chartjs / chart.js
Repository health
Security advisories, maintenance activity, dependencies and license for chartjs/chart.js, with what was checked and what was not.
Security
25 dependencies checked (25 direct), npm, via deps.dev. Findings apply only to the packages and versions checked.
OpenSSF Scorecard · 5.4/10
Checks sorted from strongest to weakest.
- MaintainedLast commit 9d ago10/10
- LicensePermissive license: MIT10/10
- CI-TestsCI configured + tests present10/10
- Dependency-Update-ToolDependabot configured10/10
- Token-PermissionsWorkflows declare explicit, scoped permissions10/10
- Pinned-DependenciesOnly 0/21 actions pinned to SHAs2/10
- Code-ReviewOnly 0/20 recent PRs had requested reviewers2/10
- Security-PolicyNo SECURITY.md found0/10
- SASTNo SAST workflow detected0/10
- Branch-ProtectionDefault branch 'master' has no protection rule0/10
Maintenance
Outside contributions: 4 of 86 external pull requests merged (17% of those decided), median 64 days to merge.From the 86 most recently updated pull requests, bots excluded.
Commit activity
100 commits sampledClick a bar to browse commits — or open GitHub for the full month ↓
Work rhythm
Commits by day of week
Pull request health
How fast do PRs resolve?
Days from open to merged / closed, last 6 PRs.
Pending right now24 open PRs
Recently merged4 PRs in the recent window
![dependabot[bot]](https://avatars.githubusercontent.com/in/29110?v=4)
Issue triage — last 12 weeks
Blue bars = issues opened that week, green = closed. Healthy projects keep these roughly in balance — a persistently bigger blue bar means an opening backlog. open issues on GitHub ↗
Release cadence· median 60d between releases
Latest v4.5.1 shipped 366d ago · typical gap 60d · steady cadence · 10 releases sampled.
New faces — last 90 days2 contributors appearing for the first time in this window
Heuristic: contributors whose earliest commit in the recent sample is < 90 days old AND who have ≤ 3 commits in the window. Click a name for their commits in this repo.
Top contributors
Issue health
Computed from GitHub Issues — no estimates. Per-issue rates use the 36 most-recently-updated issues (recent, not all-time); the open total and oldest-open age are repo-wide.
Total open on the repo (authoritative).
From 10 recently-closed issues. p90 1.6y.
Age of the longest-open unresolved issue.
6 of 26 recent open issues have no comments yet.
20 of 26 recent open issues had no update in 30d+.
2 of 26 recent open issues are unlabeled.
Open to contributors. 1 help-wanted in the recent sample — a path in if you want to contribute.
What the backlog is about
AI-generatedOpen issues grouped into themes by an LLM from their titles — a summary, not an authoritative classification. Numbers reflect the 26 most-recently-active open issues.
Most-wanted
Open issues with the most positive reactions — what the community is asking for.
"responsive" option problem since v4
#11005 · opened 3y ago · @ghost
[Feature Request] Able to align columns in bar graph
#5822 · opened 8y ago · @Utkarshbhimte
Enter animation suppressed when container's CSS pixel width is sub-integer (fractional getBoundingClientRect width)
#12256 · opened 4mo ago · @ubarkai
Allow the tooltip to remain open on hover
#12080 · opened 1y ago · @rowanwins
Most-discussed
Open issues with the most comments — where the conversation is.
"responsive" option problem since v4
#11005 · opened 3y ago · @ghost
[Feature Request] Able to align columns in bar graph
#5822 · opened 8y ago · @Utkarshbhimte
Possible plugin lifecycle regression in Chart.js 4.5.1 causing chartjs-plugin-datalabels to draw before internal labels are prepared
#12269 · opened 3mo ago · @bubbajdf
Line chart disappears when zooming
#12174 · opened 9mo ago · @olelond
Customizeable Axis Title Rendering
#3214 · opened 10y ago · @sassomedia
Labels in the recent sample
Per-issue rates are computed from a sample of 36 most-recently-updated issues, so they describe recent behavior rather than the all-time backlog. Reaction and comment counts come straight from GitHub.
Dependencies
Checked packages and import counts
Checked counts describe advisory coverage, not the repository’s complete dependency inventory. External imports come from a separate source-code graph.