnlohmann · merged 24 Oct 2026
- #5889 json_view: indented and ensure_ascii dumps through the fast writernlohmann · merged 24 Oct 2026
- #5899 Fix Semgrep findings in Python toolingnlohmann · merged 23 Oct 2026
- #5887 Split and print JSON pointers in one passnlohmann · merged 23 Oct 2026
The 30 most recently updated pull requests.
Top contributors
- nlohmann84 commits · 99%
- satelliteprogrammer1 commit · 1%
Of the 85 most recent commits.
Issues
- Open
- 26
- issues and pull requests, as GitHub counts them
- Median time to close
- 4 days
- from 7 closed of the 12 latest
- Awaiting first reply
- 0
- of 5 open among the 12 latest
- Oldest open
- 8.3 years
Rates come from the 12 most recently updated issues; the open count and oldest issue cover the whole repository.
Dependencies
Checked packages and import counts
These are the packages checked for known security issues, which may not be all of them. External imports are counted from the source code.
Packages pulled in by these were not checked.
License compatibility
Repo license: MIT · 1 deps checked · 1 potential conflict.
- astyleGPL-3.0-or-later
License
Dependency license conflicts
Dependencies whose license may be incompatible with MIT — worth a closer look before shipping.
- astyleGPL-3.0-or-later