WAIT — Slowing — last commit 7mo ago

• Last commit 7mo ago
• 18 active contributors
• Other licensed
• CI configured
• Tests present
• ⚠ Slowing — last commit 7mo ago
• ⚠ Concentrated ownership — top contributor handles 72% of recent commits
• ⚠ Non-standard license (Other) — review terms
• ⚠ Scorecard: default branch unprotected (0/10)

_{Computed from maintenance signals — commit recency, contributor breadth, bus factor, license, CI, tests, cross-checked against OpenSSF Scorecard}

Arduino IDE 1.x is the legacy graphical development environment for programming Arduino microcontroller boards using a Processing-based language. It provides a text editor, compiler toolchain integration (primarily AVR/SAM cores), serial monitor, and board/port management UI—all built in Java/Swing. This is the classic Arduino IDE that made embedded programming accessible to non-specialists for the past 15+ years. app/ is the IDE monolith containing all source code, build definitions (build.xml = Ant-based), and bundled libraries. No modular packages; the IDE is one large Java application compiled to a single executable. Platform-specific builds handled via .classpath_macosx and build variants. Minimal separation of concerns—editor, compiler integration, serial I/O, UI all tightly coupled in the same source tree.

Hobbyists, educators, and embedded systems developers who program Arduino boards (Uno, Mega, Leonardo, etc.). Also maintained by Arduino contributors who ensure backward compatibility and bug fixes for the massive installed base still using IDE 1.x rather than the newer IDE 2.x (Electron-based).

Legacy and stable but no longer actively developed—the README explicitly states this repo is 'no longer in active development' with active work shifted to arduino-ide (2.x). The codebase is mature (15+ years old), has production use at massive scale, but now only receives critical security/bug fixes. Verdict: production-ready but frozen—safe to use, unsafe to expect new features.

High dependency drag: 50+ JAR files in app/lib/ (Batik SVG renderers, Apache Commons, Bouncy Castle crypto, RSyntaxTextArea editor) with some dated (e.g., commons-codec-1.7 from 2012, batik-1.8 from 2013). Maintenance risk is real—no active CI/CD visible beyond ant.yml GitHub Actions, and inherited technical debt from 15-year-old Swing codebase. Main risk: security patches for old libraries are unlikely unless critical.

Maintenance-only mode. The .github/workflows/ant.yml shows GitHub Actions running Ant builds, but no visible active feature development. Contributors are redirected to arduino-ide (2.x) for new work. Only bug fixes and security patches (if any) are expected. The repo is essentially in long-term support (LTS) stasis.

git clone https://github.com/arduino/Arduino.git
cd Arduino/app
ant build

(Requires Java 8+ and Ant. Full IDE is built to app/build/ directory.)

Daily commands:

cd Arduino/app
ant run

Launches the IDE immediately. For distribution builds: ant dist creates platform-specific bundles in build/ with embedded JVM and toolchains.

• app/build.xml — Primary build configuration for the entire Arduino IDE application; all contributors must understand how the project is compiled and packaged.
• app/src/cc/arduino/contributions/libraries/ui/LibraryManagerUI.java — Core UI component for the library management system; essential for understanding how users interact with library installation and management.
• app/src/cc/arduino/contributions/packages/ui/ContributionIndexTableModel.java — Data model for board/package contributions display; critical for understanding how board definitions are rendered and managed in the IDE.
• app/src/cc/arduino/ConsoleOutputStream.java — Handles console output redirection in the IDE; foundational for debugging and user feedback mechanisms.
• app/src/cc/arduino/UpdatableBoardsLibsFakeURLsHandler.java — Manages URL handling for board and library updates; critical for understanding how the IDE communicates with Arduino's contribution servers.
• app/.settings/org.eclipse.jdt.core.prefs — Java compiler and IDE settings; ensures consistent code style and compilation behavior across all contributor environments.

