tokio-rs / tokio
Repository health
Security, maintenance, dependencies and license for tokio-rs/tokio.
Security
Dependencies were not checked for known security issues, because RepoPilot found no dependency manifest it can read. That does not mean they are safe. Inspect its manifests on GitHub ↗
OpenSSF Scorecard · 6.9/10
Checks sorted from strongest to weakest.
- Code review before mergeAll changesets reviewed10/10
- Security policySecurity policy file detected10/10
- No risky CI workflowsNo dangerous workflow patterns detected10/10
- Recent activity30 commits and 13 issue activity found in the last 90 days10/10
- No binaries in the repositoryNo binaries found in the repo10/10
- License fileLicense file detected10/10
- Fuzz testingProject is fuzzed10/10
- Least-privilege CI tokensDetected GitHub workflow tokens with excessive permissions0/10
- OpenSSF best-practices badgeNo effort to earn an OpenSSF best practices badge detected0/10
- Pinned dependenciesDependency not pinned by hash detected0/10
- Static analysis on commitsSAST tool is not run on all commits0/10
- Published through a build pipelinePackaging workflow not detectednot scored
- Branch protectionScorecard could not run this check.not scored
- Signed releasesNo releases foundnot scored
Maintenance
22 Oct 2026
Last commit
active
100+
Commits in the last year
1127
Contributors
all time · 27 in the last 100 commits
tokio-1.54.1
Latest release
~11d cadence
Outside contributions: 28 of 87 external pull requests merged (58% of those decided), median 2 days to merge.From the 100 most recently updated pull requests, bots excluded.
Recent releases
- tokio-1.54.121 Oct 2026 · 2 days after previous
- tokio-1.54.019 Oct 2026 · 6 days after previous
- tokio-1.53.313 Oct 2026 · same day as previous
- tokio-1.51.613 Oct 2026 · 10 days after previous
- tokio-1.53.24 Oct 2026 · same day as previous
Pull requests
- Open
- 17
- 0 stale (60+ days, no update in 30)
- Merged
- 9
- of the 30 latest
- Median time to merge
- 3 days
- From bots
- 0
- not listed below
Open
- #8438 wasm: support the net feature on Emscriptenguybedford · opened 43 days ago
- #8702 time: remove unreachable auto-advance handling from the alternative timerdarkraider01 · opened today
- #8700 time: validate automatic clock advanceklimkin · opened 1 day ago
- #8682 sync: serialize all tests in tracing_syncDarksonn · opened 2 days ago
- #8597 time: preserve alternative timer wakers on resetshuvroroy · opened 15 days ago
Recently merged
- #8684 sync: add RwLock::blocking_read_owned and blocking_write_ownedstackedbyaradhya · merged 22 Oct 2026
- #8701 task: clarify `block_in_place` panics in LocalSetdarkraider01 · merged 22 Oct 2026
- #8693 chore: prepare Tokio v1.54.1Darksonn · merged 21 Oct 2026
- #8692 time: revert "remove the runtime handle from timers"Darksonn · merged 21 Oct 2026
- #8381 net: add `UnixSocket::set_permissions`DanBondarenko · merged 21 Oct 2026
The 30 most recently updated pull requests.
Top contributors
- Darksonn47 commits · 47%
- fallintoplace15 commits · 15%
- darkraider015 commits · 5%
- shuvroroy4 commits · 4%
- guybedford3 commits · 3%
Of the 100 most recent commits.
Issues
- Open
- 439
- issues and pull requests, as GitHub counts them
- Median time to close
- 1.4 years
- from 7 closed of the 23 latest
- Awaiting first reply
- 2
- of 16 open among the 23 latest
- Oldest open
- 7.1 years
Most wanted
- #4827 meta: Stabilize WASI support76 reactions · 44 comments
- #6902 Feature request: Allow non-Send broadcast values in more (generic) contexts2 reactions · 5 comments
- #4819 `spawn_pinned` is substantially more expensive than other `spawn` mechanisms2 reactions · 2 comments
Rates come from the 23 most recently updated issues; the open count and oldest issue cover the whole repository.
Dependencies
Checked packages and import counts
These are the packages checked for known security issues, which may not be all of them. External imports are counted from the source code.
Not checked
Packages checked
Unknown
External imports
outside packages the code imports
License
MIT
License
Permissive
Family
Unknown
License conflicts in dependencies
Dependency licenses were not checked
Commercial use: Generally fine for commercial and proprietary use, subject to attribution and notice terms.