mhsanaei / 3x-ui
Repository health
Security, maintenance, dependencies and license for mhsanaei/3x-ui.
Security
25 dependencies checked (25 direct), go, via deps.dev. Findings apply only to the packages and versions checked.
Security checks (RepoPilot estimate) · 5.2/10
OpenSSF has not scored this repository, so RepoPilot ran some of its checks from public GitHub data. Checks sorted from strongest to weakest.
- Recent activityLast commit 0d ago10/10
- Tests run on pull requestsCI configured + tests present10/10
- Static analysis on commitsCodeQL action detected in workflows10/10
- Least-privilege CI tokensWorkflows declare explicit, scoped permissions10/10
- License fileLicense: GPL-3.08/10
- Pinned dependenciesOnly 0/42 actions pinned to SHAs2/10
- Code review before mergeOnly 0/20 recent PRs had requested reviewers2/10
- Automated dependency updatesNo Dependabot or Renovate config found0/10
- Security policyNo SECURITY.md found0/10
- Branch protectionDefault branch 'main' has no protection rule0/10
Maintenance
Outside contributions: 48 of 86 external pull requests merged (62% of those decided), median 4 days to merge.From the 90 most recently updated pull requests, bots excluded.
Recent releases
- dev-latest24 Jun 2026 · -112 days after previous
- v3.10.214 Oct 2026 · 2 days after previous
- v3.10.012 Oct 2026 · 9 days after previous
- v3.9.03 Oct 2026 · 17 days after previous
- v3.8.516 Sept 2026 · 1 day after previous
Pull requests
- Open
- 3
- 0 stale (60+ days, no update in 30)
- Merged
- 25
- of the 30 latest
- Median time to merge
- 6 days
- From bots
- 0
- not listed below
Open
- #6917 ci: run the PostgreSQL suites that never ran, and lint the shell, the workflows and the docs specmuditagrawal2007 · opened today
- #6620 feat(sub): bind per-client host rule override for subscription SNINethminaYasas · opened 33 days ago
- #6916 perf(runtime): pool the local xray gRPC connectionmuditagrawal2007 · opened today
Recently merged
- #6880 fix(fallbackscard): derive fallback Proxy Protocol defaults from child inboundsmvanhorn · merged 24 Oct 2026
- #6895 feat(hosts): add drag-and-drop and global subscription orderingHamedSanaei · merged 24 Oct 2026
- #6838 feat(sub): map shadowsocks tcp http header to mihomo obfs pluginEmmaHermione · merged 24 Oct 2026
- #6848 frontend: replace telegram bot message icon with TelegramFilledrashid-yusubov · merged 24 Oct 2026
- #6881 feat(amneziawg): support persistent keepalive rangesYoungReckless4 · merged 24 Oct 2026
The 30 most recently updated pull requests.
Top contributors
- MHSanaei57 commits · 57%
- jayhemnani99105 commits · 5%
- HamedSanaei4 commits · 4%
- muditagrawal20074 commits · 4%
- mvanhorn2 commits · 2%
Of the 100 most recent commits.
Issues
- Open
- 209
- issues and pull requests, as GitHub counts them
- Median time to close
- 2 days
- from 16 closed of the 34 latest
- Awaiting first reply
- 0
- of 18 open among the 34 latest
- Oldest open
- 144 days
Most wanted
- #6727 [Bug]: Reality inbound fails on Ubuntu 24 but works on Debian 12 (3x-ui 3.9.0, Min Client Ver 1.0.0)1 reaction · 9 comments
- #6891 [Bug]: FYI The docker compose doesn't build1 reaction · 2 comments
Rates come from the 34 most recently updated issues; the open count and oldest issue cover the whole repository.
Dependencies
Checked packages and import counts
These are the packages checked for known security issues, which may not be all of them. External imports are counted from the source code.
Packages pulled in by these were not checked.