thedotmack / claude-mem
Repository health
Security, maintenance, dependencies and license for thedotmack/claude-mem.
Security
25 dependencies checked (25 direct), npm, via deps.dev. Findings apply only to the packages and versions checked.
Security checks (RepoPilot estimate) · 4.4/10
OpenSSF has not scored this repository, so RepoPilot ran some of its checks from public GitHub data. Checks sorted from strongest to weakest.
- Recent activityLast commit 0d ago10/10
- License filePermissive license: Apache-2.010/10
- Tests run on pull requestsCI configured + tests present10/10
- Least-privilege CI tokensWorkflows declare explicit, scoped permissions10/10
- Pinned dependenciesOnly 0/29 actions pinned to SHAs2/10
- Code review before mergeOnly 0/20 recent PRs had requested reviewers2/10
- Automated dependency updatesNo Dependabot or Renovate config found0/10
- Security policyNo SECURITY.md found0/10
- Static analysis on commitsNo SAST workflow detected0/10
- Branch protectionDefault branch 'main' has no protection rule0/10
Maintenance
Outside contributions: 49 of 83 external pull requests merged (94% of those decided), median 1.2 days to merge.From the 94 most recently updated pull requests, bots excluded.
Pull requests
- Open
- 21
- 0 stale (60+ days, no update in 30)
- Merged
- 9
- of the 30 latest
- Median time to merge
- Same day
- From bots
- 0
- not listed below
Open
- #5011 fix(hooks): map last_assistant_message in the raw adapter (#4976)rigel905 · opened today
- #5017 fix(redaction): redact the AWS secret key under its lowercase key nameL4XB · opened today
- #5016 fix(smart-read): keep Swift extension methods under the type they extendL4XB · opened today
- #5010 My Work: React viewer on live data replaces the localhost viewerthedotmack · opened today
- #5015 fix(smart-read): end a symbol on the line before an end at column 0L4XB · opened today
Recently merged
- #5006 fix(smart-read): include TypeScript namespaces and module declarations in outlinesL4XB · merged 23 Oct 2026
- #4990 fix(context): reject path separators in prior-session idsDeryFerd · merged 23 Oct 2026
- #4985 fix(pi): keep memory injected when other extensions add request contextezoushen · merged 23 Oct 2026
- #4994 fix(smart-read): include TypeScript abstract classes in outlinesL4XB · merged 23 Oct 2026
- #4993 fix(claude-md): keep the block that generate and regenerate write BMP-only (#2787)L4XB · merged 23 Oct 2026
The 30 most recently updated pull requests.
Top contributors
- rudycelekli19 commits · 22%
- thedotmack11 commits · 13%
- DeryFerd8 commits · 9%
- kevin93275 commits · 6%
- L4XB3 commits · 4%
Of the 85 most recent commits.
Issues
- Open
- 125
- issues and pull requests, as GitHub counts them
- Median time to close
- 2 days
- from 16 closed of the 34 latest
- Awaiting first reply
- 8
- of 18 open among the 34 latest
Most wanted
- #4605 Privacy statements contradict the shipped defaults2 reactions · 0 comments
- #4788 [Windows] Unpinned transitive deps in chroma-mcp uvx launch create a new ~300 MB uv archive env per upstream release (46 GB in 4 months); `claude-mem-codex-app-server-*` temp dirs never cleaned1 reaction · 3 comments
- #4580 Observations captured during a provider quota cooldown are lost if the worker restarts before the cooldown ends1 reaction · 5 comments
Rates come from the 34 most recently updated issues; the open count and oldest issue cover the whole repository.
Dependencies
Checked packages and import counts
These are the packages checked for known security issues, which may not be all of them. External imports are counted from the source code.
Packages pulled in by these were not checked.
License compatibility
Repo license: Apache-2.0 · 25 deps checked · 0 potential conflicts.