Public record
Software health reportschema 0.34.0 · metrics 2.10.0 · 2026-09-14 06:31 UTC

crossbario / crossbar

Crossbar.io - WAMP application router

Python · JavaScriptCustom license★ 2,064 stars⑂ 278 forkssince Oct 2013View on GitHub ↗
KindCommand-line toolLibraryNetwork servicehow this is determined
#websocket#wamp#messaging#mqtt#rest#server#broker#networking-stack#networking

crossbario/crossbar holds a health index of 89 out of 100, placing it in the Excellent band. It scores highest on Engineering Quality (90/100) and lowest on Security (54/100). It was last updated 7 days ago. 2 contributors account for most of its recent work.

89
overall / 100
Excellent

Software health index

Metrics are grouped into weighted categories on one standardized 1–100 scale. Overall starts as their weighted mean, calibrated against the distribution of the public record so bands carry percentile meaning; when public evidence triggers the High-Risk Jurisdiction Policy, the rating is adjusted and receives an At Risk ceiling of 34.

89
Exceptional93-100The record's top tier (≈ top 5%); essentially all checked criteria met
Excellent80-92Strong across the board; minor gaps
Good65-79Healthy; gaps are limited and manageable
Moderate50-64Acceptable with notable gaps; review recommended
Weak35-49Material weaknesses across several areas
At Risk20-34Significant weaknesses; adoption warrants caution
Critical1-19Severe problems (abandoned, single-maintainer, no hygiene)
VitalityCommunity &AdoptionSustainability &GovernanceEngineeringQualitySecurityAI Readiness

Score profile

Each axis is a category. The shape matters more than the average — a healthy subject fills the whole shape, while a spike-and-crater profile means strength in one dimension is masking risk in another.

The weighted overall 75 is calibrated to 89 on the published index scale (record calibration 2026-08-02).

Ownership

Crossbar.ioOrganization · verified domain
55 followers38 public repossince Oct 2013

This repository is backed by an organization — shared, accountable stewardship that can outlive any single maintainer.

Package ecosystems

RegistryPackageVersionDownloads / moVersionsLast publishTags
PyPIcrossbar26.7.14,56211058 days agoautobahnautobahn.wscrossbaroraclepostgrespostgresqlpubsubrealtimerfc6455routerrpcwampwebsocket

Metrics by category

Vitality

Is the project alive — is code being written and are releases shipping?

77Good · 21% of overall

Development activity

69Good
How it's scored
36/36Push recency — last push 7 days ago
6.9/36Commit cadence — 10/52 weeks with commits
15.9/18Commit volume — 58 commits in the last year
10/10OpenSSF Scorecard: Maintained — 12 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10
Inputs used
commits_last_year58
human_commit_share0.99
days_since_last_push7
active_weeks_last_year10

Release discipline

90Excellent
How it's scored
27/27Ships releases — 74 releases published
36/36Release recency — latest release 7 days ago
27/27Release cadence — a release every ~5.4 days
0/10OpenSSF Scorecard: Signed-Releases — Project has not signed or included provenance with any releases.
Inputs used
releases_count74
latest_release_tagpr2286-null-dependabot_uv_python_minor_patch_3fd0b901bd-202609070509
releases_from_tagsno
days_since_latest_release7
mean_days_between_releases5.4

Community & Adoption

Does the project have users, downloads, attention, and a welcoming setup for contributors?

74Good · 17% of overall

Popularity & adoption

84Excellent
How it's scored
53.8/60Stars — 2,064 stars
20.4/25Forks — 278 forks
10.3/15Watchers — 72 watchers
Inputs used
forks278
stars2,064
watchers72
growth_stateunverified
growth_factor_pct100
growth_unverified_reasonno_history

Community health

71Good
How it's scored
22.5/22.5README
16.9/22.5License — license file present, not a recognized license
18/18CONTRIBUTING guide
0/13.5Code of conduct
0/7.2Issue template
6.3/6.3PR template
Inputs used
has_readmeyes
has_licenseyes
readme_badges6
has_contributingyes
has_issue_templateno
has_code_of_conductno
readme_badge_servicesgithub.com, readthedocs.org, shields.io
has_pull_request_templateyes

Ecosystem adoption (downloads)

61Moderate
How it's scored
48.8/80Monthly downloads — 4,562 downloads/month across pypi
0/20Registry dependents — not reported by this ecosystem
Inputs used
packagescrossbar
dependents—
ecosystemspypi
total_downloads—
monthly_downloads4,562
unverified_packages_excluded—
Excluded from scoring (no data or not applicable): Registry dependents. Remaining weights renormalized.

