anuraghazra / github-readme-stats
Repository health
Security, maintenance, dependencies and license for anuraghazra/github-readme-stats.
Security
75 dependencies checked (25 direct), npm, via deps.dev. Findings apply only to the packages and versions checked.
OpenSSF Scorecard · 6.5/10
Checks sorted from strongest to weakest.
- Code review before mergeAll changesets reviewed10/10
- Automated dependency updatesUpdate tool detected10/10
- No risky CI workflowsNo dangerous workflow patterns detected10/10
- No binaries in the repositoryNo binaries found in the repo10/10
- Security policySecurity policy file detected10/10
- Pinned dependenciesAll dependencies are pinned10/10
- License fileLicense file detected10/10
- Tests run on pull requests30 out of 30 merged PRs checked by a CI test10/10
- Contributors from several organisationsProject has 13 contributing companies or organizations10/10
- Static analysis on commitsSAST tool detected but not run on all commits9/10
- Recent activity1 commit and 1 issue activity found in the last 90 days1/10
- Least-privilege CI tokensDetected GitHub workflow tokens with excessive permissions0/10
- OpenSSF best-practices badgeNo effort to earn an OpenSSF best practices badge detected0/10
- Fuzz testingProject is not fuzzed0/10
- No known vulnerabilities57 existing vulnerabilities detected0/10
- Published through a build pipelinePackaging workflow not detectednot scored
- Signed releasesNo releases foundnot scored
- Branch protectionScorecard could not run this check.not scored
Maintenance
Outside contributions: 0 of 85 external pull requests merged (0% of those decided).From the 92 most recently updated pull requests, bots excluded.
Pull requests
- Open
- 18
- 7 stale (60+ days, no update in 30)
- Merged
- 0
- of the 30 latest
- Median time to merge
- Unknown
- From bots
- 1
- not listed below
Open
- #4939 fix(stats): accept zero all-time commitsMuguett-DBY · opened today
- #4938 docs: align cache_seconds options with per-card limitsMuguett-DBY · opened today
- #4743 Add vercel_deployment_instruction.yaml fileStewie-pixel · opened 282 days ago
- #4937 fix: only exclude explicitly named repositories from top languagesMU-ty · opened 7 days ago
- #3393 feature: implement basic querystring params validation (resolves #3055)qwerty541 · opened 3.0 years ago
Recently merged
None from people in recent pull requests.
The 30 most recently updated pull requests.
Top contributors
- alexandr-garbuzov33 commits · 58%
- opheliagoldstein17 commits · 30%
- martin-mfg2 commits · 4%
- rickstaa1 commit · 2%
- fizahmad1 commit · 2%
Of the 57 most recent commits.
Issues
- Open
- 297
- issues and pull requests, as GitHub counts them
- Median time to close
- 8 days
- from 11 closed of the 34 latest
- Awaiting first reply
- 2
- of 23 open among the 34 latest
- Oldest open
- 6.3 years
Most wanted
- #4737 Public deployment is paused (503 DEPLOYMENT_PAUSED) – README stats broken79 reactions · 19 comments
- #1935 Top Issues Dashboard23 reactions · 10 comments
- #4829 It's not working22 reactions · 14 comments
Rates come from the 34 most recently updated issues; the open count and oldest issue cover the whole repository.
Dependencies
Checked packages and import counts
These are the packages checked for known security issues, which may not be all of them. External imports are counted from the source code.
License compatibility
Repo license: MIT · 25 deps checked · 0 potential conflicts.