aaif-goose / goose
Repository health
Security, maintenance, dependencies and license for aaif-goose/goose.
Security
0
Critical
0 direct
0
High
0 direct
0
Moderate
0
Low
53 dependencies checked (3 direct), npm, via deps.dev. Findings apply only to the packages and versions checked.
OpenSSF Scorecard · 5.8/10
Checks sorted from strongest to weakest.
- Automated dependency updatesUpdate tool detected10/10
- Recent activity30 commits and 16 issue activity found in the last 90 days10/10
- Security policySecurity policy file detected10/10
- No binaries in the repositoryNo binaries found in the repo10/10
- Published through a build pipelinePackaging workflow detected10/10
- License fileLicense file detected10/10
- Tests run on pull requests30 out of 30 merged PRs checked by a CI test10/10
- Contributors from several organisationsProject has 23 contributing companies or organizations10/10
- Code review before mergeFound 27/28 approved changesets9/10
- Static analysis on commitsSAST tool is not run on all commits9/10
- Pinned dependenciesDependency not pinned by hash detected8/10
- Branch protectionBranch protection is not maximal on development and all release branches8/10
- No risky CI workflowsDangerous workflow patterns detected0/10
- Least-privilege CI tokensDetected GitHub workflow tokens with excessive permissions0/10
- OpenSSF best-practices badgeNo effort to earn an OpenSSF best practices badge detected0/10
- Signed releasesProject has not signed or included provenance with any releases.0/10
- No known vulnerabilities162 existing vulnerabilities detected0/10
- Fuzz testingProject is not fuzzed0/10
Maintenance
23 Oct 2026
Last commit
active
100+
Commits in the last year
666
Contributors
all time · 28 in the last 95 commits
v1.56.0
Latest release
~6d cadence
Outside contributions: 4 of 46 external pull requests merged (18% of those decided), median 1 day to merge.From the 75 most recently updated pull requests, bots excluded.
Pull requests
- Open
- 21
- 0 stale (60+ days, no update in 30)
- Merged
- 5
- of the 30 latest
- Median time to merge
- 2 days
- From bots
- 7
- not listed below
Open
- #13120 fix(desktop): restore Linux window iconsketchupz1999 · opened today
- #13087 feat(providers): add DotHoosh as a declarative providerAlirezajalilii · opened 2 days ago
- #12519 fix(providers): share always-on reasoning effort policyrohan-patnaik · opened 29 days ago
- #13069 feat(goose-agent): add generic Hook traitlifeizhou-ap · opened 2 days ago
- #13115 fix(providers): refresh DeepSeek model metadata and honor declared reasoningserg94 · opened today
Recently merged
- #12794 fix(prompt): surface MiniJinja render errors in custom system promptsAbhijay007 · merged 23 Oct 2026
- #13029 fix(providers): request summarized thinking from Claude modelswpfleger96 · merged 23 Oct 2026
- #13098 Allow callers to supply Goose session IDsi386 · merged 23 Oct 2026
- #13102 fix(code-mode): keep recipe final_output tool for the modellifeizhou-ap · merged 23 Oct 2026
- #13024 fix(cli): configure unavailable default provider (#12842)Wuodan · merged 22 Oct 2026
The 30 most recently updated pull requests.
Top contributors
- lifeizhou-ap23 commits · 24%
- DOsinga19 commits · 20%
- jamadeo10 commits · 11%
- Abhijay0075 commits · 5%
- TheSeydiCharyyev5 commits · 5%
Of the 95 most recent commits.
Issues
- Open
- 519
- issues and pull requests, as GitHub counts them
- Median time to close
- 11 days
- from 9 closed of the 48 latest
- Awaiting first reply
- 21
- of 39 open among the 48 latest
- Oldest open
- 204 days
Most wanted
- #12547 Ran into this error: Execution error: null result from llama cpp. Please retry if you think this is a transient or recoverable error.1 reaction · 4 comments
Rates come from the 48 most recently updated issues; the open count and oldest issue cover the whole repository.
Dependencies
Checked packages and import counts
These are the packages checked for known security issues, which may not be all of them. External imports are counted from the source code.
53
Packages checked
npm
3
Direct packages checked
listed in the manifest
50
Transitive packages checked
pulled in by other packages
1988
External imports
outside packages the code imports
License compatibility
Repo license: Apache-2.0 · 3 deps checked · 0 potential conflicts.
License
Apache-2.0
License
Permissive
Family
0
License conflicts in dependencies
3 dependencies checked
Commercial use: Generally fine for commercial and proprietary use, subject to attribution and notice terms. Apache-2.0 also grants a patent licence.