Sustainability & Governance

Will the project survive its people — bus factor, responsiveness, who backs it, and package upkeep?

77Good · 23% of overall

Maintainer resilience (bus factor)

64Moderate
How it's scored
25.2/54Bus factor — 2 contributor(s) cover half of all commits
14.8/22.5Commit distribution — top contributor authored 34% of commits
13.5/13.5Contributor breadth — 58 contributors
10/10OpenSSF Scorecard: Contributors — project has 36 contributing companies or organizations
Inputs used
bus_factor2
contributors_sampled58
top_contributor_share0.341

Issue & PR responsiveness

65Good
How it's scored
32.1/42Issue resolution — 76% of issues closed
24.6/30PR acceptance — 768/938 decided PRs merged
0/13Newcomer PR acceptance — no first-time contributor's PR decided in 30d
0/15OpenSSF Scorecard: Code-Review — Found 1/29 approved changesets -- score normalized to 0
Inputs used
merged_prs768
open_issues303
closed_issues980
prs_merged_7d0
prs_decided_7d0
prs_merged_30d0
prs_decided_30d0
issue_closed_ratio0.764
closed_unmerged_prs170
first_time_authors_30d0
first_time_prs_merged_30d0
first_time_prs_decided_30d0
Excluded from scoring (no data or not applicable): Newcomer PR acceptance. Remaining weights renormalized.

Ownership & stewardship

86Excellent
How it's scored
30/30Ownership backing — organization-owned
20/20Verified domain
12.6/25Owner reach — 55 followers of crossbario
23.6/25Track record — 38 public repos, account ~12 yr old
Inputs used
followers55
owner_typeOrganization
is_verifiedyes
owner_logincrossbario
public_repos38
account_age_days4,721

Package maintenance

100Exceptional
How it's scored
25/25Published & resolvable — 1 package(s) on pypi
35/35Publish recency — latest publish 58 days ago
20/20Version history — 110 published versions
20/20Not deprecated — active, not deprecated or yanked
Inputs used
packagescrossbar
ecosystemspypi
any_deprecatedno
min_days_since_publish58

Engineering Quality

Are baseline engineering and documentation practices in place?

90Excellent · 19% of overall

Engineering practices

84Excellent
How it's scored
24/24CI workflows — 3 workflow(s)
24/24Tests present
16/16Linter config — .pylintrc, pyproject.toml ([tool.ruff])
0/9.6Pre-commit hooks
6.4/6.4.editorconfig
14/20OpenSSF Scorecard: CI-Tests — 15 out of 20 merged PRs checked by a CI test -- score normalized to 7
Inputs used
has_ciyes
has_testsyes
has_editorconfigyes
has_linter_configyes
has_precommit_configno

Documentation

100Exceptional
How it's scored
30/30README
25/25Documentation directory
15/15Documentation / homepage site — https://crossbario.readthedocs.io/
10/10Repository description
10/10Topics — 9 topics
10/10Wiki
Inputs used
topicswebsocket, wamp, messaging, mqtt, rest, server, broker, networking-stack, networking
has_wikiyes
homepagehttps://crossbario.readthedocs.io/
docs_sitehttps://crossbario.readthedocs.io/
has_readmeyes
has_docs_diryes
has_descriptionyes

Security

Are visible security and supply-chain practices strong, without unresolved high-risk jurisdiction exposure?

