lightpanda-io/browser holds a health index of 77 out of 100, placing it in the Good band. It scores highest on Vitality (95/100) and lowest on Security (67/100). It was last updated today. 2 contributors account for most of its recent work.
77
overall / 100
Good
Software health index
Metrics are grouped into weighted categories on one standardized 1–100 scale. Overall starts as their weighted mean; when public evidence triggers the High-Risk Jurisdiction Policy, the rating is adjusted and receives an At risk ceiling of 49. AI Readiness sits outside the overall score.
77
Excellent85-100Exemplary; meets essentially all checked criteria
Good70-84Healthy; minor gaps
Moderate50-69Acceptable with notable gaps; review recommended
At risk30-49Significant weaknesses; adoption warrants caution
Critical1-29Severe problems (abandoned, single-maintainer, no hygiene)
Score profile
Each axis is a category. The shape matters more than the average — a healthy subject fills the whole shape, while a spike-and-crater profile means strength in one dimension is masking risk in another.
Direct dependencies free of known advisories — no direct dependency carries a known advisory
0/25
Indirect dependencies free of known advisories — transitive set not separable from development and test dependencies in this scope
0/40
No advisories left outstanding — no advisory carries a publication date
Inputs used
source
osv
advisories
1
affected_packages
1
assessed_packages
78
unassessed_packages
0
affected_by_severity
unknown 1
direct_affected_packages
0
Excluded from scoring (no data or not applicable): Indirect dependencies free of known advisories, No advisories left outstanding. Remaining weights renormalized. Matched 78 resolved dependencies against OSV. This repository publishes no package the index resolves, so the repository dependency graph was assessed instead. That graph mixes development and test pins with shipped dependencies, so only the declared runtime dependencies are scored; transitive findings are reported as context and excluded from the score. Reachability is not analyzed.
How well is the repo equipped to be developed and maintained with AI coding agents? An independent, experimental badge — weight 0.0, so it is surfaced on its own and does not affect the overall health score.
Type-checkable code — Zig without a type-check config
55/55
Manageable file sizes — 0/74 source files over 60KB
Inputs used
primary_language
Zig
largest_source_bytes
28,947
source_files_sampled
74
oversized_source_files
0
Key facts
32,085GitHub stars
56contributors
5,823commits, last 12 months
0days since last push
18releases
2bus factor
70open issues
—package ecosystems
Data collection warnings
Star history unavailable: GitHub GraphQL error: Resource not accessible by personal access token
Could not fetch crates package 'litefetch-html5ever' from its registry
More detail
Star and fork history 0 ★ / 1,430 ⇿
0Stars
1,430Forks
10Releases
When each star and fork was added, collected from GitHub and bucketed by day. Cumulative growth sits directly above the daily additions it is made of, so the two read against each other: steady organic accretion looks nothing like an abrupt, short-lived burst. Where that difference is measurable, it is reported as growth authenticity.
Only the most recent history is shown — this repository exceeds the collection window, so the earliest history is not captured.
Major 0Minor 1Patch 9
OpenSSF Scorecard 5.9 / 10
5.9aggregate
Independent, tool-agnostic security assessment from the open-source OpenSSF Scorecard. Each check rewards a security practice, not a specific vendor's tool. Checks Scorecard could not determine are marked n/a and excluded from the security score (never counted as zero).Scorecard v5.5.0 · 2026-07-23 08:50 UTC
Full resolved dependency set from the GitHub dependency graph: 9 direct and 69 indirect (transitive) packages. The transitive closure is complete when the repository commits a lockfile.
This repository publishes no package the index resolves, so its own dependency graph was assessed — 78 packages, which also include development and test pins that never ship: 1 carry known advisories, of which 0 are direct.
Package
Version
Relation
Severity
Advisories
Fixed in
paste
1.0.15
indirect
unknown
1
—
An advisory means the version recorded in the dependency graph falls inside an advisory’s affected range. Reachability is not analysed, and the graph includes development and test pins — a finding may concern tooling rather than shipped software.
Raw JSON report machine-readable
{
"data": {
"repo": {
"topics": [
"browser",
"cdp",
"headless",
"playwright",
"puppeteer",
"zig",
"browser-automation",
"lightpanda"
],
"is_fork": false,
"size_kb": 68698,
"has_wiki": false,
"homepage": "https://lightpanda.io",
"languages": {
"Go": 1143,
"Nix": 1960,
"Zig": 6500088,
"HTML": 1668725,
"Rust": 73344,
"Makefile": 4933,
"Dockerfile": 3194,
"JavaScript": 37748
},
"pushed_at": "2026-07-23T07:11:44Z",
"created_at": "2023-02-07T15:19:34Z",
"owner_type": "Organization",
"updated_at": "2026-07-23T08:40:06Z",
"description": "Lightpanda: the headless browser designed for AI and automation",
"is_archived": false,
"is_disabled": false,
"license_spdx": "AGPL-3.0",
"default_branch": "main",
"license_spdx_raw": "AGPL-3.0",
"primary_language": "Zig",
"significant_languages": [
"Zig",
"HTML"
]
},
"owner": {
"blog": "https://lightpanda.io",
"name": "Lightpanda",
"type": "Organization",
"login": "lightpanda-io",
"company": null,
"location": null,
"followers": 361,
"avatar_url": "https://avatars.githubusercontent.com/u/145980012?v=4",
"created_at": "2023-09-25T09:58:55Z",
"is_verified": null,
"public_repos": 32,
"account_age_days": 1031
},
"license": {
"state": "standard",
"spdx_id": "AGPL-3.0",
"raw_spdx": "AGPL-3.0",
"file_present": true,
"scorecard_found": true,
"profile_has_license": true
},
"activity": {
"releases": [
{
"tag": "0.3.5",
"kind": "patch",
"published_at": "2026-07-17T10:15:11Z"
},
{
"tag": "0.3.4",
"kind": "patch",
"published_at": "2026-07-01T16:25:52Z"
},
{
"tag": "0.3.3",
"kind": "patch",
"published_at": "2026-06-23T06:59:28Z"
},
{
"tag": "0.3.2",
"kind": "patch",
"published_at": "2026-06-16T08:33:19Z"
},
{
"tag": "0.3.1",
"kind": "patch",
"published_at": "2026-05-26T16:05:01Z"
},
{
"tag": "0.3.0",
"kind": "minor",
"published_at": "2026-05-13T14:19:58Z"
},
{
"tag": "0.2.9",
"kind": "patch",
"published_at": "2026-04-24T13:02:48Z"
},
{
"tag": "0.2.8",
"kind": "patch",
"published_at": "2026-04-02T14:14:31Z"
},
{
"tag": "0.2.7",
"kind": "patch",
"published_at": "2026-03-25T21:01:58Z"
},
{
"tag": "v0.2.6",
"kind": "patch",
"published_at": "2026-03-14T08:56:10Z"
},
{
"tag": "v0.2.5",
"kind": "patch",
"published_at": "2026-03-03T16:52:49Z"
},
{
"tag": "v0.2.4",
"kind": "patch",
"published_at": "2026-02-19T10:00:53Z"
},
{
"tag": "v0.2.3",
"kind": "patch",
"published_at": "2026-02-11T07:38:25Z"
},
{
"tag": "v0.2.2",
"kind": "patch",
"published_at": "2026-01-29T09:28:53Z"
},
{
"tag": "v0.2.1",
"kind": "patch",
"published_at": "2026-01-19T10:11:35Z"
},
{
"tag": "v0.2.0",
"kind": "minor",
"published_at": "2026-01-08T08:01:32Z"
},
{
"tag": "v0.1.0",
"kind": "minor",
"published_at": "2026-01-07T19:42:43Z"
},
{
"tag": "nightly",
"kind": "other",
"published_at": "2024-07-16T10:45:32Z"
}
],
"recent_commits": [
{
"oid": "a50c38b67220f9198343c0fbbb8ff13a9558414b",
"body": "cdp: expose child frame metadata",
"is_bot": false,
"headline": "Merge pull request #3016 from Ppsoft1991/fix/cdp-frame-parent",
"author_name": "Karl Seguin",
"author_login": "karlseguin",
"committed_at": "2026-07-23T04:43:55Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "6374dab634ea0300ae10760851519680851ef05a",
"body": "This has the benefit of avoiding a few arena dupes, but those were small. The\nreal benefit is consistency with the rest of the code.",
"is_bot": false,
"headline": "refactor: Use JSON writer to serialize CDP Frame",
"author_name": "Karl Seguin",
"author_login": "karlseguin",
"committed_at": "2026-07-23T04:22:24Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "f88564b56dfb2cee565cc6d4dcd51d2432b776d1",
"body": "Include parentId on child frame navigation events and recursively serialize child frames in Page.getFrameTree using their live frame and loader IDs.\n\nFixes #3014",
"is_bot": false,
"headline": "cdp: expose child frame metadata",
"author_name": "Ppsoft1991",
"author_login": "Ppsoft1991",
"committed_at": "2026-07-23T04:08:45Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "0d77c501db89139b84bf3b80fddc032f63a905f7",
"body": "webapi: derive SVG prototype chains",
"is_bot": false,
"headline": "Merge pull request #3012 from mh0pe/codex/svg-01-factory",
"author_name": "Karl Seguin",
"author_login": "karlseguin",
"committed_at": "2026-07-23T02:31:38Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "7140cfab5ae1e7719b8880bb48fa08f53e1db7f7",
"body": null,
"is_bot": false,
"headline": "webapi: derive SVG prototype chains",
"author_name": "Madison Steiner",
"author_login": "mh0pe",
"committed_at": "2026-07-23T00:05:40Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "6f82bdcd51d18012f10fdb8dfe8c5c7b69a00e18",
"body": "browser: inline finalizer callbacks",
"is_bot": false,
"headline": "Merge pull request #3026 from staylor/inline-finalizer-callbacks",
"author_name": "Karl Seguin",
"author_login": "karlseguin",
"committed_at": "2026-07-23T00:02:26Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "95ed50500b09c87b2578f0cfa1c7e81704a3fb85",
