docker-archive/compose-cli holds a health index of 19 out of 100, placing it in the Critical band. It scores highest on Community & Adoption (76/100) and lowest on Vitality (22/100). The repository is archived, so no further maintenance is expected.
19
overall / 100
Critical
Software health index
Metrics are grouped into weighted categories on one standardized 1–100 scale. Overall starts as their weighted mean, calibrated against the distribution of the public record so bands carry percentile meaning; when public evidence triggers the High-Risk Jurisdiction Policy, the rating is adjusted and receives an At Risk ceiling of 34.
19
Exceptional93-100The record's top tier (≈ top 5%); essentially all checked criteria met
Excellent80-92Strong across the board; minor gaps
Good65-79Healthy; gaps are limited and manageable
Moderate50-64Acceptable with notable gaps; review recommended
Weak35-49Material weaknesses across several areas
At Risk20-34Significant weaknesses; adoption warrants caution
Critical1-19Severe problems (abandoned, single-maintainer, no hygiene)
Score profile
Each axis is a category. The shape matters more than the average — a healthy subject fills the whole shape, while a spike-and-crater profile means strength in one dimension is masking risk in another.
The weighted overall 56 is calibrated to 59 on the published index scale (record calibration 2026-08-02).
archived on GitHub by its maintainersOverall rating: Critical ceiling
Silence alone is never the finding — a small, finished library may need no commits for years. This alert requires both: no human commit for a long time, and obligations the project is visibly not discharging. Automated commits do not count as maintenance.
Direct dependencies free of known advisories — 13 affected: github.com/docker/docker 20.10.7+incompatible (critical 9.9), google.golang.org/grpc 1.52.3 (critical 9.1), github.com/containerd/containerd 1.5.17 (high 7.3), +10 more
0/25
Indirect dependencies free of known advisories — transitive set not separable from development and test dependencies in this scope
13.4/40
No advisories left outstanding — 12 advisory-carrying package(s) unaddressed past 90 days; oldest published 1,913 days ago
Inputs used
source
osv
advisories
240
affected_packages
25
assessed_packages
210
unassessed_packages
1
affected_by_severity
critical 5, high 12, moderate 3, unknown 5
direct_affected_packages
13
Excluded from scoring (no data or not applicable): Indirect dependencies free of known advisories. Remaining weights renormalized. Matched 210 resolved dependencies against OSV. 1 could not be assessed — no resolved version, an unsupported ecosystem, or beyond the reported package list. This repository publishes no package the index resolves, so the repository dependency graph was assessed instead. That graph mixes development and test pins with shipped dependencies, so only the declared runtime dependencies are scored; transitive findings are reported as context and excluded from the score. Reachability is not analyzed.
How well is the repo equipped to be developed and maintained with AI coding agents? Carries a deliberately small weight (4%): agent tooling is a real maintenance signal, but a repository with none can still reach 100/100.
Star history unavailable: GitHub GraphQL error: Resource not accessible by personal access token
go package 'github.com/docker/compose-cli' points at a different repository (https://github.com/docker/compose-cli); excluded from ecosystem scoring
More detail
Star and fork history 0 ★ / 257 ⇿
0Stars
257Forks
48Releases
When each star and fork was added, collected from GitHub and bucketed by day. Cumulative growth sits directly above the daily additions it is made of, so the two read against each other: steady organic accretion looks nothing like an abrupt, short-lived burst. Where that difference is measurable, it is reported as growth authenticity.
Major 1Minor 0Patch 41
Each point covers 6 days.
OpenSSF Scorecard 4.1 / 10
4.1aggregate
Independent, tool-agnostic security assessment from the open-source OpenSSF Scorecard. Each check rewards a security practice, not a specific vendor's tool. Checks Scorecard could not determine are marked n/a and excluded from the security score (never counted as zero).Scorecard v5.5.0 · 2026-09-19 01:44 UTC
Full resolved dependency set from the GitHub dependency graph: 60 direct and 151 indirect (transitive) packages. The transitive closure is complete when the repository commits a lockfile.
