karpathy / nanochat
Repository health
Security advisories, maintenance activity, dependencies and license for karpathy/nanochat, with what was checked and what was not.
Security
9 dependencies checked (9 direct), pypi, via deps.dev. Findings apply only to the packages and versions checked.
OpenSSF Scorecard · 2.5/10
Checks sorted from strongest to weakest.
- LicensePermissive license: MIT10/10
- MaintainedLast commit 36d ago8/10
- Code-ReviewOnly 0/20 recent PRs had requested reviewers2/10
- CI-TestsNo CI workflows detected0/10
- Dependency-Update-ToolNo Dependabot or Renovate config found0/10
- Security-PolicyNo SECURITY.md found0/10
- SASTNo SAST workflow detected0/10
- Branch-ProtectionDefault branch 'master' has no protection rule0/10
- Token-PermissionsNo workflows to inspectnot scored
- Pinned-DependenciesNo workflows to inspectnot scored
Maintenance
Outside contributions: 2 of 92 external pull requests merged (4% of those decided), median 182 days to merge.From the 100 most recently updated pull requests, bots excluded.
Commit activity
100 commits sampledClick a bar to browse commits — or open GitHub for the full month ↓
Work rhythm
Commits by day of week
Pull request health
How fast do PRs resolve?
Days from open to merged / closed, last 7 PRs.
Pending right now23 open PRs
⚠ 4 stale PRs — open more than 60 days, no update in 30+
Long-running PRs without recent activity are usually maintainer-bandwidth signals — review process bottleneck, orphaned branches, or quietly abandoned work.
Issue triage — last 12 weeks
Blue bars = issues opened that week, green = closed. Healthy projects keep these roughly in balance — a persistently bigger blue bar means an opening backlog. open issues on GitHub ↗
Top contributors
Issue health
Computed from GitHub Issues — no estimates. Per-issue rates use the 17 most-recently-updated issues (recent, not all-time); the open total and oldest-open age are repo-wide.
Total open on the repo (authoritative).
From 4 recently-closed issues. p90 5mo.
Age of the longest-open unresolved issue.
5 of 13 recent open issues have no comments yet.
7 of 13 recent open issues had no update in 30d+.
9 of 13 recent open issues are unlabeled.
What the backlog is about
AI-generatedOpen issues grouped into themes by an LLM from their titles — a summary, not an authoritative classification. Numbers reflect the 13 most-recently-active open issues.
Most-wanted
Open issues with the most positive reactions — what the community is asking for.
RTX 3050TI Not detecting m.get_device()
#698 · opened 6mo ago · @the15thwiseone
Add support for TPU?
#284 · opened 11mo ago · @1-alexkarter
[Bug] scripts/chat_sft.py produces loss: nan from step 00001 on small device-batch-size (≤8) due to fully-masked micro-batches
#590 · opened 7mo ago · @suraj-self
Use Official PyTorch FA3 Builds
#737 · opened 5mo ago · @varunneal
Add support for OpenCL (e.g., for the integrated AMD GPU)?
#804 · opened 3mo ago · @virex-84
Most-discussed
Open issues with the most comments — where the conversation is.
Use Official PyTorch FA3 Builds
#737 · opened 5mo ago · @varunneal
[Bug] scripts/chat_sft.py produces loss: nan from step 00001 on small device-batch-size (≤8) due to fully-masked micro-batches
#590 · opened 7mo ago · @suraj-self
chat_rl: the sampled assistant_end token is masked out, so stopping is never reinforced
#810 · opened 2mo ago · @devYRPauli
RTX 3050TI Not detecting m.get_device()
#698 · opened 6mo ago · @the15thwiseone
SFT inherits pre-batch-scaling learning rates from base checkpoint
#848 · opened 1mo ago · @Qwertyemma
Labels in the recent sample
Per-issue rates are computed from a sample of 17 most-recently-updated issues, so they describe recent behavior rather than the all-time backlog. Reaction and comment counts come straight from GitHub.
Dependencies
Checked packages and import counts
Checked counts describe advisory coverage, not the repository’s complete dependency inventory. External imports come from a separate source-code graph.