arthurdejong/python-stdnum: Watch

Decision in one minute

python-stdnum receives a Watch verdict with an overall score of 65. The primary concerns driving this rating are slow maintainer responsiveness, with a median response time of 39 days, and the absence of a formal security policy. These issues suggest potential risks if rapid fixes or coordinated vulnerability disclosures are needed.

Strengths

10 people committed in the last 365 days.
Source: 10 people committed in the last 365 days.
Licensed under LGPL-2.1 (OSI-approved).
Source: Licensed under LGPL-2.1 (OSI-approved).
1,351,224 downloads last week on PyPI.
Source: 1,351,224 downloads last week on PyPI.

Concerns

Median time to a first response from someone other than the author: 39 days (sample of 4 issues and 21 pull requests from the last 90 days).
Source: Median time to a first response from someone other than the author: 39 days (sample of 4 issues and 21 pull requests from the last 90 days).
No security policy (SECURITY.md) was found.
Source: No security policy (SECURITY.md) was found.

Verify before adopting

Check how critical bug reports and pull requests are handled given the 39 days median response time.Source: Median time to a first response from someone other than the author: 39 days (sample of 4 issues and 21 pull requests from the last 90 days).
Verify the process for reporting and patching vulnerabilities in the absence of a SECURITY.md file.

Uncertainty: Responsiveness metrics were derived from a limited sample of 4 issues and 21 pull requests from the last 90 days.

Written by Gemini Flash from the metrics and reasons below; every number was checked against the data, and the verdict and score come from fixed rules, not the model.

Explained

Why this verdict

2 concerns12 neutral4 positive

Score 65 from 100% of the weight; no hard gates applied.

ConcernMedian time to a first response from someone other than the author: 39 days (sample of 4 issues and 21 pull requests from the last 90 days).
ConcernNo security policy (SECURITY.md) was found.
NeutralOpenSSF Scorecard score is 4.3 out of 10.
NeutralNo GitHub security advisories published in the last 365 days.
NeutralLast commit to the default branch was 64 days ago.
Neutral31 commits in the last 365 days.
NeutralOSV has no vulnerability records for python-stdnum (PyPI).
NeutralLast release was 287 days ago (2.2).
Neutral1 release in the last 365 days.
NeutralMedian gap between releases over the last 2 years: 122 days.
NeutralMaintainers responded to 40 percent of sampled items.
NeutralThe most active contributor authored 58 percent of commits in the last 365 days.
NeutralGitHub community profile is 57 percent complete (informational).
Neutral604 GitHub stars (a weak signal on its own).
Positive10 people committed in the last 365 days.
PositiveLicensed under LGPL-2.1 (OSI-approved).
PositiveChecks on the default branch are passing.
Positive1,351,224 downloads last week on PyPI.

