mrdoob / three.js
Repository health
Security advisories, maintenance activity, dependencies and license for mrdoob/three.js, with what was checked and what was not.
Security
66 dependencies checked (16 direct), npm, via deps.dev. Findings apply only to the packages and versions checked.
OpenSSF Scorecard · 7.1/10
Checks sorted from strongest to weakest.
- Maintained30 commit(s) and 11 issue activity found in the last 90 days -- score normalized to 1010/10
- Security-Policysecurity policy file detected10/10
- Dangerous-Workflowno dangerous workflow patterns detected10/10
- Token-PermissionsGitHub workflow tokens follow principle of least privilege10/10
- Licenselicense file detected10/10
- Pinned-Dependenciesall dependencies are pinned10/10
- SASTSAST tool is run on all commits10/10
- Binary-Artifactsbinaries present in source code7/10
- Code-ReviewFound 14/26 approved changesets -- score normalized to 55/10
- CII-Best-Practicesno effort to earn an OpenSSF best practices badge detected0/10
- Branch-Protectionbranch protection not enabled on development/release branches0/10
- Fuzzingproject is not fuzzed0/10
- Packagingpackaging workflow not detectednot scored
- Signed-Releasesno releases foundnot scored
Maintenance
Outside contributions: 22 of 56 external pull requests merged (55% of those decided), median 0 days to merge.From the 98 most recently updated pull requests, bots excluded.
Commit activity
100 commits sampledClick a bar to browse commits — or open GitHub for the full month ↓
Work rhythm
Commits by day of week
Pull request health
How fast do PRs resolve?
Days from open to merged / closed, last 21 PRs.
Pending right now9 open PRs
Recently merged18 PRs in the recent window
Issue triage — last 12 weeks
Blue bars = issues opened that week, green = closed. Healthy projects keep these roughly in balance — a persistently bigger blue bar means an opening backlog. open issues on GitHub ↗
Release cadence· median 55d between releases
Latest r186 shipped 20d ago · typical gap 55d · shipping slower than before · 10 releases sampled.
New faces — last 90 days12 contributors appearing for the first time in this window
Heuristic: contributors whose earliest commit in the recent sample is < 90 days old AND who have ≤ 3 commits in the window. Click a name for their commits in this repo.
Top contributors
Issue health
Computed from GitHub Issues — no estimates. Per-issue rates use the 16 most-recently-updated issues (recent, not all-time); the open total and oldest-open age are repo-wide.
Total open on the repo (authoritative).
From 9 recently-closed issues. p90 7.4y.
Age of the longest-open unresolved issue.
2 of 7 recent open issues have no comments yet.
0 of 7 recent open issues had no update in 30d+.
1 of 7 recent open issues are unlabeled.
What the backlog is about
AI-generatedOpen issues grouped into themes by an LLM from their titles — a summary, not an authoritative classification. Numbers reflect the 7 most-recently-active open issues.
Most-wanted
Open issues with the most positive reactions — what the community is asking for.
TSL performance optimizations
#34386 · opened 1mo ago · @mrdoob
FP16 Precision via TSL?
#34335 · opened 1mo ago · @bhouston
WebGPURenderer: Add option to enable maximum buffer limits
#34344 · opened 1mo ago · @gkjohnson
MeshPhysicalMaterial: Add EON (Energy-preserving Oren-Nayar) diffuse BRDF to MeshPhysicalMaterial
#34351 · opened 1mo ago · @Ryan-G7
Most-discussed
Open issues with the most comments — where the conversation is.
BufferGeometryUtils.mergeVertices example has a hashing bug with minimal tolerance value
#31550 · opened 1y ago · @xixixao
WebGPURenderer: Add option to enable maximum buffer limits
#34344 · opened 1mo ago · @gkjohnson
FP16 Precision via TSL?
#34335 · opened 1mo ago · @bhouston
Several unit test files are empty QUnit.module scaffolding
#34371 · opened 1mo ago · @unlikelyzero
TSL performance optimizations
#34386 · opened 1mo ago · @mrdoob
Labels in the recent sample
Per-issue rates are computed from a sample of 16 most-recently-updated issues, so they describe recent behavior rather than the all-time backlog. Reaction and comment counts come straight from GitHub.
Dependencies
Checked packages and import counts
Checked counts describe advisory coverage, not the repository’s complete dependency inventory. External imports come from a separate source-code graph.