RepoPilot

supabase / cli

Search supabase/cli

GitHub

Repository health

Security advisories, maintenance activity, dependencies and license for supabase/cli, with what was checked and what was not.

Security

0
Critical
0 direct
0
High
0 direct
0
Moderate
0
Low

16 dependencies checked (16 direct), npm, via deps.dev. Findings apply only to the packages and versions checked.

OpenSSF Scorecard · 5.9/10

Checks sorted from strongest to weakest.

  • Code-Reviewall changesets reviewed10/10
  • Dangerous-Workflowno dangerous workflow patterns detected10/10
  • Maintained30 commit(s) and 6 issue activity found in the last 90 days -- score normalized to 1010/10
  • Binary-Artifactsno binaries found in the repo10/10
  • Security-Policysecurity policy file detected10/10
  • SASTSAST tool detected but not run on all commits8/10
  • Pinned-Dependenciesdependency not pinned by hash detected -- score normalized to 66/10
  • Branch-Protectionbranch protection is not maximal on development and all release branches4/10
  • CII-Best-Practicesno effort to earn an OpenSSF best practices badge detected0/10
  • Token-Permissionsdetected GitHub workflow tokens with excessive permissions0/10
  • Licenselicense file not detected0/10
  • Signed-ReleasesProject has not signed or included provenance with any releases.0/10
  • Fuzzingproject is not fuzzed0/10
  • Packagingpackaging workflow not detectednot scored

GitHub Code Scanning: 0 open of 0 alerts.

Maintenance

13 Oct 2026
Last commit
active
100
Commits / year
10
Contributors
recent window
v3.0.0-next.7
Latest release
~0d cadence

Outside contributions: 14 of 28 external pull requests merged (67% of those decided), median 1 day to merge.From the 65 most recently updated pull requests, bots excluded.

Recent releases

Commit activity

100 commits sampled
May
Jun
Jul
Aug
Sep
Oct

Click a bar to browse commits — or open GitHub for the full month ↓

Work rhythm

Commits by day of week

Pull request health

Resolution rate0%
1
Open
0
Merged / Closed
Median time to merge/close: 2h · last 18 PRs

How fast do PRs resolve?

< 1d
16
1–3d
0
4–7d
2
1–4w
0
> 1mo
0

Days from open to merged / closed, last 18 PRs.

Pending right now12 open PRs

◌avallete
#7125ci(release): land approved sync heads even when the source moved
by avalleteopened yesterday
◌jgoux
#7123fix(cli): route every management api call through the typed client
by jgouxopened yesterday
◌avallete
#7124ci(release): approve green, reviewed develop-into-next syncs as supabase-oss
by avalleteopened yesterday
◌7ttp
#7122chore(cli): bring the remaining commands under the effect skill (CLI-2693)
by 7ttpopened yesterday
◌avallete
#7121ci(stack): shard macOS native scenarios
by avalleteopened yesterday
◌supabase-cli-releaser[bot]
#7112chore(repo): sync develop into next
by supabase-cli-releaser[bot]opened yesterday
◌Prashansa-K
#7106chore(cli): map secrets list, snippets list and db query permissions
by Prashansa-Kopened yesterday
◌supabase-cli-releaser[bot]
#7104chore: production deploy
by supabase-cli-releaser[bot]opened yesterday

Recently merged17 PRs in the recent window

✓avallete
#7120ci(release): give sync repair the failing test output, not just the log tail
by avalletemerged yesterday
✓Prashansa-K
#7105chore(cli): add permission building blocks for shared API calls
by Prashansa-Kmerged yesterday
✓avallete
#7113fix(cli): name the failing engine operation in stack telemetry
by avalletemerged yesterday
✓avallete
#7114ci(release): trigger sync repair when the AI review completes
by avalletemerged yesterday
✓avallete
#7111ci: centralize Claude and Codex model ids
by avalletemerged yesterday
✓avallete
#7083ci(release): resolve and repair develop-into-next syncs with Claude
by avalletemerged yesterday
✓Coly010
#7109feat(cli)!: remove db remote commit and the low-use inspect db aliases
by Coly010merged yesterday
✓Coly010
#7108fix(cli): say "removed in v3" in db remote commit and inspect db deprecation warnings
by Coly010merged yesterday

Issue triage — last 12 weeks

Blue bars = issues opened that week, green = closed. Healthy projects keep these roughly in balance — a persistently bigger blue bar means an opening backlog. open issues on GitHub ↗

Release cadence· median 0d between releases

Actively shipping

Latest v3.0.0-next.7 shipped 1d ago · typical gap 0d · 10 releases sampled.

all releases on GitHub ↗

New faces — last 90 days5 contributors appearing for the first time in this window

Prashansa-K2d agotirthraj016d agojust-some-random-pal7d agoColy0107d agospydon9d ago

Heuristic: contributors whose earliest commit in the recent sample is < 90 days old AND who have ≤ 3 commits in the window. Click a name for their commits in this repo.

Top contributors

17ttp7ttp
23 commits ↗
2avalleteavallete
15 commits ↗
3jgouxjgoux
10 commits ↗
4kanadguptakanadgupta
5 commits ↗

Issue health

Computed from GitHub Issues — no estimates. Per-issue rates use the 24 most-recently-updated issues (recent, not all-time); the open total and oldest-open age are repo-wide.

Open issues65

Total open on the repo (authoritative).

Median time to close6d

From 19 recently-closed issues. p90 1.5y.

Oldest open issue3.3y

Age of the longest-open unresolved issue.

Awaiting first reply60%

3 of 5 recent open issues have no comments yet.

Stale backlog0%

0 of 5 recent open issues had no update in 30d+.

Triage gap0%

0 of 5 recent open issues are unlabeled.

What the backlog is about

AI-generated

Open issues grouped into themes by an LLM from their titles — a summary, not an authoritative classification. Numbers reflect the 5 most-recently-active open issues.

Most-discussed

Open issues with the most comments — where the conversation is.

In the `config.toml` file (local), if both `[local_smtp]` and `[auth.email.smtp]` have `enabled = true`, then `[auth.email.smtp]` wins during development.

#7085 · opened 12d ago · @curiosissimoz

3comments

`config push` sets `external_email_enabled = false` when `[auth.email] enable_signup = false`, disabling password sign-in for all users

#7055 · opened 6d ago · @anastasia-afanasii

1comments

Labels in the recent sample

supabase/cli23🐛 Bug18open-for-contribution5✨ Feature4stale-closed3bug2docker2enhancement1

Per-issue rates are computed from a sample of 24 most-recently-updated issues, so they describe recent behavior rather than the all-time backlog. Reaction and comment counts come straight from GitHub.

Dependencies

Checked packages and import counts

Checked counts describe advisory coverage, not the repository’s complete dependency inventory. External imports come from a separate source-code graph.

16
Packages checked
npm
16
Direct packages checked
checked count, not total dependencies
0
Transitive packages checked
checked count, not total dependencies
1820
External imports
distinct modules in the captured graph

License

Unknown
License
Unknown / unlicensed
Family
Unknown
Dep conflicts
No dependency license scan coverage
Commercial use: No clear license detected. With no license, default copyright applies — treat as all-rights-reserved until you confirm terms with the maintainer.