Add a New Library Filter

1. Create a new predicate class in app/src/cc/arduino/contributions/libraries/filters/ following the UpdatableLibraryPredicate pattern (app/src/cc/arduino/contributions/libraries/filters/NewLibraryFilterPredicate.java)
2. Implement the predicate interface to filter libraries based on custom criteria (e.g., author, license, category) (app/src/cc/arduino/contributions/libraries/filters/NewLibraryFilterPredicate.java)
3. Wire the new filter into the LibraryManagerUI to expose it in the UI (app/src/cc/arduino/contributions/libraries/ui/LibraryManagerUI.java)

Add a New Board Package Comparator

1. Create a comparator class in app/src/cc/arduino/contributions/packages/ mirroring LibraryTypeComparator (app/src/cc/arduino/contributions/packages/BoardPackageComparator.java)
2. Define sorting logic (e.g., sort by installation status, release date, or Arduino-official vs. third-party) (app/src/cc/arduino/contributions/packages/BoardPackageComparator.java)
3. Apply the comparator in ContributionIndexTableModel to sort the board display table (app/src/cc/arduino/contributions/packages/ui/ContributionIndexTableModel.java)

Add a New Self-Check for Contributions

1. Create a new check class extending or mimicking ContributionsSelfCheck pattern in app/src/cc/arduino/contributions/ (app/src/cc/arduino/contributions/MyCustomCheck.java)
2. Implement the logic to verify a condition (e.g., 'check if a specific library version is deprecated') (app/src/cc/arduino/contributions/MyCustomCheck.java)
3. Register the check in the IDE's initialization code to run at startup or on-demand (app/src/cc/arduino/contributions/ContributionsSelfCheck.java)

Add Serial Port Communication Feature

1. Leverage the jssc (Java Simple Serial Connector) library already included in app/lib/jssc-2.8.0-arduino4.jar (app/lib/jssc-2.8.0-arduino4.jar)
2. Create a wrapper class in app/src/cc/arduino/ to abstract jssc port operations (open, close, send, receive) (app/src/cc/arduino/SerialPortWrapper.java)
3. Integrate with ConsoleOutputStream to route serial messages to the IDE console (app/src/cc/arduino/ConsoleOutputStream.java)

• Java + Swing/AWT — Cross-platform desktop GUI development with native look-and-feel; allows Arduino IDE to run on Windows, macOS, and Linux with minimal code duplication.
• Apache Ant — Lightweight, declarative build automation; well-suited for legacy Java projects and allows contributors to build without heavyweight IDEs.
• JSSC (Java Simple Serial Connector) — Enables reliable serial communication with Arduino boards for sketch uploads and serial monitoring across all major operating systems.
• jMDNS — Provides automatic discovery of network-connected Arduino boards via mDNS/Bonjour without requiring users to manually configure IP addresses.
• RSyntaxTextArea — Delivers code syntax highlighting and basic editor features for the Arduino sketch editor with minimal custom implementation.
• Apache Commons (Compress, IO, Lang, Net, HTTP) — Battle-tested utility libraries reduce custom code for file operations, compression, networking, and HTTP communication with Arduino servers.

• Legacy IDE 1.x over IDE 2.x

  • Why: IDE 1.x is mature, stable, and widely deployed; large user base and extensive third-party documentation.
  • Consequence: No longer actively developed; new features and improvements only in IDE 2.x; contributors must be aware this is maintenance mode.

• Monolithic Swing GUI instead of modern web-based UI

  • Why: Avoids dependency on web browsers, Electron, or Node.js; simpler standalone distribution and lower resource footprint on legacy systems.
  • Consequence: Harder to implement responsive design and real-time collaboration features; slower UI iteration compared to web-based frameworks.

• Table-based filtering (predicates) instead of reactive data streams

  • Why: Straightforward imperative logic; easy to understand and debug for contributors unfamiliar with functional reactive patterns.
  • Consequence: Can be less efficient for large datasets with complex interdependent filters; no built-in debouncing or batching.

• Direct HTTP/File-based index updates vs. event-driven pub/sub

  • Why: Simpler to implement and debug; no external message broker or subscription infrastructure required.
  • Consequence: Polling-based updates may miss rapid changes on the server; clients don't get real-time notifications of new libraries.

• Real-time collaborative sketch editing across multiple users
• Cloud-based project storage or synchron

Java version: must use Java 8 (or compatible); newer Java versions may break Swing compatibility or JAR loading. Platform-specific builds: macOS requires .classpath_macosx variant; Windows/Linux differ—build on the target OS or use Docker. No test framework visible: entire 1.5M LOC Java codebase appears to have zero automated tests; changes require manual smoke testing on real hardware. Dependency hell: 15-year-old commons-* and Batik JARs have known CVEs but no automated security scanning visible. Dynamic hardware cores: AVR/SAM toolchains not in this repo—downloaded at build time from separate repos; builds fail silently if download servers are down.