"body": "webapi: Improve ResizeObserver",
"is_bot": false,
"headline": "Merge pull request #3000 from lightpanda-io/resize-observer",
"author_name": "Karl Seguin",
"author_login": "karlseguin",
"committed_at": "2026-07-22T23:48:40Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "bd19246b4526dfab5a29b32b97c2c3ed1a9c0300",
"body": "perf: Improve Runner tick signaling on macrotask-only wait",
"is_bot": false,
"headline": "Merge pull request #2999 from lightpanda-io/runner-tick-signal",
"author_name": "Karl Seguin",
"author_login": "karlseguin",
"committed_at": "2026-07-22T23:48:27Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "bbbbfc7314c30215ab12805cb427cd9678bcc938",
"body": "script: route console output through an optional sink",
"is_bot": false,
"headline": "Merge pull request #3024 from lightpanda-io/agent-console-sink",
"author_name": "Karl Seguin",
"author_login": "karlseguin",
"committed_at": "2026-07-22T23:33:08Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "8f562330c80b4c60d6056d5ec74efe74d9110271",
"body": "Currently, Runner assumes that HttpClient.tick did something. But it's possible\nthat HttpClient had nothing to do, and thus didn't poll. In that case, Runner\nwould return .{.ok = 0} and Runner's caller would also certainly call\nRunner.tick again, resulting in a spin-loop.\n\nThe reason Runner allows t\n[…]\nen HttpClient.tick has done nothing, Runner will return its\nms_to_next_task, rather than 0.\n\nOn sites where all i/o is completed, and only macrotasks are waiting, this\nsignificantly reduces CPU usage.",
"is_bot": false,
"headline": "perf: Improve Runner tick signaling on macrotask-only wait",
"author_name": "Karl Seguin",
"author_login": "karlseguin",
"committed_at": "2026-07-22T23:28:32Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "e88b4b67793b6c0a10bff38a1e0790802c92e3f7",
"body": null,
"is_bot": false,
"headline": "zig 0.16",
"author_name": "Karl Seguin",
"author_login": "karlseguin",
"committed_at": "2026-07-22T23:27:40Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "61fd04d3a52b67a97f612a1ea2b0e0a3a087204a",
"body": "This gives ResizeObserver a touch up that brings it on par with how the more\nflushed out IntersectionObserver behaves. While it's impossible to fully\nimplement this in a headless world, we can correctly emit ResizeObserverEntry\nin a number of important cases, e.g. visibility change, and style width/height\nchanges.\n\nMost importantly, we not execute the callback on the initial observe, which can\nunlock some cases.",
"is_bot": false,
"headline": "webapi: Improve ResizeObserver",
"author_name": "Karl Seguin",
"author_login": "karlseguin",
"committed_at": "2026-07-22T23:23:56Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "4e143310467c47854200425447f47a5e81772856",
"body": "websocket, wpt: Improve websocket WPT results + flakiness",
"is_bot": false,
"headline": "Merge pull request #3017 from lightpanda-io/websocket-improvements",
"author_name": "Karl Seguin",
"author_login": "karlseguin",
"committed_at": "2026-07-22T23:23:32Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "2be09b51994a7d4e3eed0ce113efee735ab387c8",
"body": "Assisted-By: devx/3b7fd0ba-7378-40f0-a356-c0f5ce04cd1e",
"is_bot": false,
"headline": "browser: inline finalizer callbacks",
"author_name": "Scott Taylor",
"author_login": "staylor",
"committed_at": "2026-07-22T16:52:40Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "bb2f1a7fe3d3912e522387c4d54a5f7bd4d2026b",
"body": "cdp: preserve node IDs across child frame navigation",
"is_bot": false,
"headline": "Merge pull request #3020 from raj921/codex/fix-cdp-detached-node",
"author_name": "Pierre Tachoire",
"author_login": "krichprollsch",
"committed_at": "2026-07-22T16:20:44Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "c451cd763a3d4ae8df76b987e98556fe56c0461e",
"body": "1 - Blocks connection to \"bad\" ports\n2 - new WebSocket('...'); mostly returns the instance, and errors are emitted\n in a close event (1)\n3 - More validation (no # allowed, ...);\n4 - http -> ws, https -> wss (yes, per spec)\n\nThere's also some groundwork for better float16 support, but it turns ou\n[…]\ne a new v8 build to complete. So I left the harmless float16 mapping\nin (but, without the matching Float16Array, it doesn't help much).\n\n(1) Some things cause an exception to be raised, but most don't",
"is_bot": false,
"headline": "websocket, wpt: Improve websocket WPT results + flakiness",
"author_name": "Karl Seguin",
"author_login": "karlseguin",
"committed_at": "2026-07-22T15:31:54Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "e1202b76600f96f6e85286494ee30aedeaacb4e6",
"body": "Since the Zig 0.16 merge, console.log and completion echoes from the\nagent runtime tests reach the real stdout (0.15 silently swallowed\nthem), polluting the bench.json that CI captures from 'zig build test'\nand breaking the perf-fmt job's JSON decoding.\n\nAdd Runtime.console_sink: when set, console lines write there instead\nof stdout/stderr. The three printing tests now capture their output\nand assert it, covering console argument joining and the top-level\nreturn echo.",
"is_bot": false,
"headline": "script: route console output through an optional sink",
"author_name": "Adrià Arrufat",
"author_login": "arrufat",
"committed_at": "2026-07-22T15:00:40Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "12fa469214bf27bde836c0161332f5fbc1641948",
"body": "zig: use posix shim for shutdown",
"is_bot": false,
"headline": "Merge pull request #3023 from lightpanda-io/zig-16-merge-fix-2",
"author_name": "Karl Seguin",
"author_login": "karlseguin",
"committed_at": "2026-07-22T14:34:41Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "abdd9f003716782e7fa7510d1a878f35d0a17bb9",
"body": null,
"is_bot": false,
"headline": "zig: use posix shim for shutdown",
"author_name": "Karl Seguin",
"author_login": "karlseguin",
"committed_at": "2026-07-22T14:34:16Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "c0c8d4dc70cc07fff3f645a9504f7683b3fd3789",
"body": "cdp: Improve dead-peer detection",
"is_bot": false,
"headline": "Merge pull request #3018 from lightpanda-io/improve-dead-peer-detection",
"author_name": "Karl Seguin",
"author_login": "karlseguin",
"committed_at": "2026-07-22T14:01:10Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "2e55ace2969508c2f541a259cdf45748f22a824e",
"body": "zig, minor: fix zig 0.16 merge",
"is_bot": false,
"headline": "Merge pull request #3021 from lightpanda-io/zig-16-merge-fix",
"author_name": "Karl Seguin",
"author_login": "karlseguin",
"committed_at": "2026-07-22T13:59:31Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "fbecab3910747cf4ba97bb018638e366203f50aa",
"body": null,
"is_bot": false,
"headline": "zig, minor: fix zig 0.16 merge",
"author_name": "Karl Seguin",
"author_login": "karlseguin",
"committed_at": "2026-07-22T13:48:55Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "e979a317ad8a250ad6b325f94118d4cb686f0304",
"body": "zig: Zig 0.16",
"is_bot": false,
"headline": "Merge pull request #3007 from lightpanda-io/zig-0.16",
"author_name": "Karl Seguin",
"author_login": "karlseguin",
"committed_at": "2026-07-22T13:43:39Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "1e31e45bcf627d1bd6ef28ab94cc75638610af4e",
"body": null,
"is_bot": false,
"headline": "cdp: preserve node IDs across child frame navigation",
"author_name": "raj921",
"author_login": "raj921",
"committed_at": "2026-07-22T11:45:25Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "29e31377ed6905ee2b9aa42cdccba431d2a777f5",
"body": "1 - On linux, set TCP_USER_TIMEOUT to 10 seconds. This closes the gap where\n TCP_KEEPALIVE doesn't trigger if there are un-ack'd writes\n\n2 - shutdown the socket on cases where we know the peer is gone. This would\n unblock a worker blocked on a send()",
"is_bot": false,
"headline": "cdp: Improve dead-peer detection",
"author_name": "Karl Seguin",
"author_login": "karlseguin",
"committed_at": "2026-07-22T10:37:37Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "32280e6864e9612920bbce80a022941174c5fdf0",
"body": "Interrupt nested script waits during teardown",
"is_bot": false,
"headline": "Merge pull request #3010 from staylor/fix/issue-3009",
"author_name": "Karl Seguin",
"author_login": "karlseguin",
"committed_at": "2026-07-22T08:59:34Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "0cb9c3aebbd77d3f170e8cc54d4dc734c322baa1",
"body": null,
"is_bot": false,
"headline": "dedupe check and centralize it in HttpClient's tickSync",
"author_name": "Karl Seguin",
"author_login": "karlseguin",
"committed_at": "2026-07-22T08:41:33Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "0871b6a8daf42a13d213e6c37084a173972add2e",
"body": "Make sure jemallocator is disabled in Release builds (we only use it in Debug\nbuilds to collect metrics. Supposedly something changed in our 0.16 build that\ncauses it to be initialized even though it isn't used. Not sure, for this, I'm\njust doing what Claude tell me, but disabling something in Release that I know\nwe aren't using sounds ok).",
"is_bot": false,
"headline": "disable Zig 0.16 signal_stack_size",
"author_name": "Karl Seguin",
"author_login": "karlseguin",
"committed_at": "2026-07-22T05:26:06Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "92537df123cb0b7467a5f8ae7235d9b16eecc967",
"body": "We've been climbing the last couple weeks, and Zig 0.16 appears to have added\n~400KB. I'll try to go hunt it, but I don't want this to delay the merge.\n\n(Pierre agrees)",
"is_bot": false,
