[
  {
    "label": "dependency count",
    "id": "dependencies_count",
    "key": "dependencies_count",
    "description": "Risk is low when the package has 20 dependencies or fewer, medium when it has 40 dependencies or fewer, and high above 40 dependencies.",
    "thresholds": [
      { "level": "low", "max": 20 },
      { "level": "medium", "max": 40 },
      { "level": "high", "max": null }
    ]
  },
  {
    "label": "version deprecation",
    "id": "version_difference",
    "key": "later_version",
    "description": "Risk is low when there are 3 newer package versions or fewer, and high when there are more than 3 newer versions.",
    "thresholds": [
      { "level": "low", "max": 3 },
      { "level": "high", "max": null }
    ]
  },
  {
    "label": "code coverage",
    "id": "code_coverage",
    "key": "code_coverage",
    "description": "Risk is high when code coverage is 0.6 or lower, medium when code coverage is 0.8 or lower, and low when code coverage is above 0.8 up to 1.",
    "thresholds": [
      { "level": "high", "max": 0.6 },
      { "level": "medium", "max": 0.8 },
      { "level": "low", "max": 1 }
    ]
  },
  {
    "label": "popularity",
    "id": "popularity",
    "key": "total_download",
    "description": "Risk is high when total downloads are 3,500,000 or fewer, medium when total downloads are 50,000,000 or fewer, and low above 50,000,000.",
    "thresholds": [
      { "level": "high", "max": 3500000 },
      { "level": "medium", "max": 50000000 },
      { "level": "low", "max": null }
    ]
  },
  {
    "label": "license",
    "id": "license",
    "key": "license",
    "description": "Risk is high for AGPL, SSPL, GNU Affero GPL, CeCILL, Open Software Licence, Server Side Public License, and unavailable licenses; medium for GPL, LGPL, and Artistic licenses; and low for MIT and Apache licenses. Unknown licenses use the default high risk.",
    "default": "high",
    "thresholds": [
      {
        "level": "high",
        "values": [
          "AGPL", "SSPL", "GNUAFFEROGPL",
          "CECILL", "OPENSOFTWARELICENCE",
          "SERVERSIDEPUBLICLICENSE", "NOTAVAILABLE"
        ]
      },
      {
        "level": "medium",
        "values": ["GPL", "LGPL", "ARTISTIC"]
      },
      {
        "level": "low",
        "values": ["MIT", "APACHE"]
      }
    ]
  },
  {
    "label": "reverse dependencies",
    "id": "reverse_dependencies",
    "key": "reverse_dependencies_count",
    "description": "Risk is high when the package has 5 reverse dependencies or fewer, medium when it has 15 reverse dependencies or fewer, and low above 15 reverse dependencies.",
    "thresholds": [
      { "level": "high", "max": 5 },      
      { "level": "medium", "max": 15 },  
      { "level": "low", "max": null }       
    ]
  },
  {
    "label": "documentation",
    "id": "documentation",
    "key": "documentation_score",
    "description": "Risk is high when the documentation score is 3 or lower, medium when the documentation score is 6 or lower, and low above 6.",
    "thresholds": [
      { "level": "high", "max": 3 },
      { "level": "medium", "max": 6 },
      { "level": "low", "max": null }
    ]
  },
  {
    "label": "documentation",
    "id": "documentation",
    "key": "has_ex_docs_score",
    "description": "Risk is high when the examples and documentation score is 0.6 or lower, medium when it is 0.8 or lower, and low when it is above 0.8 up to 1.",
    "thresholds": [
      { "level": "high", "max": 0.6  },
      { "level": "medium", "max": 0.8 },
      { "level": "low", "max": 1 }
    ]
  },
  {
    "label": "R cmd check",
    "id": "cmd-check",
    "key": "cmd_check",
    "description": "Risk is high when the R CMD check score is 0, medium when it is 0.8 or lower, and low when it is above 0.8 up to 1.",
    "thresholds": [
      { "level": "high", "max": 0 },
      { "level": "medium", "max": 0.8 },
      { "level": "low", "max": 1 }
    ]
  },
  {
    "label": "bug reports URL",
    "id": "has_bug_reports_url",
    "key": "has_bug_reports_url_risk",
    "description": "Risk is low when the package provides a bug reports URL and high when no bug reports URL is available (NULL or NA).",
    "default": "high",
    "thresholds": [
      { "level": "high", "max": 0 },
      { "level": "low", "max": 1 }
    ]
  },
  {
    "label": "source control",
    "id": "has_source_control",
    "key": "has_source_control_risk",
    "description": "Risk is low when the package provides a source control link and high when no source control is available (NULL or NA).",
    "default": "high",
    "thresholds": [
      { "level": "high", "max": 0 },
      { "level": "low", "max": 1 }
    ]
  }
]
