google / guava
Repository health
Security, maintenance, dependencies and license for google/guava.
Security
Dependencies were not checked for known security issues, because RepoPilot found no dependency manifest it can read. That does not mean they are safe. Inspect its manifests on GitHub ↗
OpenSSF Scorecard · 8.7/10
Checks sorted from strongest to weakest.
- Automated dependency updatesUpdate tool detected10/10
- No risky CI workflowsNo dangerous workflow patterns detected10/10
- Least-privilege CI tokensGitHub workflow tokens follow principle of least privilege10/10
- Recent activity30 commits and 12 issue activity found in the last 90 days10/10
- Pinned dependenciesAll dependencies are pinned10/10
- License fileLicense file detected10/10
- Security policySecurity policy file detected10/10
- No known vulnerabilities0 existing vulnerabilities detected10/10
- Fuzz testingProject is fuzzed10/10
- Contributors from several organisationsProject has 11 contributing companies or organizations10/10
- No binaries in the repositoryBinaries present in source code9/10
- Static analysis on commitsSAST tool is not run on all commits9/10
- Tests run on pull requests29 out of 30 merged PRs checked by a CI test9/10
- OpenSSF best-practices badgeBadge detected: InProgress2/10
- Code review before mergeFound 0/29 approved changesets0/10
- Published through a build pipelinePackaging workflow not detectednot scored
- Signed releasesNo releases foundnot scored
- Branch protectionScorecard could not run this check.not scored
Maintenance
Outside contributions: 0 of 36 external pull requests merged (0% of those decided).From the 37 most recently updated pull requests, bots excluded.
Pull requests
- Open
- 6
- 0 stale (60+ days, no update in 30)
- Merged
- 14
- of the 30 latest
- Median time to merge
- Same day
- From bots
- 15
- not listed below
Open
- #8760 Make `LittleEndianDataInputStream.skipBytes` match `DataInputStream`arshsmith1 · opened 2 days ago
- #8774 Make rotate a no-op on an empty rangeHuang-404-Q · opened today
- #8765 Check type-variable bounds when resolving a subtypeHuang-404-Q · opened 2 days ago
- #8756 Don't leave a cache entry stuck in the loading state if storing the loaded value throwsMahir-Puri · opened 5 days ago
- #8755 Make `listeningDecorator(ScheduledExecutorService)` cancel futures whose tasks the delegate cancels during shutdown.Divyansh151005 · opened 5 days ago
Recently merged
None from people in recent pull requests.
The 30 most recently updated pull requests.
Top contributors
- cpovirk66 commits · 68%
- kluever5 commits · 5%
- eamonnmcmanus4 commits · 4%
- arshsmith13 commits · 3%
- Cindy Krafft3 commits · 3%
Of the 97 most recent commits.
Issues
- Open
- 754
- issues and pull requests, as GitHub counts them
- Median time to close
- 9 days
- from 10 closed of the 15 latest
- Awaiting first reply
- 1
- of 5 open among the 15 latest
- Oldest open
- 12.0 years
Rates come from the 15 most recently updated issues; the open count and oldest issue cover the whole repository.
Dependencies
Checked packages and import counts
These are the packages checked for known security issues, which may not be all of them. External imports are counted from the source code.