"headline": "Raise memory limit regression to 29MB",
"author_name": "Karl Seguin",
"author_login": "karlseguin",
"committed_at": "2026-07-22T05:26:06Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "802862120f7a9255833a893abbfdad1548fd6ff1",
"body": null,
"is_bot": false,
"headline": "update zenai dep (zig 0.16)",
"author_name": "Karl Seguin",
"author_login": "karlseguin",
"committed_at": "2026-07-22T05:26:06Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "df7bde233d2bf95ae787284b46dc1e9912050c69",
"body": "Try to fix CI (this is what claude came up with, I have no idea why CI is\nfailing).",
"is_bot": false,
"headline": "Fix linux build",
"author_name": "Karl Seguin",
"author_login": "karlseguin",
"committed_at": "2026-07-22T05:26:06Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "8e42d63c1c567c49023fc1c4836fff56a6bbe2ca",
"body": "Built against https://github.com/lightpanda-io/zig-v8-fork/tree/zig-0.16 but\nit doesn't require a new v8 build.\n\nBuilt against https://github.com/lightpanda-io/boringssl-zig/tree/zig-0.16\nsince the current fork we point to isn't updated.\n\nA global std.Io instance, lp.io. Way easier this way and requ\n[…]\ne, but it locks my computer, consuming RAM until MacOS\ngives me a popup I've never seen before, begging me to start killing processes.\n\nAgent and the networking stuff saw the most significant changes.",
"is_bot": false,
"headline": "zig: Zig 0.16",
"author_name": "Karl Seguin",
"author_login": "karlseguin",
"committed_at": "2026-07-22T05:26:03Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "8a3ef296c0af0ba068895bf568bb49fb06bed1e6",
"body": "overflow: Make RC a u32",
"is_bot": false,
"headline": "Merge pull request #3011 from lightpanda-io/rc-overflow",
"author_name": "Karl Seguin",
"author_login": "karlseguin",
"committed_at": "2026-07-22T05:19:59Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "a100c49cee43580339ad7071cc139a57b3e1b23f",
"body": "Remove the RC(T) generic, make the counter always a u32. We've now seen two\nu8 overflow cases. Time to eliminate them all.",
"is_bot": false,
"headline": "overflow: Make RC a u32",
"author_name": "Karl Seguin",
"author_login": "karlseguin",
"committed_at": "2026-07-22T01:39:54Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "a12032cd0e0077d6c85a222839110a758230a57e",
"body": "Assisted-By: devx/8bea7794-aef3-4ef5-a06d-fd1f1f3aafd0",
"is_bot": false,
"headline": "Interrupt nested script waits during teardown",
"author_name": "Scott Taylor",
"author_login": "staylor",
"committed_at": "2026-07-21T22:07:15Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "90db5d7f698636196502aea377475b94f601efee",
"body": "perf, v8: reduce gc hint frequency",
"is_bot": false,
"headline": "Merge pull request #3005 from lightpanda-io/reduce-gc-hint-frequency",
"author_name": "Karl Seguin",
"author_login": "karlseguin",
"committed_at": "2026-07-21T10:44:19Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "ea13c57dcd8b71b3dfe1deab408ef3d0efb13b32",
"body": "wpt: adjust concurrency",
"is_bot": false,
"headline": "Merge pull request #3006 from lightpanda-io/wpt-adjust",
"author_name": "Karl Seguin",
"author_login": "karlseguin",
"committed_at": "2026-07-21T10:00:31Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "fd35c0d01a4ff5ddaf7e763e7d5e04fab5df4006",
"body": null,
"is_bot": false,
"headline": "wpt: adjust concurrency",
"author_name": "Pierre Tachoire",
"author_login": "krichprollsch",
"committed_at": "2026-07-21T09:38:27Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "ea2008334f9bb0f1fcb3d580e3be13cc4f2201be",
"body": "Add per-CDP control for Network.setCacheDisabled",
"is_bot": false,
"headline": "Merge pull request #2990 from staylor/scott/http-cache-interception",
"author_name": "Pierre Tachoire",
"author_login": "krichprollsch",
"committed_at": "2026-07-21T08:06:54Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "69b3424b9c720f3fb4709b5069cba13936cd17d6",
"body": "This reverts commit aa4323f72b0e8fb600c08874cb8c7af8f88a2abd.",
"is_bot": false,
"headline": "Revert \"experiment: On session teardown, use less aggressive v8 GC hint\"",
"author_name": "Karl Seguin",
"author_login": "karlseguin",
"committed_at": "2026-07-21T02:34:01Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "aa4323f72b0e8fb600c08874cb8c7af8f88a2abd",
"body": "critical -> moderate",
"is_bot": false,
"headline": "experiment: On session teardown, use less aggressive v8 GC hint",
"author_name": "Karl Seguin",
"author_login": "karlseguin",
"committed_at": "2026-07-21T02:06:42Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "eca8baf8ed280295d46f8d81d2f8672424fbf5ce",
"body": "We currently send a memoryPressureNotification every second during a run. This\ncan put too much pressure on v8, manifesting as high CPU usage particularly on\ncomplex pages. This commit changes it to every 5 seconds.\n\nAlso, remove unused lowMemoryNotification.v8, perf: Reduce v8 GC hint frequency.",
"is_bot": false,
"headline": "v8, perf: Reduce v8 GC hint frequency.",
"author_name": "Karl Seguin",
"author_login": "karlseguin",
"committed_at": "2026-07-21T00:58:42Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "c7850a4012c183b43ca970c04032652af9d6c0eb",
"body": "Assisted-By: devx/2fa2960e-76f4-4b6e-b6e6-1419f108f12b",
"is_bot": false,
"headline": "Add per-CDP cache disable configuration",
"author_name": "Scott Taylor",
"author_login": "staylor",
"committed_at": "2026-07-20T18:02:55Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "cd9492f29ceb2b5ea5bef64f121ad3bfe7b8701b",
"body": "…tError\n\nwebapi: On script error, trigger window.reportError",
"is_bot": false,
"headline": "Merge pull request #3003 from lightpanda-io/script-error-window-repor…",
"author_name": "Pierre Tachoire",
"author_login": "krichprollsch",
"committed_at": "2026-07-20T15:53:06Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "a5ee29d99d216c17012d272cfbd955f08914362f",
"body": "ci: add plumber to watch workflow security",
"is_bot": false,
"headline": "Merge pull request #2985 from Totara-thib/plumber-ci",
"author_name": "Pierre Tachoire",
"author_login": "krichprollsch",
"committed_at": "2026-07-20T15:27:22Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "6c5bde28df38ce853592860f8038f9ae61d58bee",
"body": "Besides this being correct, it should improve WPT stalls by triggering the\nwindow.onerror which the WPT harness hooks into to stop tests.",
"is_bot": false,
"headline": "webapi: On script error, trigger window.reportError",
"author_name": "Karl Seguin",
"author_login": "karlseguin",
"committed_at": "2026-07-20T13:50:50Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "e25ea46cd8b939b95e90f098ad1f91b3e4d6540d",
"body": "Co-authored-by: Pierre Tachoire <pierre@tch.re>",
"is_bot": false,
"headline": "chore(readme): remove plumber badge",
"author_name": "Thibaud-Vdb",
"author_login": "Totara-thib",
"committed_at": "2026-07-20T13:33:28Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "1d553ff5ee13a5bc7132585fce8410213b6dc765",
"body": "Runs on pushes to main and on pull requests. The config starts from\nthe generated defaults and is scoped to this repo: the few controls\nthat are off carry a note explaining why and what would let them\ncome back on.\n\nReports are uploaded to code scanning, except on PRs from forks\nwhere the token cannot write security events. Each run on main also\npublishes the score through OIDC, which feeds the live badge added\nto the README next to the existing ones.",
"is_bot": false,
"headline": "ci: add plumber to watch workflow security",
"author_name": "Thibaud-Vdb",
"author_login": "Totara-thib",
"committed_at": "2026-07-20T13:12:58Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "32479b12999cc60388c1ae9bc6fa5d489440fb6c",
"body": "ci: pin github actions to commit shas",
"is_bot": false,
"headline": "Merge pull request #2984 from Totara-thib/pin-actions",
"author_name": "Pierre Tachoire",
"author_login": "krichprollsch",
"committed_at": "2026-07-20T13:12:03Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "cca00c022e11ab33e1199ed7dad5de56104d6995",
"body": "Mutable tags like @v6 can be re-pointed by whoever controls the action,\nso the next run executes code nobody here reviewed, with the job's\ntoken and secrets. Pinning to the full commit sha freezes what runs.\nVersion tags are kept as comments so renovate or dependabot can still\ntrack updates.\n\ndtolnay/rust-toolchain is pinned to a master commit with the toolchain\nmoved to an explicit input, as its readme recommends for sha pinning.",
"is_bot": false,
"headline": "ci: pin github actions to commit shas",
"author_name": "Thibaud-Vdb",
"author_login": "Totara-thib",
"committed_at": "2026-07-20T12:56:59Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "1ded9da77332fa858fabb0b060f59c9039e50332",
"body": "Cookie store",
"is_bot": false,
"headline": "Merge pull request #2995 from lightpanda-io/cookie-store",
"author_name": "Karl Seguin",
"author_login": "karlseguin",
"committed_at": "2026-07-20T12:16:29Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "795c1a96bb15b89597b3f73c42cb132c679eeb8c",
"body": "iframe: load about:blank on un-parsable URL",
"is_bot": false,
"headline": "Merge pull request #2988 from lightpanda-io/iframe-invalid-url",
"author_name": "Karl Seguin",
"author_login": "karlseguin",
"committed_at": "2026-07-20T10:50:07Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "42f089780c68f9586d2f20690a650d77dea01266",
"body": null,
"is_bot": false,
"headline": "move stripFragment to URL.zig",
