cherryhq / cherry-studio
Repository health
Security, maintenance, dependencies and license for cherryhq/cherry-studio.
Security
75 dependencies checked (25 direct), npm, via deps.dev. Findings apply only to the packages and versions checked.
Security checks (RepoPilot estimate) · 4.2/10
OpenSSF has not scored this repository, so RepoPilot ran some of its checks from public GitHub data. Checks sorted from strongest to weakest.
- Recent activityLast commit 0d ago10/10
- Tests run on pull requestsCI configured + tests present10/10
- Least-privilege CI tokensWorkflows declare explicit, scoped permissions10/10
- License fileLicense: AGPL-3.08/10
- Pinned dependenciesOnly 0/26 actions pinned to SHAs2/10
- Code review before mergeOnly 7/20 recent PRs had requested reviewers2/10
- Automated dependency updatesNo Dependabot or Renovate config found0/10
- Security policyNo SECURITY.md found0/10
- Static analysis on commitsNo SAST workflow detected0/10
- Branch protectionDefault branch 'main' has no protection rule0/10
Maintenance
Outside contributions: 3 of 21 external pull requests merged (100% of those decided), median 28.9 days to merge.From the 87 most recently updated pull requests, bots excluded.
Pull requests
- Open
- 26
- 0 stale (60+ days, no update in 30)
- Merged
- 3
- of the 30 latest
- Median time to merge
- Same day
- From bots
- 2
- not listed below
Open
- #22386 feat: persist follow-up queue - hook rewrite (3/4, split from #20440)404-Page-Found · opened 2 days ago
- #20826 fix(agent-sessions): scope model selection to the session instead of the agent404-Page-Found · opened 34 days ago
- #21395 feat(media-ffmpeg): bundle Linux LGPL runtimeSiinXu · opened 15 days ago
- #21934 fix(subagent-resume): flow view shows the resumed agent's whole timelinetommyzhang100504 · opened 6 days ago
- #20776 Prevent runtime compaction summaries from leaking into chat transcriptCopilot · opened 35 days ago
Recently merged
- #22591 fix(tool-disclosure): restore scroll chaining at panel boundariestommyzhang100504 · merged 24 Oct 2026
- #22575 feat(provider-registry): support Kimi K3.1 Pro modelsousugo · merged 24 Oct 2026
The 30 most recently updated pull requests.
Top contributors
- DeJeune22 commits · 38%
- ousugo5 commits · 9%
- kangfenmao5 commits · 9%
- lianshuang-photo4 commits · 7%
- NatsUIJM4 commits · 7%
Of the 58 most recent commits.
Issues
- Open
- 2,125
- issues and pull requests, as GitHub counts them
- Median time to close
- Same day
- from 3 closed of the 46 latest
- Awaiting first reply
- 16
- of 43 open among the 46 latest
- Oldest open
- 1.6 years
Most wanted
- #22583 [Bug]: Brackets and double quotes in the input box can only be typed half at a time.1 reaction · 2 comments
- #22589 [Feature]: Let a system-imported skill re-sync from its source folder without losing agent enablement1 reaction · 0 comments
- #22588 [Feature]: Let MCP headers and stdio env values expand ${env:NAME} or {file:path}1 reaction · 0 comments
Rates come from the 46 most recently updated issues; the open count and oldest issue cover the whole repository.
Dependencies
Checked packages and import counts
These are the packages checked for known security issues, which may not be all of them. External imports are counted from the source code.