github.com/dgrijalva/jwt-goGo

Verdict

Looks abandoned

github.com/dgrijalva/jwt-go appears abandoned — its repository has been archived, no commits for over 5 years. 26 of 99 open issues have had no reply. Plan a migration rather than waiting for a fix.

health 10/100

Why this verdict?

abandoned — No commits for over 365 days with unanswered issues piling up — or the registry marks it deprecated, or the repository is archived.

repository archived

Judged today from signal heuristics. How each verdict is decided

latest v3.2.0+incompatible
licence MIT
stars 10,732
checked today
registry ↗
repository ↗

Signals · last 1 check

Commits 90d

Open issues

Unanswered

Contributors

What the project says about itself

Open milestones — 4.0.0 20/21 done; 4.1.0 1/4 done. Source: the repository's milestones.
OpenSSF Scorecard — 2.8 / 10 on 2026-08-17. Source: OpenSSF, via deps.dev. A third party's view of security practice, not part of the health score.

Third-party facts checked today; registry facts on every crawl.

State history 1

When	Change
2026-09-04	first verdict: abandoned

Where to go instead 1

github.com/golang-jwt/jwt/v5 Drop-in replacement

Community successor; the original is abandoned and carries a known CVE

Change the import path and module requirement — the v5 API is source-compatible for common use.

Checked by hand.

Badge

Drop this in your README. It re-renders itself as the verdict changes.

[![maintenance](https://isitdeadyet.dev/badge/go/github.com/dgrijalva/jwt-go.svg)](https://isitdeadyet.dev/go/github.com/dgrijalva/jwt-go)

Watch it

Get told when github.com/dgrijalva/jwt-go changes state, changes licence, or is deprecated — instead of finding out during an incident.

Free for up to 25 packages. Signing in is a link sent to your email — there is no password to choose.