"author_name": "Karl Seguin",
"author_login": "karlseguin",
"committed_at": "2026-07-20T10:47:00Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "3d59f0eec2d619bc9d1d64a16da7c2d7d2dc7409",
"body": "Add WebDriver.getNamedCookie to give WPT access to http-only cookie.",
"is_bot": false,
"headline": "uaf: Fix potential UAF from js-created CookieChangeEvent",
"author_name": "Karl Seguin",
"author_login": "karlseguin",
"committed_at": "2026-07-20T10:47:00Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "4cdf8b441ea91a5c0edc872e1410aefdbfa12e10",
"body": "Normalize get name so that it matches the normalize stored cookie name.\n\nDon't queue cookie change event if there's no listener. This one's a bit tricky\nsince we do this check inside the callback already. But that means a listener\nadded after the event is created (but before it's delivered) gets a change\nevent it should not. So we need to check it both at event-creation time and\nat delivery time.",
"is_bot": false,
"headline": "webapi: Support max-age for CookieStore",
"author_name": "Karl Seguin",
"author_login": "karlseguin",
"committed_at": "2026-07-20T10:47:00Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "9090869420736c03c85f1b034ef87d292f5ae82f",
"body": "webapi: Blob shared per origin",
"is_bot": false,
"headline": "Merge pull request #2991 from lightpanda-io/blob-origin",
"author_name": "Karl Seguin",
"author_login": "karlseguin",
"committed_at": "2026-07-20T10:46:34Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "5736be97407d9c18ba2961abca5c900919e8ca83",
"body": "robots.txt: Improve robots.txt correctness.",
"is_bot": false,
"headline": "Merge pull request #2997 from lightpanda-io/robots-fix",
"author_name": "Karl Seguin",
"author_login": "karlseguin",
"committed_at": "2026-07-20T10:41:23Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "7a9b93becce77889b2b798a8f9b4c5574ace6859",
"body": "This applies two individual fixes to our robots.txt parser. The first is that\ninstead of doing an exact match with the User-Agent, it extracts the\n\"productToken\". A UA of Lightpanda/1.0, should match \"Lightpanda\". The second is\nthat an empty directive matches.\n\nGiven:\n\nUser-agent: Lightpanda\nDisallo\n[…]\nons. Fix #1 is necessary, otherwise\n\"Lightpanda\" != \"Lightpanda/1.0\". Fix #2 is necessary because this robots.txt\ndoes _not_ disallow Lightpanda from anything (e.g. the fallback doesn't apply\nto us).",
"is_bot": false,
"headline": "robots.txt: Improve robots.txt correctness.",
"author_name": "Karl Seguin",
"author_login": "karlseguin",
"committed_at": "2026-07-20T07:00:04Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "0cffa933d466a59074b0b0e341b11367004079e9",
"body": "cache: Never cache the top-level root page",
"is_bot": false,
"headline": "Merge pull request #2996 from lightpanda-io/root-page-no-cache",
"author_name": "Karl Seguin",
"author_login": "karlseguin",
"committed_at": "2026-07-20T06:58:52Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "9e1e0454589060848c8f64b577907b7ea4ff38a1",
"body": "wpt: set a memory limit per browser instead of per process",
"is_bot": false,
"headline": "Merge pull request #2998 from lightpanda-io/wpt-change",
"author_name": "Pierre Tachoire",
"author_login": "krichprollsch",
"committed_at": "2026-07-20T06:58:09Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "af3a552af7232eebe3f98af1c7e95f94df278573",
"body": null,
"is_bot": false,
"headline": "wpt: set a memory limit per browser instead of per process",
"author_name": "Pierre Tachoire",
"author_login": "krichprollsch",
"committed_at": "2026-07-20T06:29:44Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "299eb2c5f925aabafa3036a44e85bf8ba738f85c",
"body": "…-dispatch\n\nperf: If a message is dispatched, don't poll",
"is_bot": false,
"headline": "Merge pull request #2989 from lightpanda-io/http-client-no-poll-after…",
"author_name": "Karl Seguin",
"author_login": "karlseguin",
"committed_at": "2026-07-19T00:37:42Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "996815d5703cc240d4a02bb2167a68a973c407d8",
"body": null,
"is_bot": false,
"headline": "zig fmt",
"author_name": "Karl Seguin",
"author_login": "karlseguin",
"committed_at": "2026-07-18T09:19:02Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "86bf28216ad0581dcccedd4856cad2361539ca54",
"body": "This reworks blob URLs from being owned by the Frame to being owned by the Page\nand shared / protected by origin. This allows, for example, a worker/popup/\niframe from accessing blobs created by its page, provided they share the same\norigin.\n\nThis was already working on a small (but common) set of cases, but has now been\nreworked (by moving the blob registry up to the Page, where it can be shared) to\ncover every case.",
"is_bot": false,
"headline": "webapi: Blob shared per origin",
"author_name": "Karl Seguin",
"author_login": "karlseguin",
"committed_at": "2026-07-18T06:24:39Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "20cde7a6f59b672d49c9f14f53207bcc7cf86d60",
"body": "Polling delays processing of messages. So don't poll after we know we've\ndispatched. Largely impacts CDP which is more likely to poll (for data on the\nCDP connection).",
"is_bot": false,
"headline": "perf: If a message is dispatched, don't poll",
"author_name": "Karl Seguin",
"author_login": "karlseguin",
"committed_at": "2026-07-18T01:54:41Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "fc461e05a93a0284d63f438bfc15df127b3b89c5",
"body": "cli: add `run` command for script replay",
"is_bot": false,
"headline": "Merge pull request #2920 from lightpanda-io/run-command",
"author_name": "Adrià Arrufat",
"author_login": "arrufat",
"committed_at": "2026-07-17T21:59:23Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "805b60d626fbe8ebb2d384dba97cc127ed9a7102",
"body": "# Conflicts:\n#\tsrc/Config.zig\n#\tsrc/help.zon",
"is_bot": false,
"headline": "Merge branch 'main' into run-command",
"author_name": "Adrià Arrufat",
"author_login": "arrufat",
"committed_at": "2026-07-17T20:46:47Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "ac0e6c86a9c4e0adbd6315e24df1294a54c1b69f",
"body": "Dispose Event for `NavigationHistoryEntry`",
"is_bot": false,
"headline": "Merge pull request #2970 from lightpanda-io/navigation-dispose-event",
"author_name": "Pierre Tachoire",
"author_login": "krichprollsch",
"committed_at": "2026-07-17T13:31:06Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "6b6b17240e20743ec9e347bf3cea22bda92334ac",
"body": "Spec says this is what we should do and it's apparently used a part of bot\ndetections (because bots don't load about:blank and thus the iframe's state\ncan easily be checked to be invalid, I guess).",
"is_bot": false,
"headline": "iframe: load about:blank on un-parsable URL",
"author_name": "Karl Seguin",
"author_login": "karlseguin",
"committed_at": "2026-07-17T12:45:24Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "11f97772821b97a648ca98abe84b0ad8b6d4a3bf",
"body": "The idea is that, for most cases, the top level page isn't revisited, so\ncaching is just overhead + wasted space. Plus, if someone does revisit it,\nchances are they want a fresh copy.\n\nImagine someone scraping a typical ecommerce site. Sure, they want to cache\nthe .js files which get re-used from product to product. But do they want to\ncache each individual product page?",
"is_bot": false,
"headline": "cache: Never cache the top-level root page",
"author_name": "Karl Seguin",
"author_login": "karlseguin",
"committed_at": "2026-07-17T10:55:31Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "d4ea8153695c81a3f67cb7a1612af58e147493c6",
"body": "cli: page help output through $PAGER when stdout is a tty",
"is_bot": false,
"headline": "Merge pull request #2981 from lightpanda-io/help-pager",
"author_name": "Pierre Tachoire",
"author_login": "krichprollsch",
"committed_at": "2026-07-17T10:06:30Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "8b110ff5c5217893729facaa6b81410c87ffcdf1",
"body": "The disposed entries are already out of _entries, so an error during\nthe currententrychange dispatch leaked their _on_dispose callbacks\n(onRemoveFrame only walks _entries). Fire dispose in a defer and log\nper-entry failures instead of propagating them.",
"is_bot": false,
"headline": "fire dispose even when currententrychange dispatch fails",
"author_name": "Pierre Tachoire",
"author_login": "krichprollsch",
"committed_at": "2026-07-17T10:04:19Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "f02fba40cd1a94b6311294268cd14be88fcd9eae",
"body": "std.start.maybeIgnoreSigpipe() already installs a noop SIGPIPE handler\nat startup (std.options.keep_sigpipe defaults to false), so a write to\na dead pager returns error.BrokenPipe — which the existing catch\nhandles — instead of killing the process. The manual SIG_IGN was also\nthe disposition std deliberately avoids, since ignored dispositions\nsurvive exec and would leak to child processes.",
"is_bot": false,
"headline": "cli: drop redundant SIGPIPE ignore in the help pager",
"author_name": "Adrià Arrufat",
"author_login": "arrufat",
"committed_at": "2026-07-17T09:50:51Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "4a995f954464e6826c6bc8509fc00c4eb5a4267f",
"body": null,
"is_bot": false,
"headline": "fire dispose after currententrychange per spec",
"author_name": "Pierre Tachoire",
"author_login": "krichprollsch",
"committed_at": "2026-07-17T09:38:11Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "5c0c2920db37a1c5dada8120a2c4cc4564c31cde",