Registry
Package
Version
Relation
Go
github.com/alecaivazis/survey/v2
2.3.6
direct
Go
github.com/aws/aws-sdk-go
1.35.33
direct
Go
github.com/awslabs/goformation/v4
4.15.6
direct
Go
github.com/azure/azure-sdk-for-go
48.2.0+incompatible
direct
Go
github.com/azure/azure-storage-file-go
0.8.0
direct
Go
github.com/azure/go-autorest/autorest
0.11.12
direct
Go
github.com/azure/go-autorest/autorest/adal
0.9.5
direct
Go
github.com/azure/go-autorest/autorest/azure/auth
0.5.3
direct
Go
github.com/azure/go-autorest/autorest/azure/cli
0.4.2
direct
Go
github.com/azure/go-autorest/autorest/date
0.3.0
direct
Go
github.com/azure/go-autorest/autorest/to
0.4.0
direct
Go
github.com/buger/goterm
1.0.4
direct
Go
github.com/cnabio/cnab-to-oci
0.3.1-beta1
direct
Go
github.com/compose-spec/compose-go
1.0.8
direct
Go
github.com/containerd/console
1.0.3
direct
Go
github.com/containerd/containerd
1.5.17
direct
Go
github.com/distribution/distribution/v3
3.0.0-20210316161203-a01c71e2477e
direct
Go
github.com/docker/cli
20.10.7+incompatible
direct
Go
github.com/docker/compose/v2
2.2.0
direct
Go
github.com/docker/docker
20.10.7+incompatible
direct
Go
github.com/docker/go-connections
0.4.0
direct
Go
github.com/docker/go-units
0.5.0
direct
Go
github.com/fatih/color
1.7.0
direct
Go
github.com/gobwas/ws
1.1.0
direct
Go
github.com/golang/mock
1.6.0
direct
Go
github.com/golang/protobuf
1.5.2
direct
Go
github.com/google/go-cmp
0.5.9
direct
Go
github.com/google/shlex
0.0.0-20191202100458-e7afc7fbc510
direct
Go
github.com/hashicorp/go-multierror
1.1.1
direct
Go
github.com/hashicorp/go-uuid
1.0.3
direct
Go
github.com/hashicorp/go-version
1.6.0
direct
Go
github.com/iancoleman/strcase
0.2.0
direct
Go
github.com/joho/godotenv
1.3.0
direct
Go
github.com/labstack/echo
3.3.10+incompatible
direct
Go
github.com/mattn/go-shellwords
1.0.12
direct
Go
github.com/microsoft/go-winio
0.6.0
direct
Go
github.com/morikuni/aec
1.0.0
direct
Go
github.com/opencontainers/go-digest
1.0.0
direct
Go
github.com/opencontainers/image-spec
1.0.2
direct
Go
github.com/pkg/errors
0.9.1
direct
Go
github.com/prometheus/tsdb
0.10.0
direct
Go
github.com/sanathkr/go-yaml
0.0.0-20170819195128-ed9d249f429b
direct
Go
github.com/sirupsen/logrus
1.9.0
direct
Go
github.com/spf13/cobra
1.6.1
direct
Go
github.com/spf13/pflag
1.0.5
direct
Go
github.com/stretchr/testify
1.8.1
direct
Go
golang.org/x/oauth2
0.4.0
direct
Go
golang.org/x/sync
0.1.0
direct
Go
golang.org/x/sys
0.4.0
direct
Go
google.golang.org/grpc
1.52.3
direct
Go
google.golang.org/protobuf
1.28.1
direct
Go
gopkg.in/ini.v1
1.67.0
direct
Go
gopkg.in/yaml.v3
3.0.1
direct
Go
gotest.tools/v3
3.4.0
direct
Go
helm.sh/helm/v3
3.6.1-0.20210722154129-5946457ce9ea
direct
Go
k8s.io/api
0.21.0
direct
Go
k8s.io/apimachinery
0.21.0
direct
Go
k8s.io/cli-runtime
0.21.0
direct
Go
k8s.io/client-go
0.21.0
direct
Go
