grafana / grafana
Repository health
Security, maintenance, dependencies and license for grafana/grafana.
Security
0
Critical
0 direct
0
High
0 direct
0
Moderate
0
Low
75 dependencies checked (25 direct), npm, via deps.dev. Findings apply only to the packages and versions checked.
OpenSSF Scorecard · 6.8/10
Checks sorted from strongest to weakest.
- Code review before mergeAll changesets reviewed10/10
- Recent activity30 commits and 4 issue activity found in the last 90 days10/10
- No risky CI workflowsNo dangerous workflow patterns detected10/10
- License fileLicense file detected10/10
- Security policySecurity policy file detected10/10
- No binaries in the repositoryNo binaries found in the repo10/10
- Published through a build pipelinePackaging workflow detected10/10
- Fuzz testingProject is fuzzed10/10
- Branch protectionBranch protection is not maximal on development and all release branches5/10
- Pinned dependenciesDependency not pinned by hash detected4/10
- OpenSSF best-practices badgeBadge detected: InProgress2/10
- Least-privilege CI tokensDetected GitHub workflow tokens with excessive permissions2/10
- Signed releasesProject has not signed or included provenance with any releases.0/10
- Static analysis on commitsSAST tool is not run on all commits0/10
GitHub Code Scanning: no alerts.
Maintenance
22 Oct 2026
Last commit
active
100+
Commits in the last year
3155
Contributors
all time · 54 in the last 90 commits
v13.2.4
Latest release
~3d cadence
Outside contributions: 20 of 89 external pull requests merged (87% of those decided), median 1 day to merge.From the 92 most recently updated pull requests, bots excluded.
Pull requests
- Open
- 25
- 0 stale (60+ days, no update in 30)
- Merged
- 2
- of the 30 latest
- Median time to merge
- Same day
- From bots
- 3
- not listed below
Open
- #135645 AuthZ: Expose LegacyCheck on shared authenticated connectionsmihai-turdean · opened today
- #135639 chore: add perf dashgtk-grafana · opened today
- #135653 IAM: Include teams in whoamiryantxu · opened today
- #135654 Live: Move live internals to apps/liveryantxu · opened today
- #135207 Alerting: Delete org rules through the rules APIrwwiv · opened 6 days ago
Recently merged
- #135600 Notebooks: Always show the time pickerjuanicabanas · merged 22 Oct 2026
- #135599 Notebooks: Never store a hidden time pickerjuanicabanas · merged 22 Oct 2026
The 30 most recently updated pull requests.
Top contributors
- pstibrany7 commits · 8%
- nmarrs5 commits · 6%
- gtk-grafana4 commits · 4%
- gngrchrl4 commits · 4%
- juanicabanas3 commits · 3%
Of the 90 most recent commits.
Issues
- Open
- 3,347
- issues and pull requests, as GitHub counts them
- Median time to close
- 104 days
- from 1 closed of the 19 latest
- Awaiting first reply
- 5
- of 18 open among the 19 latest
- Oldest open
- 12.6 years
Most wanted
- #11464 Prometheus histogram as stacked chart over time7 reactions · 9 comments
- #111828 Visualizations: Rendering issues on Safari 262 reactions · 4 comments
Rates come from the 19 most recently updated issues; the open count and oldest issue cover the whole repository.
Dependencies
Checked packages and import counts
These are the packages checked for known security issues, which may not be all of them. External imports are counted from the source code.
75
Packages checked
npm
25
Direct packages checked
listed in the manifest
50
Transitive packages checked
pulled in by other packages
2500
External imports
outside packages the code imports
License
AGPL-3.0
License
Strong copyleft (network)
Family
Unknown
License conflicts in dependencies
Dependency licenses were not checked
Commercial use: AGPL extends copyleft to network/hosted use — shipping it in a SaaS can require releasing your source. Review carefully before commercial use.