"body": null,
"is_bot": false,
"headline": "release previous oncurrententrychange on overwrite",
"author_name": "Pierre Tachoire",
"author_login": "krichprollsch",
"committed_at": "2026-07-17T09:23:03Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "bf775696de0eab08987f437f06ff19fdaa584a8b",
"body": null,
"is_bot": false,
"headline": "don't skip dispose dispatch when ondispose is unset",
"author_name": "Pierre Tachoire",
"author_login": "krichprollsch",
"committed_at": "2026-07-17T09:17:05Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "a59abc7f4f1573ea76f9bd1fe683362f81535e6e",
"body": "cdp: emit non-UTF-8 header values as Latin-1 strings, not byte arrays",
"is_bot": false,
"headline": "Merge pull request #2972 from lightpanda-io/sanitize-utf8-headers",
"author_name": "Pierre Tachoire",
"author_login": "krichprollsch",
"committed_at": "2026-07-17T08:06:35Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "1bea30ac4e48d33b8b2b498d2bc2e378ee4a1ac7",
"body": null,
"is_bot": false,
"headline": "clear callbacks on onRemoveFrame for Navigation",
"author_name": "Muki Kiboigo",
"author_login": "mookums",
"committed_at": "2026-07-17T08:03:47Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "b0c0b3fe3a01f1a180855bacd3631f2b51212bc0",
"body": null,
"is_bot": false,
"headline": "release on dispose",
"author_name": "Muki Kiboigo",
"author_login": "mookums",
"committed_at": "2026-07-17T08:01:25Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "9ba8d8c564714e21a4365331fdfec138029b2149",
"body": null,
"is_bot": false,
"headline": "fix reentrancy on dispose and clean up",
"author_name": "Muki Kiboigo",
"author_login": "mookums",
"committed_at": "2026-07-17T08:00:06Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "35f128d2641dfdb63022d6ee1193c08ff74f688a",
"body": null,
"is_bot": false,
"headline": "use hasDirectListeners for fireDispose",
"author_name": "Muki Kiboigo",
"author_login": "mookums",
"committed_at": "2026-07-17T07:57:08Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "b19b57250a060f88a5114c12b004f2c63676a0b0",
"body": "css: apply @layer block rules to the cascade",
"is_bot": false,
"headline": "Merge pull request #2719 from navidemad/css-layer-cascade",
"author_name": "Karl Seguin",
"author_login": "karlseguin",
"committed_at": "2026-07-17T03:49:24Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "28b4a31b590d2390c95ff7acd675f2130bf8aff4",
"body": "…times\n\nwebapi: bound scroll task allocations; tighten DOM allocation lifetimes",
"is_bot": false,
"headline": "Merge pull request #2963 from lightpanda-io/dom-pr-22-allocation-life…",
"author_name": "Karl Seguin",
"author_login": "karlseguin",
"committed_at": "2026-07-17T03:28:20Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "50a896f4c0a2ab3eeadea74bef364c6924bdf5fa",
"body": "Use the call arena only for the AbortSignal dependent list that must survive re-entrant abort handlers, and move scratch-only DOM reads to the local arena. Store BeforeUnloadEvent.returnValue in the event-owned arena so it remains valid without accumulating in the longer-lived frame arena.\n\nThese allocator changes bound temporary memory to the shortest safe lifetime while preserving existing Web API behavior. Add coverage for replacing BeforeUnloadEvent.returnValue.",
"is_bot": false,
"headline": "webapi: tighten DOM allocation lifetimes",
"author_name": "Francis Bouvier",
"author_login": "francisbouvier",
"committed_at": "2026-07-17T02:52:10Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "8f42b72d18ce342674acf7af96871b78b80a69a6",
"body": "Keep one slab-allocated scheduler task per active element scroll sequence and recycle it on completion or scheduler cancellation. This prevents repeated programmatic scrolling from growing the frame arena and task queue without bound.\n\nAdvance the throttle state before dispatching scroll and scrollend so nested JavaScript callbacks cannot be overwritten, and avoid scheduling events for clamped no-op scrollBy calls. Add coverage for coalescing, both re-entrant event paths, and no-op scrolling.",
"is_bot": false,
"headline": "webapi: bound element scroll task allocations",
"author_name": "Francis Bouvier",
"author_login": "francisbouvier",
"committed_at": "2026-07-17T02:52:09Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "1cebd1c1ce1b210cbd3d9f9de6409000fecfa824",
"body": "…fragment-nav\n\nwebapi: handler return-false cancels events; same-fragment navigations don't reload",
"is_bot": false,
"headline": "Merge pull request #2962 from lightpanda-io/dom-pr-21-handler-return-…",
"author_name": "Karl Seguin",
"author_login": "karlseguin",
"committed_at": "2026-07-17T02:51:28Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "51dbad5a6a736d1ddac8e6c0c6c7e2b6c8f0c616",
"body": null,
"is_bot": false,
"headline": "allow location.reload() on fragmented url to cause navigation",
"author_name": "Karl Seguin",
"author_login": "karlseguin",
"committed_at": "2026-07-17T02:40:08Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "65a3ce33c0503d0c757d98e787de028b2a488400",
"body": "Review pattern from #2943: prefer the local arena for scratch-only\nallocations. scheduleNavigation dupes the URL into its own arena\nsynchronously at entry, so the normalized fragment does not need to\nsurvive the call.\n\nCo-Authored-By: Karl Seguin <karlseguin@users.noreply.github.com>",
"is_bot": false,
"headline": "webapi: use the local arena for the normalized hash",
"author_name": "Francis Bouvier",
"author_login": "francisbouvier",
"committed_at": "2026-07-17T02:12:44Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "027936ef9082662b217ea41debec702fefeebb49",
"body": "After rebasing onto main, WPT\n/dom/events/Event-dispatch-single-activation-behavior.html went from\n3/132 to 0/0 (harness never reported): the test repeatedly clicks\n`<a href=\"#link\">` anchors and resets with `location.hash = \"\"`, and\nboth patterns ended up scheduling full same-URL reloads, putting t\n[…]\nignments.\n\nCoverage: /dom/events/Event-dispatch-single-activation-behavior.html\n0/0 -> 83/132 (3/132 before the rebase; the gain past 3 comes from\nthe handler-return-value fix in the previous commit).",
"is_bot": false,
"headline": "webapi: same-fragment navigations must not reload the page",
"author_name": "Francis Bouvier",
"author_login": "francisbouvier",
"committed_at": "2026-07-17T02:12:44Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "daa3b1d4513c125a8038822dfbce531b02e9282b",
"body": "After rebasing onto main (HttpClient refactor: queued navigations now\nreliably execute), WPT /dom/events/Event-dispatch-click.html went from\n33/33 to 0/0: its form subtests cancel submission with\n`form.onsubmit = () => { ...; return false }`, but the inline-handler\ninvocation discarded the return va\n[…]\nerage: /dom/events/Event-dispatch-click.html 0/0 -> 33/33\n(restores the previously claimed 33/33); also a prerequisite for\n/dom/events/Event-dispatch-single-activation-behavior.html (see next\ncommit).",
"is_bot": false,
"headline": "webapi: event handlers returning false cancel the event",
"author_name": "Francis Bouvier",
"author_login": "francisbouvier",
"committed_at": "2026-07-17T02:12:44Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "51607355082e6f03dcf70e2c5e8c63156050653d",
"body": "webapi: cookie-averse docs, script insertion steps, moveBefore reactions, outerText",
"is_bot": false,
"headline": "Merge pull request #2961 from lightpanda-io/dom-pr-20-html-elements",
"author_name": "Karl Seguin",
"author_login": "karlseguin",
"committed_at": "2026-07-17T02:09:25Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "f5ace3701f985fda50591dc1d31180225af3587a",
"body": "Free temp DocumentFragment when possible",
"is_bot": false,
"headline": "Improve gating around nodeIsReadySubtree to prevent unnecessary calls",
"author_name": "Karl Seguin",
"author_login": "karlseguin",
"committed_at": "2026-07-17T01:44:19Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "ef910479837a4936db824fd67cc237689232d091",
"body": "…ment\n\nfeat(cdp): emit Page.navigatedWithinDocument for same-document navigations",
"is_bot": false,
"headline": "Merge pull request #2964 from rohitsux/feat/cdp-navigated-within-docu…",
"author_name": "Karl Seguin",
"author_login": "karlseguin",
"committed_at": "2026-07-17T01:30:51Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "0e49d6f280d4eb75f1bc00ac35ae8a4125512ab5",
"body": "Move notification directly into history. Improve test.",
"is_bot": false,
"headline": "Remove unused timestamp field",
"author_name": "Karl Seguin",
"author_login": "karlseguin",
"committed_at": "2026-07-17T01:13:33Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "76717324510344574b3f63ddc6b504b4e1070758",
"body": "reject focus() on non-rendered elements (display:none)",
"is_bot": false,
"headline": "Merge pull request #2982 from lightpanda-io/focus-visible-only",
"author_name": "Karl Seguin",
"author_login": "karlseguin",
"committed_at": "2026-07-16T23:50:48Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "9205edb1f4dfd5da98b3834a6fa46e1631df000a",
"body": "perf: Pre-parse HTML to find and preload scripts",
"is_bot": false,
"headline": "Merge pull request #2965 from lightpanda-io/script-preload",
"author_name": "Karl Seguin",
"author_login": "karlseguin",
"committed_at": "2026-07-16T23:49:39Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "8d3bfeaa11da955a03ad8a1d9d80940fdbcabb42",
"body": "webapi: Add SharedWorker",
"is_bot": false,