54Moderate · 16% of overall

Security posture

56Moderate
How it's scored
7.5/7.5Binary-Artifacts — no binaries found in the repo
0/7.5Branch-Protection — no data
1.8/2.5CI-Tests — 15 out of 20 merged PRs checked by a CI test -- score normalized to 7
0/2.5CII-Best-Practices — no effort to earn an OpenSSF best practices badge detected
0/7.5Code-Review — Found 1/29 approved changesets -- score normalized to 0
2.5/2.5Contributors — project has 36 contributing companies or organizations
10/10Dangerous-Workflow — no dangerous workflow patterns detected
7.5/7.5Dependency-Update-Tool — update tool detected
0/5Fuzzing — project is not fuzzed
2.2/2.5License — license file detected
7.5/7.5Maintained — 12 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10
5/5Packaging — packaging workflow detected
0.5/5Pinned-Dependencies — dependency not pinned by hash detected -- score normalized to 1
5/5SAST — SAST tool is run on all commits
5/5Security-Policy — security policy file detected
0/7.5Signed-Releases — Project has not signed or included provenance with any releases.
0/7.5Token-Permissions — detected GitHub workflow tokens with excessive permissions
0/7.5Vulnerabilities — 111 existing vulnerabilities detected
Inputs used
sourceopenssf_scorecard
checks_evaluated17
scorecard_versionv5.5.0
checks_inconclusive1
scorecard_aggregate5.6
Excluded from scoring (no data or not applicable): Branch-Protection. Remaining weights renormalized.

Dependency advisories

44Weak
How it's scored
10.6/35Direct dependencies free of known advisories — 3 affected: idna 2.5.0 (high 7.5), urllib3 1.26.20 (high 7.5), h2 3.2.0 (moderate 5.3)
10.2/25Indirect dependencies free of known advisories — 1 affected: ecdsa 0.19.2 (high 7.4)
23.6/40No advisories left outstanding — 4 advisory-carrying package(s) unaddressed past 90 days; oldest published 965 days ago
Inputs used
sourceosv
advisories20
affected_packages4
assessed_packages142
unassessed_packages0
affected_by_severityhigh 3, moderate 1
direct_affected_packages3
Matched the pypi:crossbar@26.7.1 runtime dependency closure — what installing the published package pulls in — 142 packages. Reachability is not analyzed.

AI Readiness

How well is the repo equipped to be developed and maintained with AI coding agents? Carries a deliberately small weight (4%): agent tooling is a real maintenance signal, but a repository with none can still reach 100/100.

69Good · 4% of overall

Agent context & guidance

58Moderate
How it's scored
18/45Agent instructions — .gemini/GEMINI.md, CLAUDE.md (stub)
0/15Machine-readable docs (llms.txt)
40/40Legible commit history — 93 of 99 human commits state their intent (structured subject or explanatory body)
Inputs used
has_llms_txtno
llms_txt_url—
legible_history_share0.939
agent_instruction_files.gemini/GEMINI.md, CLAUDE.md
agent_instruction_max_bytes23

Verify loop (build / test / typecheck)

83Excellent
How it's scored
18/18One-command bootstrap — Makefile, docs-cfx/Makefile, docs-cfx/work/kubernetes/Makefile, docs/Makefile, justfile, test/Makefile, test/test_automated/Makefile, test/test_jupyter/Makefile, test/test_pevents/Makefile, test/test_xbr_marketmaker/Makefile
22/22Automated tests
11/11Lint / format config — .pylintrc, pyproject.toml ([tool.ruff])
11/11Static type checking — mypy.ini, src/crossbar/py.typed
10/10Reproducible environment — Dockerfile, lockfile
2/10Demonstrated agent practice — 1 of the last 100 commits agent-authored or agent-credited
8/8Automated maintenance — 1 of the last 100 commits are automated dependency updates
1/10OpenSSF Scorecard: Pinned-Dependencies — dependency not pinned by hash detected -- score normalized to 1
Inputs used
has_nixno
has_testsyes
lockfilesuv.lock
has_dockerfileyes
typed_languageno
bootstrap_filesMakefile, docs-cfx/Makefile, docs-cfx/work/kubernetes/Makefile, docs/Makefile, justfile, test/Makefile, test/test_automated/Makefile, test/test_jupyter/Makefile, test/test_pevents/Makefile, test/test_xbr_marketmaker/Makefile
has_devcontainerno
has_linter_configyes
typecheck_configsmypy.ini, src/crossbar/py.typed
agent_commit_share0.01
toolchain_manifests—
dependency_bot_commit_share0.01

