plotly / dash
Repository health
Security, maintenance, dependencies and license for plotly/dash.
Security
58 dependencies checked (8 direct), npm, via deps.dev. Findings apply only to the packages and versions checked.
OpenSSF Scorecard · 5.3/10
Checks sorted from strongest to weakest.
- Recent activity30 commits and 7 issue activity found in the last 90 days10/10
- No risky CI workflowsNo dangerous workflow patterns detected10/10
- No binaries in the repositoryNo binaries found in the repo10/10
- License fileLicense file detected10/10
- Static analysis on commitsSAST tool is run on all commits10/10
- Code review before mergeFound 6/8 approved changesets7/10
- Pinned dependenciesDependency not pinned by hash detected2/10
- Least-privilege CI tokensDetected GitHub workflow tokens with excessive permissions0/10
- OpenSSF best-practices badgeNo effort to earn an OpenSSF best practices badge detected0/10
- Security policySecurity policy file not detected0/10
- Fuzz testingProject is not fuzzed0/10
- Signed releasesProject has not signed or included provenance with any releases.0/10
- Published through a build pipelinePackaging workflow not detectednot scored
- Branch protectionScorecard could not run this check.not scored
Maintenance
Outside contributions: 30 of 49 external pull requests merged (94% of those decided), median 3 days to merge.From the 52 most recently updated pull requests, bots excluded.
Pull requests
- Open
- 14
- 0 stale (60+ days, no update in 30)
- Merged
- 8
- of the 30 latest
- Median time to merge
- 1 day
- From bots
- 14
- not listed below
Open
- #4076 Fix numeric customdata in Graph eventsmonsterlag · opened today
- #4074 Decode the pages router pathname before matching itb84330808 · opened 1 day ago
- #4015 Replace dcc.Loading circle spinner with a rotating ringbudescode · opened 24 days ago
- #4012 fix: handle None return from error handler in no-output background callbacksdajiaohuang · opened 27 days ago
- #4067 Serialize only the values the JSON encoder cannot takeT4rk1n · opened 7 days ago
Recently merged
- #4052 fix(renderer): clear paths for null children0d00ciallo0721 · merged 21 Oct 2026
- #4075 Fix security findings reported against 4.5.0rc1T4rk1n · merged 21 Oct 2026
- #4073 Move plotly-cloud back to the optional cloud extraT4rk1n · merged 21 Oct 2026
- #4072 Bump numpy cap in CI requirements to 2.5.4T4rk1n · merged 21 Oct 2026
- #4069 Version 4.5.0rc1 (master)T4rk1n · merged 15 Oct 2026
The 30 most recently updated pull requests.
Top contributors
- T4rk1n68 commits · 74%
- BSd3v12 commits · 13%
- AnnMarieW6 commits · 7%
- 0d00ciallo07212 commits · 2%
- raashish16012 commits · 2%
Of the 92 most recent commits.
Issues
- Open
- 433
- issues and pull requests, as GitHub counts them
- Median time to close
- 28 days
- from 15 closed of the 28 latest
- Awaiting first reply
- 1
- of 13 open among the 28 latest
- Oldest open
- 8.4 years
Most wanted
- #3037 add dash-uploader to dash core components 2 reactions · 8 comments
Rates come from the 28 most recently updated issues; the open count and oldest issue cover the whole repository.
Dependencies
Checked packages and import counts
These are the packages checked for known security issues, which may not be all of them. External imports are counted from the source code.
License compatibility
Repo license: MIT · 8 deps checked · 0 potential conflicts.