"headline": "Merge pull request #2977 from lightpanda-io/SharedWorker",
"author_name": "Karl Seguin",
"author_login": "karlseguin",
"committed_at": "2026-07-16T23:49:19Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "0098b12fce050ceb56bdd1da5d70355cecb69ed6",
"body": "fix: Prevent class selector from doing substring match",
"is_bot": false,
"headline": "Merge pull request #2980 from lightpanda-io/class-selector-fix",
"author_name": "Karl Seguin",
"author_login": "karlseguin",
"committed_at": "2026-07-16T23:48:48Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "cb23ad7cbb98d7e00df61c5d9c2fc9eb7f159761",
"body": "…back\n\nFixes the failing subtest of WPT\n/dom/nodes/moveBefore/custom-element-move-reactions.html (5/6 -> 6/6):\nwhen a moved custom element defines no connectedMoveCallback, the\nfallback is disconnectedCallback + connectedCallback - and either may\nbe undefined. The error from invoking the missing dis\n[…]\nlerate a missing method and let the\nother one run.\n\nCoverage: /dom/nodes/moveBefore/custom-element-move-reactions.html\n5/6 -> 6/6 (fully green).\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "webapi: moveBefore fires connectedCallback without a disconnectedCall…",
"author_name": "Francis Bouvier",
"author_login": "francisbouvier",
"committed_at": "2026-07-16T23:47:50Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "d8bc0bacf26440d34c39121cbf5f19a83a5f27b0",
"body": "Fixes 10 failing files under /dom/nodes/insertion-removing-steps/\n(5/20 -> 15/20 files passing), which pin down when dynamically inserted\nscripts execute:\n\n- Scripts (and iframes/links/styles) appended to a DETACHED parent no\n longer activate; the ready work is gated on the node being connected,\n \n[…]\nad interleavings.\n\nCoverage: /dom/nodes/insertion-removing-steps/: 15/20 files passing\n(10 newly); /dom/nodes and /dom/events regressions clean.\n\nCo-Authored-By: Claude Fable 5 <noreply@anthropic.com>",
"is_bot": false,
"headline": "webapi: spec-conformant script insertion/execution steps",
"author_name": "Francis Bouvier",
"author_login": "francisbouvier",
"committed_at": "2026-07-16T23:47:50Z",
"body_truncated": true,
"is_coding_agent": true
}
],
"releases_count": 18,
"commits_last_year": 5823,
"latest_release_at": "2026-07-17T10:15:11Z",
"latest_release_tag": "0.3.5",
"releases_from_tags": false,
"days_since_last_push": 0,
"active_weeks_last_year": 51,
"days_since_latest_release": 5,
"mean_days_between_releases": 13.9
},
"community": {
"has_readme": true,
"has_license": true,
"has_description": true,
"has_contributing": true,
"health_percentage": 62,
"has_issue_template": false,
"has_code_of_conduct": false,
"has_pull_request_template": false
},
"ecosystem": {
"packages": []
},
"popularity": {
"forks": 1430,
"stars": 32085,
"watchers": 84,
"fork_history": {
"days": [
{
"date": "2026-03-13",
"count": 86
},
{
"date": "2026-03-14",
"count": 86
},
{
"date": "2026-03-15",
"count": 58
},
{
"date": "2026-03-16",
"count": 73
},
{
"date": "2026-03-17",
"count": 18
},
{
"date": "2026-03-18",
"count": 24
},
{
"date": "2026-03-19",
"count": 26
},
{
"date": "2026-03-20",
"count": 26
},
{
"date": "2026-03-21",
"count": 35
},
{
"date": "2026-03-22",
"count": 29
},
{
"date": "2026-03-23",
"count": 23
},
{
"date": "2026-03-24",
"count": 21
},
{
"date": "2026-03-25",
"count": 16
},
{
"date": "2026-03-26",
"count": 10
},
{
"date": "2026-03-27",
"count": 18
},
{
"date": "2026-03-28",
"count": 7
},
{
"date": "2026-03-29",
"count": 11
},
{
"date": "2026-03-30",
"count": 13
},
{
"date": "2026-03-31",
"count": 11
},
{
"date": "2026-04-01",
"count": 11
},
{
"date": "2026-04-02",
"count": 16
},
{
"date": "2026-04-03",
"count": 11
},
{
"date": "2026-04-04",
"count": 12
},
{
"date": "2026-04-05",
"count": 6
},
{
"date": "2026-04-06",
"count": 14
},
{
"date": "2026-04-07",
"count": 6
},
{
"date": "2026-04-08",
"count": 14
},
{
"date": "2026-04-09",
"count": 25
},
{
"date": "2026-04-10",
"count": 13
},
{
"date": "2026-04-11",
"count": 12
},
{
"date": "2026-04-12",
"count": 6
},
{
"date": "2026-04-13",
"count": 9
},
{
"date": "2026-04-14",
"count": 6
},
{
"date": "2026-04-15",
"count": 3
},
{
"date": "2026-04-16",
"count": 3
},
{
"date": "2026-04-17",
"count": 1
},
{
"date": "2026-04-18",
"count": 4
},
{
"date": "2026-04-19",
"count": 5
},
{
"date": "2026-04-20",
"count": 3
},
{
"date": "2026-04-21",
"count": 6
},
{
"date": "2026-04-22",
"count": 9
},
{
"date": "2026-04-23",
"count": 4
},
{
"date": "2026-04-24",
"count": 2
},
{
"date": "2026-04-25",
"count": 5
},
{
"date": "2026-04-26",
"count": 9
},
{
"date": "2026-04-27",
"count": 4
},
{
"date": "2026-04-28",
"count": 7
},
{
"date": "2026-04-29",
"count": 4
},
{
"date": "2026-04-30",
"count": 5
},
{
"date": "2026-05-01",
"count": 18
},
{
"date": "2026-05-02",
"count": 6
},
{
"date": "2026-05-03",
"count": 1
},
{
"date": "2026-05-04",
"count": 5
},
{
"date": "2026-05-05",
"count": 1
},
{
"date": "2026-05-06",
"count": 5
},
{
"date": "2026-05-07",
"count": 1
},
{
"date": "2026-05-08",
"count": 6
},
{
"date": "2026-05-09",
"count": 1
},
{
"date": "2026-05-10",
"count": 2
},
{
"date": "2026-05-11",
"count": 3
},
{
"date": "2026-05-13",
"count": 1
},
{
"date": "2026-05-14",
"count": 2
},
{
"date": "2026-05-15",
"count": 1
},
{
"date": "2026-05-16",
"count": 2
},
{
"date": "2026-05-17",
"count": 2
},
{
"date": "2026-05-18",
"count": 3
},
{
"date": "2026-05-19",
"count": 3
},
{
"date": "2026-05-20",
"count": 2
},
{
"date": "2026-05-21",
"count": 3
},
{
"date": "2026-05-22",
"count": 5
},
{
"date": "2026-05-23",
"count": 2
},
{
"date": "2026-05-24",
"count": 3
},
{
"date": "2026-05-25",
"count": 1
},
{
"date": "2026-05-26",
"count": 1
},
{
"date": "2026-05-27",
"count": 2
},
{
"date": "2026-05-28",
"count": 2
},
{
"date": "2026-05-30",
"count": 1
},
{
"date": "2026-05-31",
"count": 1
},
{
"date": "2026-06-01",
"count": 1
},
{
"date": "2026-06-02",
"count": 1
},
{
"date": "2026-06-03",
"count": 3
},
{
"date": "2026-06-04",
"count": 2
},
{
"date": "2026-06-10",
"count": 2
},
{
"date": "2026-06-12",
"count": 5
},
{
"date": "2026-06-14",
"count": 2
},
{
"date": "2026-06-15",
"count": 3
},
{
"date": "2026-06-16",
"count": 1
},
{
"date": "2026-06-17",
"count": 2
},
{
"date": "2026-06-18",
"count": 1
},
{
"date": "2026-06-19",
"count": 1
},
{
"date": "2026-06-20",
"count": 2
},
{
"date": "2026-06-21",
"count": 6
},
{
"date": "2026-06-24",
"count": 1
},
{
"date": "2026-06-26",
"count": 1
},
{
"date": "2026-06-27",
"count": 2
},
{
"date": "2026-06-28",
"count": 3
},
{
"date": "2026-06-29",
"count": 4
},
{
"date": "2026-06-30",
"count": 1
},
{
"date": "2026-07-01",
"count": 1
},
{
"date": "2026-07-02",
"count": 1
},
{
"date": "2026-07-04",
"count": 1
},
{
"date": "2026-07-06",
"count": 3
},
{
"date": "2026-07-07",
"count": 1
},
{
"date": "2026-07-09",
"count": 6
},
{
"date": "2026-07-10",
"count": 3
},
{
"date": "2026-07-11",
"count": 2
},
{
"date": "2026-07-13",
"count": 3
},
{
"date": "2026-07-14",
"count": 8
},
{
"date": "2026-07-15",
"count": 1
},
{
"date": "2026-07-16",
"count": 3
},
{
"date": "2026-07-17",
"count": 5
},
{
"date": "2026-07-18",
"count": 2
},
{
"date": "2026-07-20",
"count": 1
},
{
"date": "2026-07-21",
"count": 1
},
{
"date": "2026-07-22",
"count": 2
}
],
"complete": false,
"collected": 1000,
"total_forks": 1430
},
"star_history": null,
"open_issues_and_prs": 92
},
"ai_readiness": {
"has_nix": true,
"example_dirs": [],
"has_llms_txt": false,
"has_dockerfile": true,
"has_mcp_signal": false,
"bootstrap_files": [
"Makefile"
],
"api_schema_files": [],
"has_devcontainer": false,
"typecheck_configs": [],
"toolchain_manifests": [
"src/html5ever/Cargo.toml"
],
"largest_source_bytes": 28947,
"source_files_sampled": 74,
"oversized_source_files": 0,
"agent_instruction_files": [
"AGENTS.md",
"CLAUDE.md"
],
"agent_instruction_max_bytes": 1174
},
"dependencies": {
"manifests": [],
"advisories": {
"error": null,
"scope": "repository_graph",
"source": "osv",
"findings": [
{
"name": "paste",
"direct": false,
"version": "1.0.15",
"severity": "unknown",
"ecosystem": "crates",
"cvss_score": null,
"advisory_ids": [
"RUSTSEC-2024-0436"
],
"fixed_version": null,
"advisory_count": 1,
"oldest_advisory_days": 653
}
],
"collected": true,
"malicious": [],
"truncated": false,
"by_severity": {
"unknown": 1
},
"advisory_count": 1,
"affected_count": 1,
"assessed_count": 78,
"malicious_count": 0,
"assessed_package": null,
"unassessed_count": 0,
"direct_affected_count": 0
},
"ecosystems": [],
"dependencies": [
{
"name": "html5ever",
"manifest": "src/html5ever/Cargo.toml",
"ecosystem": "crates",
"version_constraint": "0.39.0"
},
{
"name": "string_cache",
"manifest": "src/html5ever/Cargo.toml",
"ecosystem": "crates",
"version_constraint": "0.9.0"
},
{
"name": "typed-arena",
"manifest": "src/html5ever/Cargo.toml",
"ecosystem": "crates",
"version_constraint": "2.0.2"
},
{
"name": "tikv-jemallocator",
"manifest": "src/html5ever/Cargo.toml",
"ecosystem": "crates",
"version_constraint": "0.6.1"
},
{
"name": "tikv-jemalloc-ctl",
"manifest": "src/html5ever/Cargo.toml",
"ecosystem": "crates",
"version_constraint": "0.6.1"
},
{
"name": "xml5ever",
"manifest": "src/html5ever/Cargo.toml",
"ecosystem": "crates",
"version_constraint": "0.39.0"
},
{
"name": "encoding_rs",
"manifest": "src/html5ever/Cargo.toml",
"ecosystem": "crates",
"version_constraint": "0.8"
},
{
"name": "idna",
"manifest": "src/html5ever/Cargo.toml",
"ecosystem": "crates",
"version_constraint": "1.1.0"
},
{
"name": "url",
"manifest": "src/html5ever/Cargo.toml",
"ecosystem": "crates",
"version_constraint": "2.5.8"