Code legibility for models

80Excellent
How it's scored
27/45Type-checkable code — Python with type-check config (mypy.ini, src/crossbar/py.typed)
52.9/55Manageable file sizes — 15/395 source files over 60KB
Inputs used
primary_languagePython
largest_source_bytes982,255
source_files_sampled395
oversized_source_files15

Machine-readable interfaces

40Weak
How it's scored
0/40API schema (OpenAPI/GraphQL/proto)
0/20MCP server
40/40Runnable examples — examples, notebooks, sample
Inputs used
example_dirsexamples, notebooks, sample
has_mcp_signalno
api_schema_files—
interfaces_expected_ofnetwork-service

Key facts

2,064GitHub stars
58contributors
58commits, last 12 months
7days since last push
74releases
2bus factor
303open issues
PyPIpackage ecosystems

Data collection warnings

  • Star history unavailable: GitHub GraphQL error: Resource not accessible by personal access token

More detail

Star and fork history 0 ★ / 278 ⇿
0Stars
278Forks
12Releases

When each star and fork was added, collected from GitHub and bucketed by day. Cumulative growth sits directly above the daily additions it is made of, so the two read against each other: steady organic accretion looks nothing like an abrupt, short-lived burst. Where that difference is measurable, it is reported as growth authenticity.

05010015020025030027052013-112020-022026-05
Major 0Minor 0Patch 0

Each point covers 12 days.

OpenSSF Scorecard 5.6 / 10
5.6aggregate

Independent, tool-agnostic security assessment from the open-source OpenSSF Scorecard. Each check rewards a security practice, not a specific vendor's tool. Checks Scorecard could not determine are marked n/a and excluded from the security score (never counted as zero).Scorecard v5.5.0 · 2026-09-14 06:31 UTC

