pallets / click
Repository health
Security, maintenance, dependencies and license for pallets/click.
Security
Dependencies were not checked for known security issues, because RepoPilot found no dependency manifest it can read. That does not mean they are safe. Inspect its manifests on GitHub ↗
OpenSSF Scorecard · 7.2/10
Checks sorted from strongest to weakest.
- Recent activity30 commits and 22 issue activity found in the last 90 days10/10
- No risky CI workflowsNo dangerous workflow patterns detected10/10
- No binaries in the repositoryNo binaries found in the repo10/10
- Least-privilege CI tokensGitHub workflow tokens follow principle of least privilege10/10
- Fuzz testingProject is fuzzed10/10
- License fileLicense file detected10/10
- Published through a build pipelinePackaging workflow detected10/10
- Security policySecurity policy file detected9/10
- Pinned dependenciesDependency not pinned by hash detected8/10
- Code review before mergeFound 11/14 approved changesets7/10
- Branch protectionBranch protection is not maximal on development and all release branches3/10
- OpenSSF best-practices badgeNo effort to earn an OpenSSF best practices badge detected0/10
- Signed releasesProject has not signed or included provenance with any releases.0/10
- Static analysis on commitsSAST tool is not run on all commits0/10
Maintenance
Outside contributions: 5 of 71 external pull requests merged (7% of those decided), median 14.1 days to merge.From the 100 most recently updated pull requests, bots excluded.
Pull requests
- Open
- 3
- 0 stale (60+ days, no update in 30)
- Merged
- 11
- of the 30 latest
- Median time to merge
- Same day
- From bots
- 0
- not listed below
Open
- #3880 Split `PAGER` and `EDITOR` with a Windows-specific `shlex` equivalentkdeldycke · opened 19 days ago
- #3827 Require a parameter name to be a non-keyword Python identifierkdeldycke · opened 42 days ago
- #3878 Print `\x04` and `\x1a` input bytes as `^D` and `^Z` in `CliRunner`kdeldycke · opened 19 days ago
Recently merged
- #3884 Fix `show_envvar` output for a sequence or an empty `envvar`kdeldycke · merged 6 Oct 2026
- #3877 Add `Parameter.spec` and deprecate `human_readable_name`kdeldycke · merged 4 Oct 2026
- #3866 Deprecate parameter names that are: not a Python identifier, or a Python Keyword, or not lower-casedkdeldycke · merged 23 Sept 2026
- #3876 Merge stable into mainRowlando13 · merged 21 Sept 2026
- #3860 Always list all positional argumentskdeldycke · merged 21 Sept 2026
The 30 most recently updated pull requests.
Top contributors
- Rowlando1354 commits · 54%
- kdeldycke43 commits · 43%
- casperdcl1 commit · 1%
- AndreasBackx1 commit · 1%
- kobihikri1 commit · 1%
Of the 100 most recent commits.
Issues
- Open
- 85
- issues and pull requests, as GitHub counts them
- Median time to close
- 3 days
- from 13 closed of the 18 latest
- Awaiting first reply
- 0
- of 5 open among the 18 latest
- Oldest open
- 11.5 years
Rates come from the 18 most recently updated issues; the open count and oldest issue cover the whole repository.
Dependencies
Checked packages and import counts
These are the packages checked for known security issues, which may not be all of them. External imports are counted from the source code.