Breakdown

Nine dimensions

Security posture
Weight 20
43Risky
Source values
OpenSSF Scorecard
4.3 / 10OpenSSF Scorecard API · 19 Oct 2026, 05:14 UTC
Scorecard date
2026-10-12OpenSSF Scorecard API · 19 Oct 2026, 05:14 UTC
Advisories (365 days)
0GET /repos/{o}/{r}/security-advisories · 19 Oct 2026, 05:14 UTC
Known vulnerabilities
Weight 15
100Healthy
no records in OSV
Source values
Package
PyPI: python-stdnumEntered in admin
Latest version
2.2pypi.org JSON API · 19 Oct 2026, 05:14 UTC
Known vulnerabilities (all versions)
0OSV.dev POST /v1/query · 19 Oct 2026, 05:14 UTC
With a fixed version
0OSV.dev POST /v1/query · 19 Oct 2026, 05:14 UTC
Affecting the latest version
0queried with 2.2OSV.dev POST /v1/query · 19 Oct 2026, 05:14 UTC
Published in last 365 days
0OSV.dev POST /v1/query · 19 Oct 2026, 05:14 UTC
Most recent published
Not availableNo vulnerability recordsOSV.dev POST /v1/query · 19 Oct 2026, 05:14 UTC
Maintenance
Weight 15
70Watch
Source values
Archived
NoGET /repos/{owner}/{repo} · 19 Oct 2026, 05:14 UTC
Disabled
NoGET /repos/{owner}/{repo} · 19 Oct 2026, 05:14 UTC
Days since last default-branch commit
64 daysGET /repos/{o}/{r}/commits · 19 Oct 2026, 05:14 UTC
Commits in last 365 days
31GET /repos/{o}/{r}/commits · 19 Oct 2026, 05:14 UTC
Release cadence
Weight 10
46Risky
Source values
Days since last release
287 daysGET /repos/{o}/{r}/releases · 19 Oct 2026, 05:14 UTC
Releases in last 365 days
1GET /repos/{o}/{r}/releases · 19 Oct 2026, 05:14 UTC
Median days between releases (2 years)
122 daysover the last 2 yearsGET /repos/{o}/{r}/releases · 19 Oct 2026, 05:14 UTC
Uses GitHub Releases
YesGET /repos/{o}/{r}/releases · 19 Oct 2026, 05:14 UTC
Latest release
2.2GET /repos/{o}/{r}/releases · 19 Oct 2026, 05:14 UTC
Responsiveness
Weight 10
28Risky
sampled (25 items)
Source values
Issues sampled
4issues updated in the last 90 days, PRs excluded, bots excludedGET /repos/{o}/{r}/issues + /pulls (+ comments, reviews) · 19 Oct 2026, 05:14 UTC
Pull requests sampled
21pull requests updated in the last 90 days, bots excludedGET /repos/{o}/{r}/issues + /pulls (+ comments, reviews) · 19 Oct 2026, 05:14 UTC
Median time to first response
39 dayssampledGET /repos/{o}/{r}/issues + /pulls (+ comments, reviews) · 19 Oct 2026, 05:14 UTC
Share with a maintainer response
40%sampledGET /repos/{o}/{r}/issues + /pulls (+ comments, reviews) · 19 Oct 2026, 05:14 UTC
Maintainer depth
Weight 10
85Healthy
Source values
Distinct contributors (365 days)
10GET /repos/{o}/{r}/commits · 19 Oct 2026, 05:14 UTC
Top contributor's share of commits
58%GET /repos/{o}/{r}/commits · 19 Oct 2026, 05:14 UTC
Top contributor
arthurdejongGET /repos/{o}/{r}/commits · 19 Oct 2026, 05:14 UTC
Low bus factor
NoGET /repos/{o}/{r}/commits · 19 Oct 2026, 05:14 UTC
Governance and licensing
Weight 10
60Watch
Source values
License (SPDX)
LGPL-2.1GET /repos/{owner}/{repo} · 19 Oct 2026, 05:14 UTC
License status
OSI-approvedGET /repos/{owner}/{repo} + OSI list · 19 Oct 2026, 05:14 UTC
Security policy
NoGET /repos/{o}/{r}/contents/SECURITY.md (+ .github/, docs/) · 19 Oct 2026, 05:14 UTC
Code of conduct (info)
NoGET /repos/{o}/{r}/community/profile · 19 Oct 2026, 05:14 UTC
Contributing guide (info)
YesGET /repos/{o}/{r}/community/profile · 19 Oct 2026, 05:14 UTC
Issue templates (info)
NoGET /repos/{o}/{r}/community/profile · 19 Oct 2026, 05:14 UTC
Community profile (info)
57%GET /repos/{o}/{r}/community/profile · 19 Oct 2026, 05:14 UTC
CI health
Weight 5
100Healthy
Source values
Default-branch checks
PassingGET /repos/{o}/{r}/commits/{sha}/check-runs · 19 Oct 2026, 05:14 UTC
Method
check-runsGitHub · 19 Oct 2026, 05:14 UTC
Adoption
Weight 5
88Healthy
Source values
Weekly downloads
1,351,224PyPI via pypistats.org (last week) · 19 Oct 2026, 05:14 UTC
Stars (weak signal)
604GET /repos/{owner}/{repo} · 19 Oct 2026, 05:14 UTC
Forks (weak signal)
239GET /repos/{owner}/{repo} · 19 Oct 2026, 05:14 UTC
Dependents
Not availableNot collected: no reliable public source without scraping— · 19 Oct 2026, 05:14 UTC

Over time

Trend

Score moved from 66 to 65; the verdict stayed Watch.

2026-W42 WatchScore 66100% coverage
2026-W43 WatchScore 65100% coverageShown above

History

Decision log

No decision recorded yet. Status: Evaluating.

Why this verdict

2 concerns12 neutral4 positive

Score 65 from 100% of the weight; no hard gates applied.

ConcernMedian time to a first response from someone other than the author: 39 days (sample of 4 issues and 21 pull requests from the last 90 days).

ConcernNo security policy (SECURITY.md) was found.

NeutralOpenSSF Scorecard score is 4.3 out of 10.

NeutralNo GitHub security advisories published in the last 365 days.

NeutralLast commit to the default branch was 64 days ago.

Neutral31 commits in the last 365 days.

NeutralOSV has no vulnerability records for python-stdnum (PyPI).

NeutralLast release was 287 days ago (2.2).

Neutral1 release in the last 365 days.

NeutralMedian gap between releases over the last 2 years: 122 days.

NeutralMaintainers responded to 40 percent of sampled items.

NeutralThe most active contributor authored 58 percent of commits in the last 365 days.

NeutralGitHub community profile is 57 percent complete (informational).

Neutral604 GitHub stars (a weak signal on its own).

Positive10 people committed in the last 365 days.

PositiveLicensed under LGPL-2.1 (OSI-approved).

PositiveChecks on the default branch are passing.

Positive1,351,224 downloads last week on PyPI.