sigs.k8s.io/kustomize/kyaml
0.10.15
direct
Go
github.com/agl/ed25519
0.0.0-20170116200512-5312a6153412
indirect
Go
github.com/asaskevich/govalidator
0.0.0-20200428143746-21a406dcc535
indirect
Go
github.com/azure/azure-pipeline-go
0.2.1
indirect
Go
github.com/azure/go-ansiterm
0.0.0-20210617225240-d185dfc1b5a1
indirect
Go
github.com/azure/go-autorest
14.2.0+incompatible
indirect
Go
github.com/azure/go-autorest/autorest/validation
0.3.1
indirect
Go
github.com/azure/go-autorest/logger
0.2.0
indirect
Go
github.com/azure/go-autorest/tracing
0.6.0
indirect
Go
github.com/beorn7/perks
1.0.1
indirect
Go
github.com/burntsushi/toml
0.3.1
indirect
Go
github.com/cespare/xxhash/v2
2.1.1
indirect
Go
github.com/cnabio/cnab-go
0.10.0-beta1
indirect
Go
github.com/compose-spec/godotenv
1.1.1
indirect
Go
github.com/containerd/cgroups
1.0.3
indirect
Go
github.com/containerd/continuity
0.3.0
indirect
Go
github.com/containerd/typeurl
1.0.2
indirect
Go
github.com/cyphar/filepath-securejoin
0.2.2
indirect
Go
github.com/davecgh/go-spew
1.1.1
indirect
Go
github.com/dimchansky/utfbom
1.1.0
indirect
Go
github.com/docker/buildx
0.5.2-0.20210422185057-908a856079fc
indirect
Go
github.com/docker/distribution
2.7.1+incompatible
indirect
Go
github.com/docker/docker-credential-helpers
0.6.4-0.20210125172408-38bea2ce277a
indirect
Go
github.com/docker/go
1.5.1-1.0.20160303222718-d30aec9fd63c
indirect
Go
github.com/docker/go-metrics
0.0.1
indirect
Go
github.com/evanphx/json-patch
4.9.0+incompatible
indirect
Go
github.com/exponent-io/jsonpath
0.0.0-20151013193312-d6023ce2651d
indirect
Go
github.com/form3tech-oss/jwt-go
3.2.2+incompatible
indirect
Go
github.com/fvbommel/sortorder
1.0.1
indirect
Go
github.com/go-errors/errors
1.0.1
indirect
Go
github.com/go-logr/logr
0.4.0
indirect
Go
github.com/go-openapi/jsonpointer
0.19.3
indirect
Go
github.com/go-openapi/jsonreference
0.19.3
indirect
Go
github.com/go-openapi/spec
0.19.5
indirect
Go
github.com/go-openapi/swag
0.19.5
indirect
Go
github.com/gobwas/glob
0.2.3
indirect
Go
github.com/gobwas/httphead
0.1.0
indirect
Go
github.com/gobwas/pool
0.2.1
indirect
Go
github.com/gofrs/flock
0.8.0
indirect
Go
github.com/gogo/googleapis
1.4.0
indirect
Go
github.com/gogo/protobuf
1.3.2
indirect
Go
github.com/golang/groupcache
0.0.0-20200121045136-8c9f03a8e57e
indirect
Go
github.com/google/btree
1.0.0
indirect
Go
github.com/google/gofuzz
1.1.0
indirect
Go
github.com/google/uuid
1.3.0
indirect
Go
github.com/googleapis/gnostic
0.4.1
indirect
Go
github.com/gorilla/mux
1.8.0
indirect
Go
github.com/gosuri/uitable
0.0.4
indirect
Go
github.com/gregjones/httpcache
0.0.0-20180305231024-9cad4c3443a7
indirect
Go
github.com/grpc-ecosystem/go-grpc-middleware
1.2.0
indirect
Go
github.com/grpc-ecosystem/grpc-opentracing
0.0.0-20180507213350-8e809c8a8645
indirect
Go
github.com/hashicorp/errwrap
1.0.0
indirect
Go
