RepoPilot

lyswhut / lx-music-desktop

Search lyswhut/lx-music-desktop

GitHub

Repository health

Security, maintenance, dependencies and license for lyswhut/lx-music-desktop.

Security

0
Critical
0 direct
0
High
0 direct
0
Moderate
0
Low

75 dependencies checked (25 direct), npm, via deps.dev. Findings apply only to the packages and versions checked.

OpenSSF Scorecard · 3.6/10

Checks sorted from strongest to weakest.

  • Recent activity26 commits and 5 issue activity found in the last 90 days10/10
  • No risky CI workflowsNo dangerous workflow patterns detected10/10
  • License fileLicense file detected10/10
  • No binaries in the repositoryBinaries present in source code5/10
  • Code review before mergeFound 6/30 approved changesets2/10
  • Pinned dependenciesDependency not pinned by hash detected1/10
  • Least-privilege CI tokensDetected GitHub workflow tokens with excessive permissions0/10
  • OpenSSF best-practices badgeNo effort to earn an OpenSSF best practices badge detected0/10
  • Security policySecurity policy file not detected0/10
  • Fuzz testingProject is not fuzzed0/10
  • Static analysis on commitsSAST tool is not run on all commits0/10
  • Signed releasesProject has not signed or included provenance with any releases.0/10
  • Published through a build pipelinePackaging workflow not detectednot scored
  • Branch protectionScorecard could not run this check.not scored

Maintenance

7 Oct 2026
Last commit
active
100+
Commits in the last year
22
Contributors
all time · 9 in the last 100 commits
v2.12.6
Latest release
~84d cadence

Outside contributions: 39 of 100 external pull requests merged (57% of those decided), median 1.3 days to merge.From the 100 most recently updated pull requests, bots excluded.

Recent releases

  • v2.12.619 Sept 2026 · 5 days after previous
  • v2.12.513 Sept 2026 · 1 day after previous
  • v2.12.412 Sept 2026 · same day as previous
  • v2.12.312 Sept 2026 · 134 days after previous
  • v2.12.21 May 2026 · 74 days after previous

Pull requests

Open
12
4 stale (60+ days, no update in 30)
Merged
8
of the 30 latest
Median time to merge
1 day
From bots
0
not listed below

The 30 most recently updated pull requests.

Top contributors

Of the 100 most recent commits.

Issues

Open
1,301
issues and pull requests, as GitHub counts them
Median time to close
5 days
from 20 closed of the 86 latest
Awaiting first reply
23
of 66 open among the 86 latest
Oldest open
7.2 years

Most wanted

Rates come from the 86 most recently updated issues; the open count and oldest issue cover the whole repository.

Dependencies

Checked packages and import counts

These are the packages checked for known security issues, which may not be all of them. External imports are counted from the source code.

75
Packages checked
npm
25
Direct packages checked
listed in the manifest
50
Transitive packages checked
pulled in by other packages
Unknown
External imports
outside packages the code imports

License compatibility

Repo license: Apache-2.0 · 25 deps checked · 0 potential conflicts.

License

Apache-2.0
License
Permissive
Family
0
License conflicts in dependencies
25 dependencies checked
Commercial use: Generally fine for commercial and proprietary use, subject to attribution and notice terms. Apache-2.0 also grants a patent licence.