typicode / json-server
Repository health
Security, maintenance, dependencies and license for typicode/json-server.
Security
72 dependencies checked (22 direct), npm, via deps.dev. Findings apply only to the packages and versions checked.
OpenSSF Scorecard · 3.6/10
Checks sorted from strongest to weakest.
- No binaries in the repositoryNo binaries found in the repo10/10
- No risky CI workflowsNo dangerous workflow patterns detected10/10
- License fileLicense file detected10/10
- Published through a build pipelinePackaging workflow detected10/10
- Branch protectionBranch protection is not maximal on development and all release branches3/10
- Code review before mergeFound 2/18 approved changesets1/10
- Recent activity0 commits and 0 issue activity found in the last 90 days0/10
- Pinned dependenciesDependency not pinned by hash detected0/10
- Least-privilege CI tokensDetected GitHub workflow tokens with excessive permissions0/10
- OpenSSF best-practices badgeNo effort to earn an OpenSSF best practices badge detected0/10
- Security policySecurity policy file not detected0/10
- Fuzz testingProject is not fuzzed0/10
- Static analysis on commitsSAST tool is not run on all commits0/10
- Signed releasesNo releases foundnot scored
Maintenance
Outside contributions: 3 of 50 external pull requests merged (11% of those decided), median 2.1 days to merge.From the 82 most recently updated pull requests, bots excluded.
Recent releases
- v1.0.0-beta.1523 Mar 2026 · 3 days after previous
- v1.0.0-beta.1420 Mar 2026 · 8 days after previous
- v1.0.0-beta.1313 Mar 2026 · 13 days after previous
- v1.0.0-beta.1228 Feb 2026 · 1 day after previous
- v1.0.0-beta.1026 Feb 2026 · 7 days after previous
Pull requests
- Open
- 15
- 12 stale (60+ days, no update in 30)
- Merged
- 1
- of the 30 latest
- Median time to merge
- Same day
- From bots
- 0
- not listed below
Open
- #1781 fix: only treat own keys of the database as resourcesKrrishkumar125 · opened 2 days ago
- #1779 fix: preserve question marks in query valuessergioperezcheco · opened 7 days ago
- #1778 ci: add npmscan dependency security checksalemalem · opened 8 days ago
- #1772 fix: resolve dependents against every deleted resourceHafizMMoaz · opened 87 days ago
- #1771 fix: match array fields in where filtersHafizMMoaz · opened 87 days ago
Recently merged
- #1715 chore: add linting step to Node.js workflowtypicode · merged 26 Feb 2026
The 30 most recently updated pull requests.
Top contributors
- typicode84 commits · 88%
- Omar-Tnt042 commits · 2%
- codehassoul1 commit · 1%
- pgoslatara1 commit · 1%
- manikanta58271 commit · 1%
Of the 95 most recent commits.
Issues
- Open
- 723
- issues and pull requests, as GitHub counts them
- Median time to close
- 4 days
- from 14 closed of the 39 latest
- Awaiting first reply
- 4
- of 25 open among the 39 latest
- Oldest open
- 11.7 years
Most wanted
- #1633 Full text search is not working6 reactions · 10 comments
- #1557 cant find package json-server within node_modules2 reactions · 6 comments
- #1642 Feature: Find available ports starting from 30001 reaction · 3 comments
Rates come from the 39 most recently updated issues; the open count and oldest issue cover the whole repository.
Dependencies
Checked packages and import counts
These are the packages checked for known security issues, which may not be all of them. External imports are counted from the source code.
License compatibility
Repo license: MIT · 22 deps checked · 0 potential conflicts.