• arduino/arduino-ide — The active successor—Electron/TypeScript-based IDE 2.x that replaces this legacy Swing app; where all new feature development happens
• arduino/ArduinoCore-avr — AVR core libraries and toolchain definitions (Uno, Mega, Leonardo)—downloaded and bundled by this IDE at build time; defines what avr-gcc commands are available
• arduino/ArduinoCore-sam — SAM (ARM Cortex-M3/M4) core for Due/Zero boards—companion repo to AVR core, also auto-downloaded during IDE build
• arduino/Arduino-cli — Command-line interface to Arduino toolchain—allows headless compilation and board management; shares core logic with IDE 1.x but in a separate, modular package
• processing/processing — Spiritual predecessor and language inspiration—Arduino's Processing-like syntax and IDE design borrowed heavily from Processing; understanding Processing helps understand Arduino's philosophy

To work on one of these in Claude Code or Cursor, paste: Implement the "<title>" PR idea from CLAUDE.md, working through the checklist as the task list.

Modernize and consolidate outdated dependencies in app/lib/

The app/lib directory contains numerous legacy dependencies with known vulnerabilities (batik-1.8.jar from 2013, commons-* libraries from 2012-2016, jackson-2.9.5 with CVEs). Since IDE 1.x is in legacy maintenance mode, a PR to audit and update critical security vulnerabilities (especially in commons-codec, commons-compress, and jackson libraries) would directly improve security for the existing user base still relying on IDE 1.x. This requires examining build.xml to identify safe upgrade paths.

• [ ] Audit app/lib/ dependencies using OWASP Dependency-Check or similar tool
• [ ] Identify CVEs in commons-codec-1.7, commons-compress-1.8, jackson-2.9.5, and jmdns-3.5.5
• [ ] Test compatible newer versions by modifying app/build.xml gradle/ant dependencies
• [ ] Verify backwards compatibility with existing IDE 1.x functionality
• [ ] Document security improvements in CONTRIBUTING.md

Add pre-submit validation workflow for .github/workflows/ant.yml

The repository has a minimal ant.yml workflow but lacks comprehensive pre-submit checks. A PR to enhance .github/workflows/ant.yml should add linting for Java code quality (checkstyle/spotbugs), verify JAR manifest integrity, and validate that CONTRIBUTING.md guidelines are followed. This prevents regressions in the legacy codebase where tests may be sparse.

• [ ] Review existing .github/workflows/ant.yml to understand current triggers
• [ ] Add Checkstyle configuration for Java code style validation
• [ ] Integrate SpotBugs or SonarQube analysis for bug detection
• [ ] Add validation of app/lib/ JAR checksums to detect tampering
• [ ] Test workflow locally and document in CONTRIBUTING.md

Create contributor setup guide and environment documentation in CONTRIBUTING.md

CONTRIBUTING.md exists but likely lacks specific instructions for IDE 1.x development. New contributors struggle with Eclipse project setup (.classpath, .classpath_macosx, .project, .settings files indicate Eclipse-specific configuration), Java version requirements, and building app/build.xml. A detailed PR with step-by-step setup for Windows/macOS/Linux, build instructions, and how to test changes locally would dramatically lower the barrier to contribution.

• [ ] Expand CONTRIBUTING.md with 'Development Setup' section
• [ ] Document Java version requirements and Maven/Ant build prerequisites
• [ ] Add Eclipse IDE import instructions (.project/.classpath setup)
• [ ] Include 'Building from source' section referencing app/build.xml
• [ ] Add 'Testing changes locally' with board/sketch validation steps
• [ ] Create troubleshooting section for common setup issues

• Add Java unit tests for core classes in app/src/cc/arduino/ (Board.java, SerialRXTX.java, etc.)—currently zero test coverage is a major maintenance gap and blocks refactoring.
• Audit and update app/lib/ dependencies to latest LTS versions of Apache Commons, Bouncy Castle, RSyntaxTextArea—document CVEs in each JAR and justify why old versions were retained (if security-critical, flag as blocker).
• Document the build process: create BUILD.md with Java version requirements, platform-specific steps, troubleshooting for common Ant/classpath errors—README assumes too much existing knowledge.

