jgraph / drawio-desktop
Repository health
Security, maintenance, dependencies and license for jgraph/drawio-desktop.
Security
66 dependencies checked (16 direct), npm, via deps.dev. Findings apply only to the packages and versions checked.
OpenSSF Scorecard · 4.6/10
Checks sorted from strongest to weakest.
- Security policySecurity policy file detected10/10
- No binaries in the repositoryNo binaries found in the repo10/10
- Recent activity30 commits and 0 issue activity found in the last 90 days10/10
- No risky CI workflowsNo dangerous workflow patterns detected10/10
- License fileLicense file detected10/10
- Pinned dependenciesDependency not pinned by hash detected2/10
- Code review before mergeFound 0/17 approved changesets0/10
- Least-privilege CI tokensDetected GitHub workflow tokens with excessive permissions0/10
- OpenSSF best-practices badgeNo effort to earn an OpenSSF best practices badge detected0/10
- Fuzz testingProject is not fuzzed0/10
- Static analysis on commitsSAST tool is not run on all commits0/10
- Signed releasesProject has not signed or included provenance with any releases.0/10
- Published through a build pipelinePackaging workflow not detectednot scored
- Branch protectionScorecard could not run this check.not scored
Maintenance
Outside contributions: 17 of 37 external pull requests merged (46% of those decided), median 0.7 days to merge.From the 37 most recently updated pull requests, bots excluded.
Pull requests
- Open
- 0
- 0 stale (60+ days, no update in 30)
- Merged
- 23
- of the 30 latest
- Median time to merge
- Same day
- From bots
- 24
- not listed below
Open
None from people in recent pull requests.
Recently merged
- #2575 Fix drawio -xf png parsing, point SECURITY.md at GitHub reporting, fix the Windows portable asset namedavidjgraph · merged 7 Oct 2026
- #2566 Adds --embed-svg-metadata to embed cell metadata in SVG exportsalderg · merged 3 Oct 2026
- #2555 Documents the submodule bump as following the drawio dev tipdavidjgraph · merged 23 Sept 2026
- #2556 Raises the appx MinVersion so Partner Center accepts the msixdavidjgraph · merged 23 Sept 2026
- #2554 Corrects the release process for the PR-based prepare-release flowdavidjgraph · merged 23 Sept 2026
The 30 most recently updated pull requests.
Top contributors
- davidjgraph79 commits · 90%
- alderg8 commits · 9%
- claude1 commit · 1%
Of the 88 most recent commits.
Issues
- Open
- 4
- issues and pull requests, as GitHub counts them
- Median time to close
- 16 days
- from 71 closed of the 75 latest
- Awaiting first reply
- 0
- of 4 open among the 75 latest
- Oldest open
- 121 days
Most wanted
- #2526 Linux: Embed AppImage update information2 reactions · 2 comments
Rates come from the 75 most recently updated issues; the open count and oldest issue cover the whole repository.
Dependencies
Checked packages and import counts
These are the packages checked for known security issues, which may not be all of them. External imports are counted from the source code.