}
],
"all_dependencies": {
"error": null,
"source": "github-sbom",
"packages": [
{
"name": "encoding_rs",
"direct": true,
"version": "0.8.35",
"ecosystem": "crates"
},
{
"name": "html5ever",
"direct": true,
"version": "0.39.0",
"ecosystem": "crates"
},
{
"name": "idna",
"direct": true,
"version": "1.1.0",
"ecosystem": "crates"
},
{
"name": "string_cache",
"direct": true,
"version": "0.9.0",
"ecosystem": "crates"
},
{
"name": "tikv-jemalloc-ctl",
"direct": true,
"version": "0.6.1",
"ecosystem": "crates"
},
{
"name": "tikv-jemallocator",
"direct": true,
"version": "0.6.1",
"ecosystem": "crates"
},
{
"name": "typed-arena",
"direct": true,
"version": "2.0.2",
"ecosystem": "crates"
},
{
"name": "url",
"direct": true,
"version": "2.5.8",
"ecosystem": "crates"
},
{
"name": "xml5ever",
"direct": true,
"version": "0.39.0",
"ecosystem": "crates"
},
{
"name": "autocfg",
"direct": false,
"version": "1.4.0",
"ecosystem": "crates"
},
{
"name": "bitflags",
"direct": false,
"version": "2.9.1",
"ecosystem": "crates"
},
{
"name": "cc",
"direct": false,
"version": "1.2.39",
"ecosystem": "crates"
},
{
"name": "cfg-if",
"direct": false,
"version": "1.0.0",
"ecosystem": "crates"
},
{
"name": "displaydoc",
"direct": false,
"version": "0.2.6",
"ecosystem": "crates"
},
{
"name": "fastrand",
"direct": false,
"version": "2.4.1",
"ecosystem": "crates"
},
{
"name": "find-msvc-tools",
"direct": false,
"version": "0.1.2",
"ecosystem": "crates"
},
{
"name": "form_urlencoded",
"direct": false,
"version": "1.2.2",
"ecosystem": "crates"
},
{
"name": "icu_collections",
"direct": false,
"version": "2.2.0",
"ecosystem": "crates"
},
{
"name": "icu_locale_core",
"direct": false,
"version": "2.2.0",
"ecosystem": "crates"
},
{
"name": "icu_normalizer",
"direct": false,
"version": "2.2.0",
"ecosystem": "crates"
},
{
"name": "icu_normalizer_data",
"direct": false,
"version": "2.2.0",
"ecosystem": "crates"
},
{
"name": "icu_properties",
"direct": false,
"version": "2.2.0",
"ecosystem": "crates"
},
{
"name": "icu_properties_data",
"direct": false,
"version": "2.2.0",
"ecosystem": "crates"
},
{
"name": "icu_provider",
"direct": false,
"version": "2.2.0",
"ecosystem": "crates"
},
{
"name": "idna_adapter",
"direct": false,
"version": "1.2.2",
"ecosystem": "crates"
},
{
"name": "libc",
"direct": false,
"version": "0.2.172",
"ecosystem": "crates"
},
{
"name": "litemap",
"direct": false,
"version": "0.8.2",
"ecosystem": "crates"
},
{
"name": "lock_api",
"direct": false,
"version": "0.4.13",
"ecosystem": "crates"
},
{
"name": "log",
"direct": false,
"version": "0.4.27",
"ecosystem": "crates"
},
{
"name": "markup5ever",
"direct": false,
"version": "0.39.0",
"ecosystem": "crates"
},
{
"name": "new_debug_unreachable",
"direct": false,
"version": "1.0.6",
"ecosystem": "crates"
},
{
"name": "parking_lot",
"direct": false,
"version": "0.12.4",
"ecosystem": "crates"
},
{
"name": "parking_lot_core",
"direct": false,
"version": "0.9.11",
"ecosystem": "crates"
},
{
"name": "paste",
"direct": false,
"version": "1.0.15",
"ecosystem": "crates"
},
{
"name": "percent-encoding",
"direct": false,
"version": "2.3.2",
"ecosystem": "crates"
},
{
"name": "phf",
"direct": false,
"version": "0.13.1",
"ecosystem": "crates"
},
{
"name": "phf_codegen",
"direct": false,
"version": "0.13.1",
"ecosystem": "crates"
},
{
"name": "phf_generator",
"direct": false,
"version": "0.13.1",
"ecosystem": "crates"
},
{
"name": "phf_shared",
"direct": false,
"version": "0.13.1",
"ecosystem": "crates"
},
{
"name": "potential_utf",
"direct": false,
"version": "0.1.5",
"ecosystem": "crates"
},
{
"name": "precomputed-hash",
"direct": false,
"version": "0.1.1",
"ecosystem": "crates"
},
{
"name": "proc-macro2",
"direct": false,
"version": "1.0.95",
"ecosystem": "crates"
},
{
"name": "quote",
"direct": false,
"version": "1.0.45",
"ecosystem": "crates"
},
{
"name": "redox_syscall",
"direct": false,
"version": "0.5.12",
"ecosystem": "crates"
},
{
"name": "scopeguard",
"direct": false,
"version": "1.2.0",
"ecosystem": "crates"
},
{
"name": "serde",
"direct": false,
"version": "1.0.219",
"ecosystem": "crates"
},
{
"name": "serde_derive",
"direct": false,
"version": "1.0.219",
"ecosystem": "crates"
},
{
"name": "shlex",
"direct": false,
"version": "1.3.0",
"ecosystem": "crates"
},
{
"name": "siphasher",
"direct": false,
"version": "1.0.1",
"ecosystem": "crates"
},
{
"name": "smallvec",
"direct": false,
"version": "1.15.1",
"ecosystem": "crates"
},
{
"name": "stable_deref_trait",
"direct": false,
"version": "1.2.1",
"ecosystem": "crates"
},
{
"name": "string_cache_codegen",
"direct": false,
"version": "0.6.1",
"ecosystem": "crates"
},
{
"name": "syn",
"direct": false,
"version": "2.0.101",
"ecosystem": "crates"
},
{
"name": "synstructure",
"direct": false,
"version": "0.13.2",
"ecosystem": "crates"
},
{
"name": "tendril",
"direct": false,
"version": "0.5.0",
"ecosystem": "crates"
},
{
"name": "tikv-jemalloc-sys",
"direct": false,
"version": "0.6.1+5.3.0-1-ge13ca993e8ccb9ba9847cc330696e02839f328f7",
"ecosystem": "crates"
},
{
"name": "tinystr",
"direct": false,
"version": "0.8.3",
"ecosystem": "crates"
},
{
"name": "unicode-ident",
"direct": false,
"version": "1.0.18",
"ecosystem": "crates"
},
{
"name": "utf-8",
"direct": false,
"version": "0.7.6",
"ecosystem": "crates"
},
{
"name": "utf8_iter",
"direct": false,
"version": "1.0.4",
"ecosystem": "crates"
},
{
"name": "web_atoms",
"direct": false,
"version": "0.2.3",
"ecosystem": "crates"
},
{
"name": "windows-targets",
"direct": false,
"version": "0.52.6",
"ecosystem": "crates"
},
{
"name": "windows_aarch64_gnullvm",
"direct": false,
"version": "0.52.6",
"ecosystem": "crates"
},
{
"name": "windows_aarch64_msvc",
"direct": false,
"version": "0.52.6",
"ecosystem": "crates"
},
{
"name": "windows_i686_gnu",
"direct": false,
"version": "0.52.6",
"ecosystem": "crates"
},
{
"name": "windows_i686_gnullvm",
"direct": false,
"version": "0.52.6",
"ecosystem": "crates"
},
{
"name": "windows_i686_msvc",
"direct": false,
"version": "0.52.6",
"ecosystem": "crates"
},
{
"name": "windows_x86_64_gnu",
"direct": false,
"version": "0.52.6",
"ecosystem": "crates"
},
{
"name": "windows_x86_64_gnullvm",
"direct": false,
"version": "0.52.6",
"ecosystem": "crates"
},
{
"name": "windows_x86_64_msvc",
"direct": false,
"version": "0.52.6",
"ecosystem": "crates"
},
{
"name": "writeable",
"direct": false,
"version": "0.6.3",
"ecosystem": "crates"
},
{
"name": "yoke",
"direct": false,
"version": "0.8.2",
"ecosystem": "crates"
},
{
"name": "yoke-derive",
"direct": false,
"version": "0.8.2",
"ecosystem": "crates"
},
{
"name": "zerofrom",
"direct": false,
"version": "0.1.8",
"ecosystem": "crates"
},
{
"name": "zerofrom-derive",
"direct": false,
"version": "0.1.7",
"ecosystem": "crates"
},
{
"name": "zerotrie",
"direct": false,
"version": "0.2.4",
"ecosystem": "crates"
},
{
"name": "zerovec",
"direct": false,
"version": "0.11.6",
"ecosystem": "crates"
},
{
"name": "zerovec-derive",
"direct": false,
"version": "0.11.3",
"ecosystem": "crates"
}
],
"collected": true,
"truncated": false,
"total_count": 78,
"direct_count": 9,
"indirect_count": 69
}
},
"maintainership": {
"issues": {
"open_prs": 22,
"merged_prs": 2327,
"open_issues": 70,
"closed_ratio": 0.855,
"closed_issues": 412,
"closed_unmerged_prs": 196
},
"bus_factor": 2,
"bot_contributors": 0,
"top_contributors": [
{
"type": "User",
"login": "karlseguin",
"commits": 3311,
"avatar_url": "https://avatars.githubusercontent.com/u/206480?v=4"
},
{
"type": "User",
"login": "krichprollsch",
"commits": 2080,
"avatar_url": "https://avatars.githubusercontent.com/u/562696?v=4"
},
{
"type": "User",
"login": "arrufat",
"commits": 1042,
"avatar_url": "https://avatars.githubusercontent.com/u/1671644?v=4"
},
{
"type": "User",
"login": "francisbouvier",
"commits": 475,
"avatar_url": "https://avatars.githubusercontent.com/u/5114029?v=4"
},
{
"type": "User",
"login": "nikneym",
"commits": 373,
"avatar_url": "https://avatars.githubusercontent.com/u/4337696?v=4"
},
{
"type": "User",
"login": "mookums",
"commits": 367,
"avatar_url": "https://avatars.githubusercontent.com/u/26614015?v=4"
},
{
"type": "User",
"login": "sjorsdonkers",
"commits": 146,
"avatar_url": "https://avatars.githubusercontent.com/u/72333389?v=4"
},
{
"type": "User",
"login": "navidemad",
"commits": 127,
"avatar_url": "https://avatars.githubusercontent.com/u/6686865?v=4"
},
{
"type": "User",
"login": "mrdimidium",
"commits": 81,
"avatar_url": "https://avatars.githubusercontent.com/u/24303010?v=4"
},
{
"type": "User",
"login": "egrs",
"commits": 67,
"avatar_url": "https://avatars.githubusercontent.com/u/28808383?v=4"
}
],
"contributors_sampled": 56,
"top_contributor_share": 0.402
},
"quality_signals": {
"has_ci": true,
"has_tests": true,
"ci_workflows": [
"agent-regression.yml",
"cla.yml",
"e2e-integration-test.yml",
"e2e-test.yml",
"package-debian.yml",
"plumber.yml",
"release.yml",
"wpt.yml",
"zig-test.yml"
],
"has_docs_dir": false,
"linter_configs": [],
"has_editorconfig": false,
"has_linter_config": false,
"has_precommit_config": false
},
"security_signals": {
"lockfiles": [
"Cargo.lock"
],
"scorecard": {
"checks": [
{
"name": "Binary-Artifacts",
"score": 10,
"reason": "no binaries found in the repo",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#binary-artifacts"
},
{
"name": "Branch-Protection",
"score": null,
"reason": "internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#branch-protection"
},
{
"name": "CI-Tests",
"score": 10,
