skylot / jadx
Repository health
Security, maintenance, dependencies and license for skylot/jadx.
Security
Dependencies were not checked for known security issues, because RepoPilot found no dependency manifest it can read. That does not mean they are safe. Inspect its manifests on GitHub ↗
OpenSSF Scorecard · 4.7/10
Checks sorted from strongest to weakest.
- Recent activity30 commits and 10 issue activity found in the last 90 days10/10
- No risky CI workflowsNo dangerous workflow patterns detected10/10
- Security policySecurity policy file detected10/10
- License fileLicense file detected10/10
- No binaries in the repositoryBinaries present in source code9/10
- Code review before mergeFound 26/30 approved changesets8/10
- Least-privilege CI tokensDetected GitHub workflow tokens with excessive permissions0/10
- OpenSSF best-practices badgeNo effort to earn an OpenSSF best practices badge detected0/10
- Pinned dependenciesDependency not pinned by hash detected0/10
- Fuzz testingProject is not fuzzed0/10
- Signed releasesProject has not signed or included provenance with any releases.0/10
- Branch protectionBranch protection not enabled on development/release branches0/10
- Static analysis on commitsSAST tool is not run on all commits0/10
- Published through a build pipelinePackaging workflow not detectednot scored
Maintenance
23 Oct 2026
Last commit
active
100+
Commits in the last year
174
Contributors
all time · 27 in the last 95 commits
v1.5.6
Latest release
~151d cadence
Outside contributions: 49 of 89 external pull requests merged (78% of those decided), median 1.7 days to merge.From the 96 most recently updated pull requests, bots excluded.
Pull requests
- Open
- 14
- 0 stale (60+ days, no update in 30)
- Merged
- 14
- of the 30 latest
- Median time to merge
- 1 day
- From bots
- 0
- not listed below
Open
- #3030 fix(gui): describe deobfuscation whitelist as space separated in tooltipprotonnegativo · opened today
- #3028 fix: don't mark a method's throws as visited before its blocks are loadedHuzaifaChaudary · opened 1 day ago
- #3026 fix: copy a short return tail reached from a loop body and from before the loopHuzaifaChaudary · opened 2 days ago
- #3024 fix: keep code after try/catch out of 'if' branch inside trycpruijsen · opened 5 days ago
- #3023 fix: keep outer class name for own inner classes in class headercpruijsen · opened 5 days ago
Recently merged
- #3020 fix: don't use constants from not accessible classes for replacementHawkForge · merged 23 Oct 2026
- #3027 feat(gui): expose docking functionality to pluginsnitanmarcel · merged 23 Oct 2026
- #3012 feat(gui): docking support using ModernDockingnitanmarcel · merged 14 Oct 2026
- #3003 fix(core): don't expand single null or array element of varargs calljayhemnani9910 · merged 13 Oct 2026
- #3002 fix(core): keep string concat when the first two operands are not stringsjayhemnani9910 · merged 12 Oct 2026
The 30 most recently updated pull requests.
Top contributors
- skylot41 commits · 43%
- mostafaNazari70215 commits · 16%
- oriori17034 commits · 4%
- HdShare4 commits · 4%
- jpstotz4 commits · 4%
Of the 95 most recent commits.
Issues
- Open
- 461
- issues and pull requests, as GitHub counts them
- Median time to close
- 3 days
- from 20 closed of the 32 latest
- Awaiting first reply
- 5
- of 12 open among the 32 latest
- Oldest open
- 12.0 years
Most wanted
- #2884 [core] Failed to restore switch over string1 reaction · 1 comment
- #2968 [feature][plugins] Allow jadx plugins to depend and access other plugins1 reaction · 0 comments
Rates come from the 32 most recently updated issues; the open count and oldest issue cover the whole repository.
Dependencies
Checked packages and import counts
These are the packages checked for known security issues, which may not be all of them. External imports are counted from the source code.
Not checked
Packages checked
Unknown
External imports
outside packages the code imports
License
Apache-2.0
License
Permissive
Family
Unknown
License conflicts in dependencies
Dependency licenses were not checked
Commercial use: Generally fine for commercial and proprietary use, subject to attribution and notice terms. Apache-2.0 also grants a patent licence.