h5bp / html5-boilerplate
Repository health
Security, maintenance, dependencies and license for h5bp/html5-boilerplate.
Security
0
Critical
0 direct
0
High
0 direct
0
Moderate
0
Low
65 dependencies checked (15 direct), npm, via deps.dev. Findings apply only to the packages and versions checked.
OpenSSF Scorecard · 5.9/10
Checks sorted from strongest to weakest.
- No binaries in the repositoryNo binaries found in the repo10/10
- Automated dependency updatesUpdate tool detected10/10
- No risky CI workflowsNo dangerous workflow patterns detected10/10
- License fileLicense file detected10/10
- Static analysis on commitsSAST tool is run on all commits10/10
- Tests run on pull requests30 out of 30 merged PRs checked by a CI test10/10
- Contributors from several organisationsProject has 82 contributing companies or organizations10/10
- Pinned dependenciesDependency not pinned by hash detected8/10
- Code review before mergeFound 6/8 approved changesets7/10
- Recent activity7 commits and 0 issue activity found in the last 90 days5/10
- No known vulnerabilities5 existing vulnerabilities detected5/10
- Least-privilege CI tokensDetected GitHub workflow tokens with excessive permissions0/10
- OpenSSF best-practices badgeNo effort to earn an OpenSSF best practices badge detected0/10
- Signed releasesProject has not signed or included provenance with any releases.0/10
- Fuzz testingProject is not fuzzed0/10
- Security policySecurity policy file not detected0/10
- Published through a build pipelinePackaging workflow not detectednot scored
- Branch protectionScorecard could not run this check.not scored
Maintenance
12 Oct 2026
Last commit
active
53
Commits in the last year
316
Contributors
all time · 15 in the last 66 commits
v9.0.1
Latest release
~210d cadence
Outside contributions: 3 of 22 external pull requests merged (18% of those decided), median 2.2 days to merge.From the 29 most recently updated pull requests, bots excluded.
Recent releases
- v9.0.116 Apr 2024 · 132 days after previous
- v9.0.06 Dec 2023 · 1280 days after previous
- v8.0.0-RC24 Jun 2020 · same day as previous
- v8.0.04 Jun 2020 · 2 days after previous
- v8.0.0-RC13 Jun 2020 · 196 days after previous
Pull requests
- Open
- 9
- 3 stale (60+ days, no update in 30)
- Merged
- 7
- of the 30 latest
- Median time to merge
- 3 days
- From bots
- 23
- not listed below
Open
- #3504 ci: pin the last three refs, replace two archived release actions and scope the dist workflow tokenTotara-thib · opened 5 days ago
Recently merged
- #3490 Remove `initial-scale=1` from viewportcoliff · merged 14 Sept 2026
- #3491 Dev Deps Update & Run Prettiercoliff · merged 14 Sept 2026
The 30 most recently updated pull requests.
Top contributors
- roblarsen36 commits · 55%
- coliff16 commits · 24%
- Abhisshek7172 commits · 3%
- Lourdesmarco1 commit · 2%
- nightt58791 commit · 2%
Of the 66 most recent commits.
Issues
- Open
- 22
- issues and pull requests, as GitHub counts them
Most wanted
- #3038 [feat] : Enhance Accessibility Documentation for Inclusive Web Development8 reactions · 6 comments
Dependencies
Checked packages and import counts
These are the packages checked for known security issues, which may not be all of them. External imports are counted from the source code.
65
Packages checked
npm
15
Direct packages checked
listed in the manifest
50
Transitive packages checked
pulled in by other packages
Unknown
External imports
outside packages the code imports
License compatibility
Repo license: MIT · 15 deps checked · 0 potential conflicts.
License
MIT
License
Permissive
Family
0
License conflicts in dependencies
15 dependencies checked
Commercial use: Generally fine for commercial and proprietary use, subject to attribution and notice terms.