Nine dimensions

Security posture

Weight 20

43Risky

Source values

OpenSSF Scorecard: 4.3 / 10OpenSSF Scorecard API · 19 Oct 2026, 05:14 UTC
Scorecard date: 2026-10-12OpenSSF Scorecard API · 19 Oct 2026, 05:14 UTC
Advisories (365 days): 0GET /repos/{o}/{r}/security-advisories · 19 Oct 2026, 05:14 UTC

Known vulnerabilities

Weight 15

100Healthy

no records in OSV

Source values

Package: PyPI: python-stdnumEntered in admin
Latest version: 2.2pypi.org JSON API · 19 Oct 2026, 05:14 UTC
Known vulnerabilities (all versions): 0OSV.dev POST /v1/query · 19 Oct 2026, 05:14 UTC
With a fixed version: 0OSV.dev POST /v1/query · 19 Oct 2026, 05:14 UTC
Affecting the latest version: 0queried with 2.2OSV.dev POST /v1/query · 19 Oct 2026, 05:14 UTC
Published in last 365 days: 0OSV.dev POST /v1/query · 19 Oct 2026, 05:14 UTC
Most recent published: Not availableNo vulnerability recordsOSV.dev POST /v1/query · 19 Oct 2026, 05:14 UTC

Maintenance

Weight 15

70Watch

Source values

Archived: NoGET /repos/{owner}/{repo} · 19 Oct 2026, 05:14 UTC
Disabled: NoGET /repos/{owner}/{repo} · 19 Oct 2026, 05:14 UTC
Days since last default-branch commit: 64 daysGET /repos/{o}/{r}/commits · 19 Oct 2026, 05:14 UTC
Commits in last 365 days: 31GET /repos/{o}/{r}/commits · 19 Oct 2026, 05:14 UTC

Release cadence

Weight 10

46Risky

Source values

Days since last release: 287 daysGET /repos/{o}/{r}/releases · 19 Oct 2026, 05:14 UTC
Releases in last 365 days: 1GET /repos/{o}/{r}/releases · 19 Oct 2026, 05:14 UTC
Median days between releases (2 years): 122 daysover the last 2 yearsGET /repos/{o}/{r}/releases · 19 Oct 2026, 05:14 UTC
Uses GitHub Releases: YesGET /repos/{o}/{r}/releases · 19 Oct 2026, 05:14 UTC
Latest release: 2.2GET /repos/{o}/{r}/releases · 19 Oct 2026, 05:14 UTC

Responsiveness

Weight 10

28Risky

sampled (25 items)

Source values

Issues sampled: 4issues updated in the last 90 days, PRs excluded, bots excludedGET /repos/{o}/{r}/issues + /pulls (+ comments, reviews) · 19 Oct 2026, 05:14 UTC
Pull requests sampled: 21pull requests updated in the last 90 days, bots excludedGET /repos/{o}/{r}/issues + /pulls (+ comments, reviews) · 19 Oct 2026, 05:14 UTC
Median time to first response: 39 dayssampledGET /repos/{o}/{r}/issues + /pulls (+ comments, reviews) · 19 Oct 2026, 05:14 UTC
Share with a maintainer response: 40%sampledGET /repos/{o}/{r}/issues + /pulls (+ comments, reviews) · 19 Oct 2026, 05:14 UTC

Maintainer depth

Weight 10

85Healthy

Source values

Distinct contributors (365 days): 10GET /repos/{o}/{r}/commits · 19 Oct 2026, 05:14 UTC
Top contributor's share of commits: 58%GET /repos/{o}/{r}/commits · 19 Oct 2026, 05:14 UTC
Top contributor: arthurdejongGET /repos/{o}/{r}/commits · 19 Oct 2026, 05:14 UTC
Low bus factor: NoGET /repos/{o}/{r}/commits · 19 Oct 2026, 05:14 UTC

Governance and licensing

Weight 10

60Watch

Source values

License (SPDX): LGPL-2.1GET /repos/{owner}/{repo} · 19 Oct 2026, 05:14 UTC
License status: OSI-approvedGET /repos/{owner}/{repo} + OSI list · 19 Oct 2026, 05:14 UTC
Security policy: NoGET /repos/{o}/{r}/contents/SECURITY.md (+ .github/, docs/) · 19 Oct 2026, 05:14 UTC
Code of conduct (info): NoGET /repos/{o}/{r}/community/profile · 19 Oct 2026, 05:14 UTC
Contributing guide (info): YesGET /repos/{o}/{r}/community/profile · 19 Oct 2026, 05:14 UTC
Issue templates (info): NoGET /repos/{o}/{r}/community/profile · 19 Oct 2026, 05:14 UTC
Community profile (info): 57%GET /repos/{o}/{r}/community/profile · 19 Oct 2026, 05:14 UTC

CI health

Weight 5

100Healthy

Source values

Default-branch checks: PassingGET /repos/{o}/{r}/commits/{sha}/check-runs · 19 Oct 2026, 05:14 UTC
Method: check-runsGitHub · 19 Oct 2026, 05:14 UTC

Adoption

Weight 5

88Healthy

Source values

Weekly downloads: 1,351,224PyPI via pypistats.org (last week) · 19 Oct 2026, 05:14 UTC
Stars (weak signal): 604GET /repos/{owner}/{repo} · 19 Oct 2026, 05:14 UTC
Forks (weak signal): 239GET /repos/{owner}/{repo} · 19 Oct 2026, 05:14 UTC
Dependents: Not availableNot collected: no reliable public source without scraping— · 19 Oct 2026, 05:14 UTC