github.com/hashicorp/golang-lru
0.5.3
indirect
Go
github.com/huandu/xstrings
1.3.1
indirect
Go
github.com/imdario/mergo
0.3.12
indirect
Go
github.com/inconshreveable/mousetrap
1.0.1
indirect
Go
github.com/jaguilar/vt100
0.0.0-20150826170717-2703a27b14ea
indirect
Go
github.com/jmespath/go-jmespath
0.4.0
indirect
Go
github.com/jmoiron/sqlx
1.3.1
indirect
Go
github.com/json-iterator/go
1.1.11
indirect
Go
github.com/kballard/go-shellquote
0.0.0-20180428030007-95032a82bc51
indirect
Go
github.com/klauspost/compress
1.11.13
indirect
Go
github.com/labstack/gommon
0.4.0
indirect
Go
github.com/lann/builder
0.0.0-20180802200727-47ae307949d0
indirect
Go
github.com/lann/ps
0.0.0-20150810152359-62de8c46ede0
indirect
Go
github.com/lib/pq
1.10.0
indirect
Go
github.com/liggitt/tabwriter
0.0.0-20181228230101-89fcab3d43de
indirect
Go
github.com/mailru/easyjson
0.7.0
indirect
Go
github.com/makenowjust/heredoc
0.0.0-20170808103936-bb23615498cd
indirect
Go
github.com/masterminds/goutils
1.1.1
indirect
Go
github.com/masterminds/semver
1.5.0
indirect
Go
github.com/masterminds/semver/v3
3.1.1
indirect
Go
github.com/masterminds/sprig/v3
3.2.2
indirect
Go
github.com/masterminds/squirrel
1.5.0
indirect
Go
github.com/mattn/go-colorable
0.1.11
indirect
Go
github.com/mattn/go-ieproxy
0.0.0-20190610004146-91bb50d98149
indirect
Go
github.com/mattn/go-isatty
0.0.14
indirect
Go
github.com/mattn/go-runewidth
0.0.7
indirect
Go
github.com/matttproud/golang_protobuf_extensions
1.0.4
indirect
Go
github.com/mgutz/ansi
0.0.0-20170206155736-9520e82c474b
indirect
Go
github.com/microsoft/hcsshim
0.8.25
indirect
Go
github.com/miekg/pkcs11
1.0.3
indirect
Go
github.com/mitchellh/copystructure
1.1.1
indirect
Go
github.com/mitchellh/go-homedir
1.1.0
indirect
Go
github.com/mitchellh/go-wordwrap
1.0.0
indirect
Go
github.com/mitchellh/mapstructure
1.4.2
indirect
Go
github.com/mitchellh/reflectwalk
1.0.1
indirect
Go
github.com/moby/buildkit
0.8.2-0.20210401015549-df49b648c8bf
indirect
Go
github.com/moby/locker
1.0.1
indirect
Go
github.com/moby/spdystream
0.2.0
indirect
Go
github.com/moby/sys/mount
0.2.0
indirect
Go
github.com/moby/sys/mountinfo
0.4.1
indirect
Go
github.com/moby/sys/symlink
0.1.0
indirect
Go
github.com/moby/term
0.0.0-20210619224110-3f7ff695adc6
indirect
Go
github.com/modern-go/concurrent
0.0.0-20180306012644-bacd9c7ef1dd
indirect
Go
github.com/modern-go/reflect2
1.0.1
indirect
Go
github.com/monochromegane/go-gitignore
0.0.0-20200626010858-205db1a8cc00
indirect
Go
github.com/opencontainers/runc
1.0.2
indirect
Go
github.com/opentracing/opentracing-go
1.2.0
indirect
Go
github.com/oras-project/oras-go
0.1.0
indirect
Go
github.com/peterbourgon/diskv
2.0.1+incompatible
indirect
Go
github.com/pmezard/go-difflib
1.0.0
indirect
Go
github.com/prometheus/client_golang
1.7.1
indirect
Go
github.com/prometheus/client_model
0.2.0
indirect
