microsoft / monaco-editor
Repository health
Security, maintenance, dependencies and license for microsoft/monaco-editor.
Security
75 dependencies checked (25 direct), npm, via deps.dev. Findings apply only to the packages and versions checked.
OpenSSF Scorecard · 7.8/10
Checks sorted from strongest to weakest.
- Recent activity30 commits out of 30 and 1 issue activity out of 30 found in the last 90 days10/10
- Code review before mergeAll last 30 commits are reviewed through GitHub10/10
- No known vulnerabilitiesNo vulnerabilities detected10/10
- Security policySecurity policy file detected10/10
- License fileLicense file detected10/10
- No risky CI workflowsNo dangerous workflow patterns detected10/10
- No binaries in the repositoryNo binaries found in the repo10/10
- Automated dependency updatesUpdate tool detected10/10
- Branch protectionBranch protection is not maximal on development and all release branches8/10
- Pinned dependenciesDependency not pinned by hash detected7/10
- OpenSSF best-practices badgeNo badge detected0/10
- Least-privilege CI tokensNon read-only tokens detected in GitHub workflows0/10
- Fuzz testingProject is not fuzzed0/10
- Signed releasesNo releases foundnot scored
- Published through a build pipelineNo published package detectednot scored
Maintenance
Outside contributions: 2 of 27 external pull requests merged (22% of those decided), median 23 days to merge.From the 29 most recently updated pull requests, bots excluded.
Recent releases
- v0.57.024 Sept 2026 · same day as previous
- v0.57.0-rc.224 Sept 2026 · 66 days after previous
- v0.56.020 Jul 2026 · 25 days after previous
- v0.56.0-dev-2026062525 Jun 2026 · 134 days after previous
- v0.56.0-dev-2026021111 Feb 2026 · 1 day after previous
Pull requests
- Open
- 14
- 0 stale (60+ days, no update in 30)
- Merged
- 12
- of the 30 latest
- Median time to merge
- 1 day
- From bots
- 18
- not listed below
Open
- #5552 fix: recognize regex literals before a ternary colonmangeshraut712 · opened today
- #5536 Add Mojo 1.1.0 syntax highlighting and editing supportd5ng4i · opened 8 days ago
- #5481 fix(build): exclude deprecated .worker.ts entrypoints from AMD buildMichaelDoyle · opened 36 days ago
- #5494 Add SAS language supportallanbowe · opened 25 days ago
- #5537 ci: add npmscan dependency security checksalemalem · opened 8 days ago
Recently merged
- #5477 Fix ini comments not being highlighted when indentedqirong77 · merged 22 Oct 2026
The 30 most recently updated pull requests.
Top contributors
- hediet45 commits · 79%
- meganrogge3 commits · 5%
- Yoyokrazy2 commits · 4%
- hawkticehurst2 commits · 4%
- qirong771 commit · 2%
Of the 57 most recent commits.
Issues
- Open
- 887
- issues and pull requests, as GitHub counts them
- Median time to close
- 35 days
- from 4 closed of the 37 latest
- Awaiting first reply
- 13
- of 33 open among the 37 latest
- Oldest open
- 10.3 years
Most wanted
- #5352 [Bug] Update dompurify to >= 3.4.99 reactions · 13 comments
- #5454 Bump bundled DOMPurify to 3.4.12+ (0.56.0 ships 3.4.8)7 reactions · 5 comments
- #4438 [Bug] Paste in editor context menu broken on monaco-editor 0.475 reactions · 3 comments
Rates come from the 37 most recently updated issues; the open count and oldest issue cover the whole repository.
Dependencies
Checked packages and import counts
These are the packages checked for known security issues, which may not be all of them. External imports are counted from the source code.
License compatibility
Repo license: MIT · 24 deps checked · 0 potential conflicts.