fission-ai / openspec
Repository health
Security, maintenance, dependencies and license for fission-ai/openspec.
Security
73 dependencies checked (23 direct), npm, via deps.dev. Findings apply only to the packages and versions checked.
Security checks (RepoPilot estimate) · 6.2/10
OpenSSF has not scored this repository, so RepoPilot ran some of its checks from public GitHub data. Checks sorted from strongest to weakest.
- Recent activityLast commit 0d ago10/10
- License filePermissive license: MIT10/10
- Tests run on pull requestsCI configured + tests present10/10
- Least-privilege CI tokensWorkflows declare explicit, scoped permissions10/10
- Pinned dependenciesAll actions pinned to SHAs10/10
- Code review before merge10/20 recent PRs had requested reviewers6/10
- Automated dependency updatesNo Dependabot or Renovate config found0/10
- Security policyNo SECURITY.md found0/10
- Static analysis on commitsNo SAST workflow detected0/10
- Branch protectionInsufficient permissions to read branch protectionnot scored
Maintenance
Outside contributions: 20 of 51 external pull requests merged (57% of those decided), median 5 days to merge.From the 84 most recently updated pull requests, bots excluded.
Pull requests
- Open
- 18
- 0 stale (60+ days, no update in 30)
- Merged
- 11
- of the 30 latest
- Median time to merge
- 4 days
- From bots
- 4
- not listed below
Open
- #2012 docs(cli): propose multi-library command supportrunsonmypc · opened 23 days ago
- #2009 fix(list): discover descendant local librariesrunsonmypc · opened 23 days ago
- #1796 fix(archive): delegate workflow archive moves to the CLIrunsonmypc · opened 47 days ago
- #1826 feat(changes): organize plans by approvalrunsonmypc · opened 43 days ago
- #2134 feat(skills): openspec-beta skills, installed once per machine with migration and revertclay-good · opened 3 days ago
Recently merged
- #2141 fix(security): patch vitest, vite and launch-editor dev toolingclay-good · merged 23 Oct 2026
- #2140 fix(security): bump next to 16.4.2 in the websiteclay-good · merged 23 Oct 2026
- #2109 feat(update): add --dry-run to report what an update would changeclay-good · merged 22 Oct 2026
- #2114 fix(verify): match REMOVED baselines by exact normalized namesurlymochan · merged 22 Oct 2026
- #2120 fix(new-change): name the configured schema in the progress linesurlymochan · merged 22 Oct 2026
The 30 most recently updated pull requests.
Top contributors
- clay-good37 commits · 44%
- surlymochan4 commits · 5%
- runsonmypc4 commits · 5%
- ryandemelo3 commits · 4%
- drakeo3382 commits · 2%
Of the 85 most recent commits.
Issues
- Open
- 196
- issues and pull requests, as GitHub counts them
- Median time to close
- 4 days
- from 17 closed of the 32 latest
- Awaiting first reply
- 7
- of 15 open among the 32 latest
- Oldest open
- 360 days
Most wanted
- #2069 feat(validation): make requirement-description limits configurable by lifecycle scope4 reactions · 1 comment
- #1950 Feature: Store scoping — project-level store registry1 reaction · 3 comments
Rates come from the 32 most recently updated issues; the open count and oldest issue cover the whole repository.
Dependencies
Checked packages and import counts
These are the packages checked for known security issues, which may not be all of them. External imports are counted from the source code.
License compatibility
Repo license: MIT · 23 deps checked · 0 potential conflicts.