Go
github.com/prometheus/common
0.10.0
indirect
Go
github.com/prometheus/procfs
0.6.0
indirect
Go
github.com/puerkitobio/purell
1.1.1
indirect
Go
github.com/puerkitobio/urlesc
0.0.0-20170810143723-de5bf2ad4578
indirect
Go
github.com/qri-io/jsonpointer
0.1.0
indirect
Go
github.com/qri-io/jsonschema
0.1.1
indirect
Go
github.com/rubenv/sql-migrate
0.0.0-20200616145509-8d140a17f351
indirect
Go
github.com/russross/blackfriday
1.5.2
indirect
Go
github.com/sanathkr/yaml
0.0.0-20170819201035-0056894fa522
indirect
Go
github.com/shopspring/decimal
1.2.0
indirect
Go
github.com/spf13/cast
1.3.1
indirect
Go
github.com/stretchr/objx
0.5.0
indirect
Go
github.com/theupdateframework/notary
0.6.1
indirect
Go
github.com/tonistiigi/fsutil
0.0.0-20201103201449-0834f99b7b85
indirect
Go
github.com/tonistiigi/units
0.0.0-20180711220420-6950e57a87ea
indirect
Go
github.com/valyala/bytebufferpool
1.0.0
indirect
Go
github.com/valyala/fasttemplate
1.2.1
indirect
Go
github.com/xeipuuv/gojsonpointer
0.0.0-20190905194746-02993c407bfb
indirect
Go
github.com/xeipuuv/gojsonreference
0.0.0-20180127040603-bd5ef7bd5415
indirect
Go
github.com/xeipuuv/gojsonschema
1.2.0
indirect
Go
github.com/xlab/treeprint
0.0.0-20181112141820-a009c3971eca
indirect
Go
go.opencensus.io
0.23.0
indirect
Go
go.starlark.net
0.0.0-20200306205701-8dd3e2ee1dd5
indirect
Go
golang.org/x/crypto
0.0.0-20210921155107-089bfa567519
indirect
Go
golang.org/x/mod
0.6.0-dev.0.20220419223038-86c51ed26bb4
indirect
Go
golang.org/x/net
0.5.0
indirect
Go
golang.org/x/term
0.4.0
indirect
Go
golang.org/x/text
0.6.0
indirect
Go
golang.org/x/time
0.0.0-20210220033141-f8bda1e9f3ba
indirect
Go
golang.org/x/tools
0.1.12
indirect
Go
google.golang.org/appengine
1.6.7
indirect
Go
google.golang.org/genproto
0.0.0-20221118155620-16455021b5e6
indirect
Go
gopkg.in/gorp.v1
1.7.2
indirect
Go
gopkg.in/inf.v0
0.9.1
indirect
Go
gopkg.in/yaml.v2
2.4.0
indirect
Go
k8s.io/apiextensions-apiserver
0.21.0
indirect
Go
k8s.io/apiserver
0.21.0
indirect
Go
k8s.io/component-base
0.21.0
indirect
Go
k8s.io/klog/v2
2.8.0
indirect
Go
k8s.io/kube-openapi
0.0.0-20210305001622-591a79e4bda7
indirect
Go
k8s.io/kubectl
0.21.0
indirect
Go
k8s.io/utils
0.0.0-20201110183641-67b214c5f920
indirect
Go
rsc.io/letsencrypt
0.0.3
indirect
Go
sigs.k8s.io/kustomize/api
0.8.5
indirect
Go
sigs.k8s.io/structured-merge-diff/v4
4.1.0
indirect
Go
sigs.k8s.io/yaml
1.2.0
indirect
Maven
com.google.guava:guava
—
indirect
Maven
org.postgresql:postgresql
42.3.3
indirect
Dependency advisories 25
This repository publishes no package the index resolves, so its own dependency graph was assessed — 210 packages, which also include development and test pins that never ship: 25 carry known advisories, of which 13 are direct. 1 could not be assessed — no resolved version, an unsupported ecosystem, or beyond the reported package list.