10Binary-Artifactsno binaries found in the repo
n/aBranch-Protectioninternal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md
7CI-Tests15 out of 20 merged PRs checked by a CI test -- score normalized to 7
0CII-Best-Practicesno effort to earn an OpenSSF best practices badge detected
0Code-ReviewFound 1/29 approved changesets -- score normalized to 0
10Contributorsproject has 36 contributing companies or organizations
10Dangerous-Workflowno dangerous workflow patterns detected
10Dependency-Update-Toolupdate tool detected
0Fuzzingproject is not fuzzed
9Licenselicense file detected
10Maintained12 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10
10Packagingpackaging workflow detected
1Pinned-Dependenciesdependency not pinned by hash detected -- score normalized to 1
10SASTSAST tool is run on all commits
10Security-Policysecurity policy file detected
0Signed-ReleasesProject has not signed or included provenance with any releases.
0Token-Permissionsdetected GitHub workflow tokens with excessive permissions
0Vulnerabilities111 existing vulnerabilities detected
Direct dependencies 74
RegistryPackageVersion constraintManifest
PyPIautobahn>=26.7.1pyproject.toml
PyPItxaio>=26.6.1pyproject.toml
PyPIzlmdb>=26.7.1pyproject.toml
PyPIcfxdb>=26.6.1pyproject.toml
PyPIxbr>=26.6.1pyproject.toml
PyPItwisted>=22.10.0pyproject.toml
PyPItwisted>=22.10.0pyproject.toml
PyPItwisted>=22.10.0pyproject.toml
PyPItreq>=22.2.0pyproject.toml
PyPItxtorcon>=22.0.0pyproject.toml
PyPIeth-abi>=5.1.0,<5.2.0pyproject.toml
PyPIeth-account>=0.13.0pyproject.toml
PyPIeth-typing>=5.0.1pyproject.toml
PyPIpy-eth-sig-utils>=0.4.0pyproject.toml
PyPIhexbytes>=0.3.0pyproject.toml
PyPIh2>=3.2.0,<4.0.0pyproject.toml
PyPIhyperframe>=5.2.0,<6.0.0pyproject.toml
PyPIpriority>=1.3.0,<2.0pyproject.toml
PyPIattrs>=22.2.0pyproject.toml
PyPIbase58>=2.1.1pyproject.toml
PyPIbcrypt>=4.0.1pyproject.toml
PyPIbitstring>=4.0.1pyproject.toml
PyPIcbor2>=5.4.6pyproject.toml
PyPIclick>=8.1.3pyproject.toml
PyPIcolorama>=0.4.6pyproject.toml
PyPIconstantly>=15.1.0pyproject.toml
PyPIcookiecutter>=2.1.1pyproject.toml
PyPIcryptography>=39.0.0pyproject.toml
PyPIdocker>=6.0.1pyproject.toml
PyPIflask>=2.2.2pyproject.toml
PyPIhumanize>=4.4.0pyproject.toml
PyPIidna>=2.5,<2.6pyproject.toml
PyPIimportlib-resources>=5.10.2pyproject.toml
PyPIincremental>=22.10.0pyproject.toml
PyPIiso8601>=1.1.0pyproject.toml
PyPIjinja2>=3.1.2pyproject.toml
PyPIjinja2-highlight>=0.6.1pyproject.toml
PyPIjsonschema>=4.0.0pyproject.toml
PyPIMarkupSafe>=2.1.2pyproject.toml
PyPImistune>=2.0.4pyproject.toml
PyPImorphys>=1.0pyproject.toml
PyPInetaddr>=0.8.0pyproject.toml
PyPInumpy>=1.24.1pyproject.toml
PyPIparsimonious>=0.9.0,<0.11.0pyproject.toml
PyPIpasslib>=1.7.4pyproject.toml
PyPIprompt-toolkit>=3.0.36pyproject.toml
PyPIpsutil>=5.9.4pyproject.toml
PyPIpy-ubjson>=0.16.1pyproject.toml
PyPIpyasn1>=0.4.8pyproject.toml
PyPIpyasn1-modules>=0.2.8pyproject.toml
PyPIpycryptodome>=3.16.0pyproject.toml
PyPIpygments>=2.14.0pyproject.toml
PyPIpynacl>=1.5.0pyproject.toml
PyPIpyopenssl>=23.0.0pyproject.toml
PyPIpyqrcode>=1.2.1pyproject.toml
PyPIpytrie>=0.4.0pyproject.toml
PyPIpyyaml>=6.0pyproject.toml
PyPIrequests>=2.28.2pyproject.toml
PyPIsdnotify>=0.3.2pyproject.toml
PyPIservice-identity>=21.1.0pyproject.toml
PyPIsetproctitle>=1.3.2pyproject.toml
PyPIsetuptools>=67.2.0pyproject.toml
PyPIsix>=1.16.0pyproject.toml
PyPIsortedcontainers>=2.4.0pyproject.toml
PyPIstringcase>=1.2.0pyproject.toml
PyPItabulate>=0.9.0pyproject.toml
PyPIu-msgpack-python>=2.7.2pyproject.toml
PyPIujson>=5.7.0pyproject.toml
PyPIurllib3>=1.26.14,<1.27pyproject.toml
PyPIvalidate-email>=1.3pyproject.toml
PyPIwatchdog>=2.2.1pyproject.toml
PyPIwerkzeug>=2.2.2pyproject.toml
PyPIwsaccel>=0.6.4pyproject.toml
PyPIzope.interface>=5.5.2pyproject.toml
All dependencies 264

Full resolved dependency set from the GitHub dependency graph: 72 direct and 192 indirect (transitive) packages. The transitive closure is complete when the repository commits a lockfile.