The Arduino IDE 1.x codebase has significant security concerns primarily due to its legacy status and outdated dependencies. Most JARs are 8-15+ years old with known vulnerabilities and no active maintenance. The project is explicitly deprecated in favor of IDE 2.x. Critical issues include vulnerable HTTP URLs, outdated cryptography and compression libraries, and lack of modern security scanning. The security posture

• High · Outdated and Vulnerable Dependencies — app/lib/ directory - multiple JAR files. Multiple dependencies contain known vulnerabilities due to age and lack of updates: commons-httpclient-3.1 (2007), commons-logging-1.0.4 (2007), jsch-0.1.50 (2013), jssc-2.8.0 (outdated serial communication library), and jackson-databind-2.9.5 (2018). These libraries have documented CVEs and security patches in newer versions. Fix: Upgrade all dependencies to their latest stable versions. Priority upgrades: commons-httpclient → httpcomponents-client, jackson-databind → 2.17.0+, jsch → 0.1.55+, jssc → maintained fork or alternative. Implement dependency scanning in CI/CD pipeline.
• High · Insecure HTTP URL in README — README.md. The README contains an HTTP URL (http://content.arduino.cc/brand/arduino-color.svg) instead of HTTPS, which could be vulnerable to man-in-the-middle attacks if used in contexts where HTTPS is not enforced. Fix: Change all HTTP URLs to HTTPS. Update the brand image URL to use HTTPS protocol.
• High · Outdated Build System and Deprecated Java Libraries — app/build.xml, app/lib/batik-*.jar, app/lib/xml-apis-*.jar. The codebase uses Ant (app/build.xml) as the build system, which is outdated and lacks modern security scanning capabilities. Legacy XML parsing libraries (xml-apis, batik) from 2008-2014 may have unpatched XML vulnerabilities (XXE, XML bomb). Fix: Migrate to Maven or Gradle with dependency management and security scanning. Update XML processing libraries or implement XXE protection via entity resolution configuration.
• Medium · Cryptography Library Version Mismatch — app/lib/bcprov-jdk15on-152.jar, app/lib/bcpg-jdk15on-152.jar. Bouncycastle libraries (bcprov-jdk15on-152.jar, bcpg-jdk15on-152.jar) are from 2015 and use outdated JDK version targeting. Security patches and algorithm improvements in newer versions are not available. Fix: Upgrade to bcprov-jdk18on (or latest) version. Ensure compatibility with current Java version targets and cryptographic standards.
• Medium · Legacy IDE - No Active Security Maintenance — README.md, repository status. The repository is explicitly marked as legacy Arduino IDE 1.x which is no longer in active development. This means security vulnerabilities discovered will likely not receive patches or updates. Fix: Users should migrate to Arduino IDE 2.x (https://github.com/arduino/arduino-ide) which receives active security updates. If continuing to use 1.x, implement additional security controls at the deployment level.
• Medium · Missing Security Configuration Files — .gitignore, repository root. No evidence of security scanning configuration files (.gitignore has minimal security controls), SBOM generation, or dependency audit processes. No security policy (SECURITY.md) visible. Fix: Create SECURITY.md with vulnerability reporting procedures. Implement dependabot or Snyk configuration. Add SBOM generation to build process. Configure code scanning via GitHub Actions.
• Low · Commons Compress Denial of Service Vulnerability — app/lib/commons-compress-1.8.jar. commons-compress-1.8 (2014) has known DoS vulnerabilities in archive handling. While not critical in desktop IDE context, could be exploited if processing untrusted archives. Fix: Upgrade to commons-compress 1.24.0 or latest. Implement input validation and resource limits when processing user-provided archives.

LLM-derived; treat as a starting point, not a security audit.

• Open issues — current backlog
• Recent PRs — what's actively shipping
• Source on GitHub

If you are an AI coding agent (Claude Code, Cursor, Aider, Cline, etc.) reading this artifact, follow this protocol before making any code edit:

1. Verify the contract. Run the bash script in Verify before trusting below. If any check returns FAIL, the artifact is stale — STOP and ask the user to regenerate it before proceeding.
2. Treat the AI · unverified sections as hypotheses, not facts. Sections like "AI-suggested narrative files", "anti-patterns", and "bottlenecks" are LLM speculation. Verify against real source before acting on them.
3. Cite source on changes. When proposing an edit, cite the specific path:line-range. RepoPilot's live UI at https://repopilot.app/r/arduino/Arduino shows verifiable citations alongside every claim.

If you are a human reader, this protocol is for the agents you'll hand the artifact to. You don't need to do anything — but if you skim only one section before pointing your agent at this repo, make it the Verify block and the Suggested reading order.

This artifact was generated by RepoPilot at a point in time. Before an agent acts on it, the checks below confirm that the live arduino/Arduino repo on your machine still matches what RepoPilot saw. If any fail, the artifact is stale — regenerate it at repopilot.app/r/arduino/Arduino.