Package
Version
Relation
Severity
Advisories
Fixed in
github.com/docker/docker
20.10.7+incompatible
direct
critical
35
28.0.0
google.golang.org/grpc
1.52.3
direct
critical
12
1.85.0-dev.0.20260825072537-93e31b48545e
github.com/moby/buildkit
0.8.2-0.20210401015549-df49b648c8bf
indirect
critical
16
0.31.1
golang.org/x/crypto
0.0.0-20210921155107-089bfa567519
indirect
critical
46
3.4.0
org.postgresql:postgresql
42.3.3
indirect
critical
4
42.7.11
github.com/containerd/containerd
1.5.17
direct
high
17
2.3.5
github.com/distribution/distribution/v3
3.0.0-20210316161203-a01c71e2477e
direct
high
6
3.1.1
github.com/labstack/echo
3.3.10+incompatible
direct
high
1
5.2.0
github.com/sirupsen/logrus
1.9.0
direct
high
2
1.9.3
golang.org/x/oauth2
0.4.0
direct
high
2
0.27.0
google.golang.org/protobuf
1.28.1
direct
high
2
1.33.0
helm.sh/helm/v3
3.6.1-0.20210722154129-5946457ce9ea
direct
high
28
4.1.4
github.com/docker/distribution
2.7.1+incompatible
indirect
high
3
2.8.0+incompatible
github.com/moby/spdystream
0.2.0
indirect
high
2
0.5.1
github.com/opencontainers/runc
1.0.2
indirect
high
22
1.13.0
github.com/prometheus/client_golang
1.7.1
indirect
high
2
1.11.1
golang.org/x/net
0.5.0
indirect
high
25
12.0.2
github.com/docker/cli
20.10.7+incompatible
direct
moderate
4
29.2.0+incompatible
github.com/cyphar/filepath-securejoin
0.2.2
indirect
moderate
2
0.2.4
github.com/docker/buildx
0.5.2-0.20210422185057-908a856079fc
indirect
moderate
2
0.21.3
github.com/aws/aws-sdk-go
1.35.33
direct
unknown
2
—
github.com/docker/compose/v2
2.2.0
direct
unknown
1
2.40.2
golang.org/x/sys
0.4.0
direct
unknown
1
0.44.0
golang.org/x/mod
0.6.0-dev.0.20220419223038-86c51ed26bb4
indirect
unknown
2
1.27.0-rc.3
golang.org/x/text
0.6.0
indirect
unknown
1
0.39.0
An advisory means the version recorded in the dependency graph falls inside an advisory’s affected range. Reachability is not analysed, and the graph includes development and test pins — a finding may concern tooling rather than shipped software.
Raw JSON report machine-readable
Feedback
Spotted something off in this report, or have thoughts to share? Wrong measurements, missed tooling, ideas, questions — anything is welcome. Every message is read and gets a response.
Related records
Inspected repositories sharing catalogue tags or ecosystems with docker-archive/compose-cli. Read them side by side →
Scores are signals, not warranties. They reflect publicly visible practices on GitHub — not a code audit, and not a security guarantee.
Missing data is excluded and weights renormalized, never scored as zero. Methodology is versioned and open: metrics v2.10.0, schema v0.34.0 — full methodology · metrics wiki.