RegistryPackageVersionRelation
PyPIattrs25.4.0direct
PyPIautobahn26.7.1direct
PyPIbase582.1.1direct
PyPIbcrypt5.0.0direct
PyPIbitstring4.3.1direct
PyPIcbor25.7.1direct
PyPIcfxdb26.6.1direct
PyPIclick8.3.1direct
PyPIcolorama0.4.6direct
PyPIconstantly23.10.4direct
PyPIcookiecutter2.6.0direct
PyPIcryptography46.0.3direct
PyPIdocker7.1.0direct
PyPIeth-abi5.1.0direct
PyPIeth-account0.13.7direct
PyPIeth-typing5.2.1direct
PyPIflask3.1.2direct
PyPIh23.2.0direct
PyPIhexbytes1.3.1direct
PyPIhumanize4.14.0direct
PyPIhyperframe5.2.0direct
PyPIidna2.5direct
PyPIimportlib-resources6.5.2direct
PyPIincremental24.11.0direct
PyPIiso86012.1.0direct
PyPIjinja23.1.6direct
PyPIjinja2-highlight0.6.1direct
PyPIjsonschema4.25.1direct
PyPImarkupsafe3.0.3direct
PyPImistune3.2.1direct
PyPImorphys1.0direct
PyPInetaddr1.3.0direct
PyPInumpy2.3.5direct
PyPIparsimonious0.10.0direct
PyPIpasslib1.7.4direct
PyPIpriority1.3.0direct
PyPIprompt-toolkit3.0.52direct
PyPIpsutil7.1.3direct
PyPIpy-eth-sig-utils0.4.0direct
PyPIpy-ubjson0.16.1direct
PyPIpyasn10.6.1direct
PyPIpyasn1-modules0.4.2direct
PyPIpycryptodome3.23.0direct
PyPIpygments2.19.2direct
PyPIpynacl1.6.1direct
PyPIpyopenssl25.3.0direct
PyPIpyqrcode1.2.1direct
PyPIpytrie0.4.0direct
PyPIpyyaml6.0.3direct
PyPIrequests2.32.5direct
PyPIsdnotify0.3.2direct
PyPIservice-identity24.2.0direct
PyPIsetproctitle1.3.7direct
PyPIsetuptools80.9.0direct
PyPIsix1.17.0direct
PyPIsortedcontainers2.4.0direct
PyPIstringcase1.2.0direct
PyPItabulate0.9.0direct
PyPItreq25.5.0direct
PyPItwisted25.5.0direct
PyPItxaio26.6.1direct
PyPItxtorcon24.8.0direct
PyPIu-msgpack-python2.8.0direct
PyPIujson5.11.0direct
PyPIurllib31.26.20direct
PyPIvalidate-email1.3direct
PyPIwatchdog6.0.0direct
PyPIwerkzeug3.1.4direct
PyPIwsaccel0.6.7direct
PyPIxbr26.6.1direct
PyPIzlmdb26.7.1direct
PyPIzope-interface8.1.1direct
PyPIaccessible-pygments0.0.5indirect
PyPIaiohappyeyeballs2.6.1indirect
PyPIaiohttp3.13.2indirect
PyPIaiosignal1.4.0indirect
PyPIalabaster1.0.0indirect
PyPIaltgraph0.17.5indirect
PyPIannotated-types0.7.0indirect
PyPIanyio1.3.1indirect
PyPIappdirs1.4.4indirect
PyPIargon2-cffi25.1.0indirect
PyPIargon2-cffi-bindings25.1.0indirect
PyPIarrow1.4.0indirect
PyPIastroid3.3.11indirect
PyPIastroid4.0.2indirect
PyPIasync-generator1.10indirect
PyPIautomat25.4.16indirect
PyPIbabel2.17.0indirect
PyPIbackports-tarfile1.2.0indirect
PyPIbandit1.9.2indirect
PyPIbeautifulsoup44.14.3indirect
PyPIbinaryornot0.4.4indirect
PyPIbitarray3.8.0indirect
PyPIbjdata0.6.6indirect
PyPIblake31.0.8indirect
PyPIbleach6.3.0indirect
PyPIblinker1.9.0indirect
PyPIbrotli1.2.0indirect
PyPIbrotlicffi1.2.0.0indirect
PyPIbuild1.3.0indirect
PyPIcachetools6.2.4indirect
PyPIcertifi2025.11.12indirect
PyPIcffi2.0.0indirect
PyPIchardet5.2.0indirect
PyPIcharset-normalizer3.4.4indirect
PyPIckzg2.1.5indirect
PyPIcoverage7.13.0indirect
PyPIcrossbar26.7.1indirect
PyPIcython-test-exception-raiser1.0.2indirect
PyPIcytoolz1.1.0indirect
PyPIdecorator5.2.1indirect
PyPIdefusedxml0.7.1indirect
PyPIdistlib0.4.0indirect
PyPIdocutils0.21.2indirect
PyPIecdsa0.19.1indirect
PyPIeth-hash0.7.1indirect
PyPIeth-keyfile0.8.1indirect
PyPIeth-keys0.7.0indirect
PyPIeth-rlp2.2.0indirect
PyPIeth-utils5.3.1indirect
PyPIfastjsonschema2.21.2indirect
PyPIfilelock3.20.1indirect
PyPIfrozenlist1.8.0indirect
PyPIfuro2025.9.25indirect
PyPIgreenlet3.3.0indirect
PyPIh110.16.0indirect
PyPIhashin1.0.5indirect
PyPIhkdf0.0.3indirect
PyPIhpack3.0.0indirect
PyPIhttpcore1.0.9indirect
PyPIhttpx0.28.1indirect
PyPIhyperlink21.0.0indirect
PyPIhypothesis6.148.7indirect
PyPIid1.5.0indirect
PyPIimagesize1.4.1indirect
PyPIimportlib-metadata8.7.0indirect
PyPIiniconfig2.3.0indirect
PyPIitsdangerous2.2.0indirect
PyPIjaraco-classes3.4.0indirect
