spring-projects / spring-framework
Repository health
Security, maintenance, dependencies and license for spring-projects/spring-framework.
Security
7 dependencies checked (7 direct), npm, via deps.dev. Findings apply only to the packages and versions checked.
OpenSSF Scorecard · 6.0/10
Checks sorted from strongest to weakest.
- Recent activity30 commits and 14 issue activity found in the last 90 days10/10
- Security policySecurity policy file detected10/10
- No risky CI workflowsNo dangerous workflow patterns detected10/10
- License fileLicense file detected10/10
- Fuzz testingProject is fuzzed10/10
- No binaries in the repositoryBinaries present in source code9/10
- Pinned dependenciesDependency not pinned by hash detected7/10
- Branch protectionBranch protection is not maximal on development and all release branches3/10
- Code review before mergeFound 3/30 approved changesets1/10
- Least-privilege CI tokensDetected GitHub workflow tokens with excessive permissions0/10
- OpenSSF best-practices badgeNo effort to earn an OpenSSF best practices badge detected0/10
- Static analysis on commitsSAST tool is not run on all commits0/10
- Published through a build pipelinePackaging workflow not detectednot scored
- Signed releasesNo releases foundnot scored
Maintenance
Outside contributions: 13 of 100 external pull requests merged (32% of those decided), median 2.3 days to merge.From the 100 most recently updated pull requests, bots excluded.
Pull requests
- Open
- 16
- 0 stale (60+ days, no update in 30)
- Merged
- 7
- of the 30 latest
- Median time to merge
- 62 days
- From bots
- 0
- not listed below
Open
- #37548 Detect whitespace text in `XMLEventStreamReader#isWhiteSpace`lejuho · opened today
- #37544 Skip externally managed members in AOT injectioncodeconsole · opened today
- #37545 Require semicolon before MIME type parametersnamest504 · opened today
- #37546 Ignore empty values and list elements in `Forwarded` headernamest504 · opened today
- #37534 Avoid leaking temp file when disk limit is exceeded in `PartGenerator`namest504 · opened 1 day ago
Recently merged
- #37159 Fix busy-spin in SubscriberInputStream await()flex-donggyu · merged 21 Oct 2026
- #37532 Fix fully populated check in `DataClassRowMapper` for classes with settersnamest504 · merged 21 Oct 2026
- #36915 Validate namespace and local name in requirejunhyeong9812 · merged 21 Oct 2026
- #37525 Avoid overflow for default `maxDelay` with `timeUnit` in `@Retryable`namest504 · merged 21 Oct 2026
- #36853 Document LocaleContextHolder inheritable behaviorcfcromn · merged 21 Oct 2026
The 30 most recently updated pull requests.
Top contributors
- sbrannen36 commits · 36%
- bclozel26 commits · 26%
- jhoeller11 commits · 11%
- rstoyanchev5 commits · 5%
- namest5043 commits · 3%
Of the 100 most recent commits.
Issues
- Open
- 517
- issues and pull requests, as GitHub counts them
- Median time to close
- 6 days
- from 16 closed of the 39 latest
- Awaiting first reply
- 9
- of 23 open among the 39 latest
- Oldest open
- 17.7 years
Most wanted
- #21829 Support @RequestParam, @RequestHeader, etc. as meta-annotations [SPR-17296]21 reactions · 7 comments
- #30985 @Lazy not working in Native mode5 reactions · 19 comments
Rates come from the 39 most recently updated issues; the open count and oldest issue cover the whole repository.
Dependencies
Checked packages and import counts
These are the packages checked for known security issues, which may not be all of them. External imports are counted from the source code.
Packages pulled in by these were not checked.
License compatibility
Repo license: Apache-2.0 · 7 deps checked · 0 potential conflicts.