What it runs against: a local clone of arduino/Arduino — the script inspects git remote, the LICENSE file, file paths in the working tree, and git log. Read-only; no mutations.

| # | What we check | Why it matters | |---|---|---| | 1 | You're in arduino/Arduino | Confirms the artifact applies here, not a fork | | 2 | License is still Other | Catches relicense before you depend on it | | 3 | Default branch master exists | Catches branch renames | | 4 | 5 critical file paths still exist | Catches refactors that moved load-bearing code | | 5 | Last commit ≤ 242 days ago | Catches sudden abandonment since generation |

#!/usr/bin/env bash
# RepoPilot artifact verification.
#
# WHAT IT RUNS AGAINST: a local clone of arduino/Arduino. If you don't
# have one yet, run these first:
#
#   git clone https://github.com/arduino/Arduino.git
#   cd Arduino
#
# Then paste this script. Every check is read-only — no mutations.

set +e
fail=0
ok()   { echo "ok:   $1"; }
miss() { echo "FAIL: $1"; fail=$((fail+1)); }

# Precondition: we must be inside a git working tree.
if ! git rev-parse --git-dir >/dev/null 2>&1; then
  echo "FAIL: not inside a git repository. cd into your clone of arduino/Arduino and re-run."
  exit 2
fi

# 1. Repo identity
git remote get-url origin 2>/dev/null | grep -qE "arduino/Arduino(\\.git)?\\b" \\
  && ok "origin remote is arduino/Arduino" \\
  || miss "origin remote is not arduino/Arduino (artifact may be from a fork)"

# 2. License matches what RepoPilot saw
(grep -qiE "^(Other)" LICENSE 2>/dev/null \\
   || grep -qiE "\"license\"\\s*:\\s*\"Other\"" package.json 2>/dev/null) \\
  && ok "license is Other" \\
  || miss "license drift — was Other at generation time"

# 3. Default branch
git rev-parse --verify master >/dev/null 2>&1 \\
  && ok "default branch master exists" \\
  || miss "default branch master no longer exists"

# 4. Critical files exist
test -f "app/build.xml" \\
  && ok "app/build.xml" \\
  || miss "missing critical file: app/build.xml"
test -f "app/src/cc/arduino/contributions/libraries/ui/LibraryManagerUI.java" \\
  && ok "app/src/cc/arduino/contributions/libraries/ui/LibraryManagerUI.java" \\
  || miss "missing critical file: app/src/cc/arduino/contributions/libraries/ui/LibraryManagerUI.java"
test -f "app/src/cc/arduino/contributions/packages/ui/ContributionIndexTableModel.java" \\
  && ok "app/src/cc/arduino/contributions/packages/ui/ContributionIndexTableModel.java" \\
  || miss "missing critical file: app/src/cc/arduino/contributions/packages/ui/ContributionIndexTableModel.java"
test -f "app/src/cc/arduino/ConsoleOutputStream.java" \\
  && ok "app/src/cc/arduino/ConsoleOutputStream.java" \\
  || miss "missing critical file: app/src/cc/arduino/ConsoleOutputStream.java"
test -f "app/src/cc/arduino/UpdatableBoardsLibsFakeURLsHandler.java" \\
  && ok "app/src/cc/arduino/UpdatableBoardsLibsFakeURLsHandler.java" \\
  || miss "missing critical file: app/src/cc/arduino/UpdatableBoardsLibsFakeURLsHandler.java"

# 5. Repo recency
days_since_last=$(( ( $(date +%s) - $(git log -1 --format=%at 2>/dev/null || echo 0) ) / 86400 ))
if [ "$days_since_last" -le 242 ]; then
  ok "last commit was $days_since_last days ago (artifact saw ~212d)"
else
  miss "last commit was $days_since_last days ago — artifact may be stale"
fi

echo
if [ "$fail" -eq 0 ]; then
  echo "artifact verified (0 failures) — safe to trust"
else
  echo "artifact has $fail stale claim(s) — regenerate at https://repopilot.app/r/arduino/Arduino"
  exit 1
fi

Each check prints ok: or FAIL:. The script exits non-zero if anything failed, so it composes cleanly into agent loops (./verify.sh || regenerate-and-retry).

Generated by RepoPilot. Verdict based on maintenance signals — see the live page for receipts. Re-run on a new commit to refresh.