PyPIjaraco-context6.0.1indirect
PyPIjaraco-functools4.3.0indirect
PyPIjeepney0.9.0indirect
PyPIjsonschema-specifications2025.9.1indirect
PyPIjupyter-client8.7.0indirect
PyPIjupyter-core5.9.1indirect
PyPIjupyterlab-pygments0.3.0indirect
PyPIkeyring25.7.0indirect
PyPIlinkify-it-py2.0.3indirect
PyPImacholib1.16.4indirect
PyPImarkdown-it-py3.0.0indirect
PyPImdit-py-plugins0.5.0indirect
PyPImdurl0.1.2indirect
PyPImmh35.2.0indirect
PyPImnemonic0.21indirect
PyPImock5.2.0indirect
PyPImore-itertools10.8.0indirect
PyPImsgpack1.1.2indirect
PyPImultidict6.7.0indirect
PyPImultipart1.3.0indirect
PyPImyst-parser4.0.1indirect
PyPInbclient0.10.2indirect
PyPInbconvert7.16.6indirect
PyPInbformat5.10.4indirect
PyPInbsphinx0.9.8indirect
PyPInh30.3.2indirect
PyPIpackaging25.0indirect
PyPIpandoc2.4indirect
PyPIpandocfilters1.5.1indirect
PyPIpefile2024.8.26indirect
PyPIpip25.3indirect
PyPIpip-licenses5.5.0indirect
PyPIplatformdirs4.5.1indirect
PyPIpluggy1.6.0indirect
PyPIplumbum1.10.0indirect
PyPIply3.11indirect
PyPIprettytable3.17.0indirect
PyPIpropcache0.4.1indirect
PyPIpy-ecc8.0.0indirect
PyPIpy-multihash3.0.0indirect
PyPIpycparser2.23indirect
PyPIpydantic2.12.5indirect
PyPIpydantic-core2.41.5indirect
PyPIpyenchant3.3.0indirect
PyPIpyhamcrest2.1.0indirect
PyPIpyinstaller6.17.0indirect
PyPIpyinstaller-hooks-contrib2025.10indirect
PyPIpyobjc-core12.1indirect
PyPIpyobjc-framework-cfnetwork12.1indirect
PyPIpyobjc-framework-cocoa12.1indirect
PyPIpyproject-api1.10.0indirect
PyPIpyproject-hooks1.2.0indirect
PyPIpyserial3.5indirect
PyPIpytest9.0.2indirect
PyPIpytest-cov7.0.0indirect
PyPIpytest-tap3.5indirect
PyPIpytest-twisted1.14.3indirect
PyPIpython-dateutil2.9.0.post0indirect
PyPIpython-slugify8.0.4indirect
PyPIpyunormalize17.0.0indirect
PyPIpywin32311indirect
PyPIpywin32-ctypes0.2.3indirect
PyPIpyzmq27.1.0indirect
PyPIqrcode8.2indirect
PyPIreadme-renderer44.0indirect
PyPIreferencing0.37.0indirect
PyPIregex2025.11.3indirect
PyPIrequests-toolbelt1.0.0indirect
PyPIrfc39862.0.0indirect
PyPIrich14.2.0indirect
PyPIrlp4.1.0indirect
PyPIroman-numerals4.1.0indirect
PyPIroman-numerals-py4.1.0indirect
PyPIrpds-py0.30.0indirect
PyPIruff0.14.9indirect
PyPIscour0.38.2indirect
PyPIsecretstorage3.5.0indirect
PyPIsniffio1.3.1indirect
PyPIsnowballstemmer3.0.1indirect
PyPIsoupsieve2.8indirect
PyPIspake20.9indirect
PyPIsphinx8.2.3indirect
PyPIsphinx-autoapi3.6.1indirect
PyPIsphinx-autodoc-typehints3.5.2indirect
PyPIsphinx-basic-ng1.0.0b2indirect
PyPIsphinx-copybutton0.5.2indirect
PyPIsphinx-design0.6.1indirect
PyPIsphinxcontrib-applehelp2.0.0indirect
PyPIsphinxcontrib-devhelp2.0.0indirect
PyPIsphinxcontrib-htmlhelp2.1.0indirect
PyPIsphinxcontrib-images1.0.1indirect
PyPIsphinxcontrib-jsmath1.0.1indirect
PyPIsphinxcontrib-qthelp2.0.0indirect
PyPIsphinxcontrib-serializinghtml2.0.0indirect
PyPIsphinxcontrib-spelling8.0.2indirect
PyPIsphinxext-opengraph0.13.0indirect
PyPIstevedore5.6.0indirect
PyPItap-py3.2.1indirect
PyPItext-unidecode1.3indirect
PyPItinycss21.4.0indirect
PyPItomli2.3.0indirect
PyPItoolz1.1.0indirect
PyPItornado6.5.4indirect
PyPItox4.32.0indirect
PyPItraitlets5.14.3indirect
PyPItwine6.2.0indirect
PyPItwisted-iocpsupport25.10.1indirect
PyPItypes-requests2.31.0.6indirect
PyPItypes-urllib31.26.25.14indirect
PyPItyping-extensions4.15.0indirect
PyPItyping-inspection0.4.2indirect
PyPItzdata2025.3indirect
PyPIuc-micro-py1.0.3indirect
PyPIvarint1.0.2indirect
PyPIvirtualenv20.35.4indirect
PyPIwcwidth0.2.14indirect
PyPIweb37.14.0indirect
PyPIwebencodings0.5.1indirect
PyPIwebsockets15.0.1indirect
PyPIwheel0.45.1indirect
PyPIwsproto1.3.2indirect
PyPIyapf0.29.0indirect
PyPIyarl1.22.0indirect
PyPIzipp3.23.0indirect
Dependency advisories 4

