alistgo / alist
Repository health
Security, maintenance, dependencies and license for alistgo/alist.
Security
25 dependencies checked (25 direct), go, via deps.dev. Findings apply only to the packages and versions checked.
- GHSA-q7pp-wcgr-pffx · github.com/disintegration/imaging (direct)Crash when processing crafted TIFF filesAsk about this findingMODERATE
- GO-2022-0635 · github.com/aws/aws-sdk-go (direct)In-band key negotiation issue in AWS S3 Crypto SDK for golang in github.com/aws/aws-sdk-goAsk about this findingMODERATE
- GO-2022-0646 · github.com/aws/aws-sdk-go (direct)CBC padding oracle issue in AWS S3 Crypto SDK for golang in github.com/aws/aws-sdk-goAsk about this findingMODERATE
Security checks (RepoPilot estimate) · 4.7/10
OpenSSF has not scored this repository, so RepoPilot ran some of its checks from public GitHub data. Checks sorted from strongest to weakest.
- Recent activityLast commit 3d ago10/10
- Tests run on pull requestsCI configured + tests present10/10
- Least-privilege CI tokensWorkflows declare explicit, scoped permissions10/10
- License fileLicense: AGPL-3.08/10
- Pinned dependenciesOnly 2/22 actions pinned to SHAs2/10
- Code review before mergeOnly 0/20 recent PRs had requested reviewers2/10
- Automated dependency updatesNo Dependabot or Renovate config found0/10
- Security policyNo SECURITY.md found0/10
- Static analysis on commitsNo SAST workflow detected0/10
- Branch protectionInsufficient permissions to read branch protectionnot scored
Maintenance
Outside contributions: 31 of 52 external pull requests merged (70% of those decided), median 8.6 days to merge.From the 98 most recently updated pull requests, bots excluded.
Pull requests
- Open
- 5
- 0 stale (60+ days, no update in 30)
- Merged
- 24
- of the 30 latest
- Median time to merge
- 8 days
- From bots
- 0
- not listed below
Open
- #9680 fix(security): update Go toolchains and networking dependenciesokatu-loli · opened 1 day ago
- #9679 fix(ci): mock FreeBSD probe status codeokatu-loli · opened 3 days ago
- #9672 ci: pin third-party actions by commit, declare workflow tokens and stop persisting checkout credentialsTotara-thib · opened 5 days ago
- #9669 docs: add AppWK featured badgemrxujiangtao200011-crypto · opened 11 days ago
- #9656 fix: delete device session on logout instead of marking inactivexuelei9300 · opened 34 days ago
Recently merged
- #9673 fix(ldap): reactivate device session on LDAP loginxuelei9300 · merged 21 Oct 2026
- #9670 fix(ci): cover stable release builders and reject missing artifactsokatu-loli · merged 21 Oct 2026
- #9676 fix(lanzou): preserve absolute download endpointokatu-loli · merged 21 Oct 2026
- #9674 fix(wopan): initialize tokens and set dispatcher user agentokatu-loli · merged 21 Oct 2026
- #9668 fix(move): create the destination dir before moving into ithktitof · merged 13 Oct 2026
The 30 most recently updated pull requests.
Top contributors
- okatu-loli70 commits · 70%
- NovumOrbis10 commits · 10%
- alist-dev3 commits · 3%
- anupamme2 commits · 2%
- cipherprofessor2 commits · 2%
Of the 100 most recent commits.
Issues
- Open
- 559
- issues and pull requests, as GitHub counts them
- Median time to close
- 20 days
- from 25 closed of the 43 latest
- Awaiting first reply
- 4
- of 18 open among the 43 latest
- Oldest open
- 4.3 years
Rates come from the 43 most recently updated issues; the open count and oldest issue cover the whole repository.
Dependencies
Checked packages and import counts
These are the packages checked for known security issues, which may not be all of them. External imports are counted from the source code.
Packages pulled in by these were not checked.