Installing pypi:crossbar@26.7.1 pulls in 142 packages, direct and transitive: 4 carry known advisories, of which 3 are direct dependencies.

PackageVersionRelationSeverityAdvisoriesFixed in
idna2.5.0directhigh43.15
urllib31.26.20directhigh102.7.0
ecdsa0.19.2indirecthigh2—
h23.2.0directmoderate44.4.1

An advisory means the version recorded in the dependency graph falls inside an advisory’s affected range. Reachability is not analysed, and the graph includes development and test pins — a finding may concern tooling rather than shipped software.

Raw JSON report machine-readable

Feedback

Spotted something off in this report, or have thoughts to share? Wrong measurements, missed tooling, ideas, questions — anything is welcome. Every message is read and gets a response.

The message is kept through sign-in.

Related records

Inspected repositories sharing catalogue tags or ecosystems with crossbario/crossbar. Read them side by side →

97supabase/realtimeBroadcast, Presence, and Postgres Changes via WebSocketsExceptional96emqx/emqxThe most scalable and reliable MQTT broker for AI, IoT, IIoT and connected vehiclesExceptional98googleapis/mcp-toolboxMCP Toolbox for Databases is an open source MCP server for databases.Exceptional98supabase/supabaseThe Postgres development platform. Supabase gives you a dedicated Postgres database to build your web, mobile, and AI applications.Exceptional96expressjs/expressFast, unopinionated, minimalist web framework for node.Exceptional95directus/directusThe flexible backend for all your projects 🐰 Turn your DB into a headless CMS, admin panels, or apps with a custom UI, instant APIs, auth & more.Exceptional

Scores are signals, not warranties. They reflect publicly visible practices on GitHub — not a code audit, and not a security guarantee.

Missing data is excluded and weights renormalized, never scored as zero. Methodology is versioned and open: metrics v2.10.0, schema v0.34.0 — full methodology · metrics wiki.

How one result sits in the wider record: aggregate statistics — PyPI.