"reason": "13 out of 13 merged PRs checked by a CI test -- score normalized to 10",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#ci-tests"
},
{
"name": "CII-Best-Practices",
"score": 0,
"reason": "no effort to earn an OpenSSF best practices badge detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#cii-best-practices"
},
{
"name": "Code-Review",
"score": 6,
"reason": "Found 9/13 approved changesets -- score normalized to 6",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#code-review"
},
{
"name": "Contributors",
"score": 10,
"reason": "project has 13 contributing companies or organizations",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#contributors"
},
{
"name": "Dangerous-Workflow",
"score": 10,
"reason": "no dangerous workflow patterns detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dangerous-workflow"
},
{
"name": "Dependency-Update-Tool",
"score": 0,
"reason": "no update tool detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dependency-update-tool"
},
{
"name": "Fuzzing",
"score": 0,
"reason": "project is not fuzzed",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#fuzzing"
},
{
"name": "License",
"score": 10,
"reason": "license file detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#license"
},
{
"name": "Maintained",
"score": 10,
"reason": "30 commit(s) and 12 issue activity found in the last 90 days -- score normalized to 10",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#maintained"
},
{
"name": "Packaging",
"score": null,
"reason": "packaging workflow not detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#packaging"
},
{
"name": "Pinned-Dependencies",
"score": 7,
"reason": "dependency not pinned by hash detected -- score normalized to 7",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#pinned-dependencies"
},
{
"name": "SAST",
"score": 6,
"reason": "SAST tool is not run on all commits -- score normalized to 6",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#sast"
},
{
"name": "Security-Policy",
"score": 9,
"reason": "security policy file detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#security-policy"
},
{
"name": "Signed-Releases",
"score": 0,
"reason": "Project has not signed or included provenance with any releases.",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#signed-releases"
},
{
"name": "Token-Permissions",
"score": 0,
"reason": "detected GitHub workflow tokens with excessive permissions",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#token-permissions"
},
{
"name": "Vulnerabilities",
"score": 9,
"reason": "1 existing vulnerabilities detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#vulnerabilities"
}
],
"commit": "a50c38b67220f9198343c0fbbb8ff13a9558414b",
"ran_at": "2026-07-23T08:50:38Z",
"aggregate_score": 5.9,
"scorecard_version": "v5.5.0"
},
"has_codeql_workflow": false,
"has_security_policy": true,
"has_dependabot_config": false
},
"contribution_flow": {
"collected": true,
"ci_last_run_at": "2026-07-23T07:06:05Z",
"oldest_open_prs": [
{
"number": 2303,
"created_at": "2026-04-28T16:51:55Z",
"last_comment_at": "2026-05-05T02:08:19Z",
"last_comment_author": "karlseguin"
},
{
"number": 2423,
"created_at": "2026-05-11T16:06:44Z",
"last_comment_at": "2026-07-21T07:38:24Z",
"last_comment_author": "maifeeulasad"
},
{
"number": 2631,
"created_at": "2026-06-03T15:36:21Z",
"last_comment_at": "2026-07-21T03:39:20Z",
"last_comment_author": "karlseguin"
},
{
"number": 2645,
"created_at": "2026-06-04T22:42:29Z",
"last_comment_at": "2026-06-25T20:36:48Z",
"last_comment_author": "urly3"
},
{
"number": 2891,
"created_at": "2026-07-06T09:28:01Z",
"last_comment_at": "2026-07-09T03:05:23Z",
"last_comment_author": "karlseguin"
},
{
"number": 2899,
"created_at": "2026-07-08T09:01:41Z",
"last_comment_at": null,
"last_comment_author": null
},
{
"number": 2969,
"created_at": "2026-07-15T11:44:45Z",
"last_comment_at": "2026-07-19T23:42:34Z",
"last_comment_author": "karlseguin"
},
{
"number": 2983,
"created_at": "2026-07-17T10:04:27Z",
"last_comment_at": null,
"last_comment_author": null
},
{
"number": 3002,
"created_at": "2026-07-20T13:45:11Z",
"last_comment_at": null,
"last_comment_author": null
},
{
"number": 3004,
"created_at": "2026-07-20T16:39:06Z",
"last_comment_at": "2026-07-23T00:52:36Z",
"last_comment_author": "mvanhorn"
},
{
"number": 3008,
"created_at": "2026-07-21T16:52:04Z",
"last_comment_at": null,
"last_comment_author": null
},
{
"number": 3015,
"created_at": "2026-07-22T07:02:31Z",
"last_comment_at": null,
"last_comment_author": null
},
{
"number": 3019,
"created_at": "2026-07-22T11:42:08Z",
"last_comment_at": null,
"last_comment_author": null
},
{
"number": 3028,
"created_at": "2026-07-22T17:24:51Z",
"last_comment_at": null,
"last_comment_author": null
},
{
"number": 3029,
"created_at": "2026-07-23T01:14:04Z",
"last_comment_at": null,
"last_comment_author": null
},
{
"number": 3030,
"created_at": "2026-07-23T01:14:04Z",
"last_comment_at": null,
"last_comment_author": null
},
{
"number": 3032,
"created_at": "2026-07-23T01:14:04Z",
"last_comment_at": null,
"last_comment_author": null
},
{
"number": 3031,
"created_at": "2026-07-23T01:14:04Z",
"last_comment_at": null,
"last_comment_author": null
},
{
"number": 3033,
"created_at": "2026-07-23T01:14:04Z",
"last_comment_at": null,
"last_comment_author": null
},
{
"number": 3034,
"created_at": "2026-07-23T01:14:04Z",
"last_comment_at": "2026-07-23T02:45:16Z",
"last_comment_author": "mh0pe"
}
],
"last_merged_pr_at": "2026-07-23T04:43:56Z",
"ci_last_conclusion": "SUCCESS",
"oldest_open_issues": [
{
"number": 37,
"created_at": "2023-09-27T16:04:42Z",
"last_comment_at": null,
"last_comment_author": null
},
{
"number": 29,
"created_at": "2023-09-27T16:26:26Z",
"last_comment_at": "2025-09-27T19:11:43Z",
"last_comment_author": "mrdimidium"
},
{
"number": 349,
"created_at": "2025-01-08T10:32:29Z",
"last_comment_at": "2026-02-05T06:39:25Z",
"last_comment_author": "karlseguin"
},
{
"number": 362,
"created_at": "2025-01-17T18:30:01Z",
"last_comment_at": "2025-02-12T22:44:34Z",
"last_comment_author": "spidy0x0"
},
{
"number": 375,
"created_at": "2025-01-23T15:44:48Z",
"last_comment_at": "2025-01-25T09:57:30Z",
"last_comment_author": "itziklavon"
},
{
"number": 382,
"created_at": "2025-01-27T06:41:22Z",
"last_comment_at": "2025-01-27T14:50:44Z",
"last_comment_author": "krichprollsch"
},
{
"number": 385,
"created_at": "2025-01-27T14:53:41Z",
"last_comment_at": null,
"last_comment_author": null
},
{
"number": 386,
"created_at": "2025-01-27T14:54:59Z",
"last_comment_at": null,
"last_comment_author": null
},
{
"number": 561,
"created_at": "2025-04-23T10:45:11Z",
"last_comment_at": "2025-04-25T17:23:31Z",
"last_comment_author": "mikeptweet"
},
{
"number": 565,
"created_at": "2025-04-24T03:19:39Z",
"last_comment_at": null,
"last_comment_author": null
},
{
"number": 576,
"created_at": "2025-04-25T23:29:01Z",
"last_comment_at": null,
"last_comment_author": null
},
{
"number": 736,
"created_at": "2025-06-01T07:38:57Z",
"last_comment_at": "2025-06-23T17:09:45Z",
"last_comment_author": "krichprollsch"
},
{
"number": 783,
"created_at": "2025-06-16T09:01:41Z",
"last_comment_at": null,
"last_comment_author": null
},
{
"number": 882,
"created_at": "2025-07-11T12:19:58Z",
"last_comment_at": "2025-07-11T18:11:24Z",
"last_comment_author": "pixelkoduje"
},
{
"number": 925,
"created_at": "2025-08-06T00:47:16Z",
"last_comment_at": null,
"last_comment_author": null
},
{
"number": 967,
"created_at": "2025-08-24T07:33:11Z",
"last_comment_at": "2025-09-22T09:24:41Z",
"last_comment_author": "krichprollsch"
},
{
"number": 1095,
"created_at": "2025-09-27T08:17:18Z",
"last_comment_at": "2025-11-19T12:57:45Z",
"last_comment_author": "krichprollsch"
},
{
"number": 1096,
"created_at": "2025-09-28T19:51:55Z",
"last_comment_at": "2026-03-17T16:21:23Z",
"last_comment_author": "mrdimidium"
},
{
"number": 1177,
"created_at": "2025-10-24T11:01:15Z",
"last_comment_at": "2025-10-27T14:45:44Z",
"last_comment_author": "superphao"
},
{
"number": 1179,
"created_at": "2025-10-25T19:17:50Z",
"last_comment_at": "2025-10-27T22:52:50Z",
"last_comment_author": "mrdimidium"
}
]
}
},
"config": {
"disabled_metrics": [],
"disabled_categories": [],
"disabled_components": {}
},
"source": {
"url": "https://github.com/lightpanda-io/browser",
"host": "github.com",
"name": "browser",
"owner": "lightpanda-io"
},
"metrics": {
"overall": {
"key": "overall",
"band": "good",
"name": "Overall health",
"note": null,
"notes": [],
"value": 77,
"inputs": {
"security": 67,
"vitality": 95,
"community": 84,
"governance": 70,
"engineering": 67
},
"components": []
},
"categories": [
{
"key": "vitality",
"band": "excellent",
"name": "Vitality",
"value": 95,
"weight": 0.22,
"metrics": [
{
"key": "development_activity",
"band": "excellent",
"name": "Development activity",
"note": null,
"notes": [],
"value": 99,
"inputs": {
"commits_last_year": 5823,
"human_commit_share": 1,
"days_since_last_push": 0,
"active_weeks_last_year": 51
},
"components": [
{
"key": "push_recency",
"name": "Push recency",
"detail": "last push 0 days ago",
"points": 36,
"status": "met",
"details": [
{
"code": "push_recency",
"params": {
"days": 0
}
}
],
"max_points": 36
},
{
"key": "commit_cadence",
"name": "Commit cadence",
"detail": "51/52 weeks with commits",
"points": 35.3,
"status": "partial",
"details": [
{
"code": "commit_cadence_weeks",
"params": {
"weeks": 51
}
}
],
"max_points": 36
},
{
"key": "commit_volume",
"name": "Commit volume",
"detail": "5823 commits in the last year",
"points": 18,
"status": "met",
"details": [
{
"code": "commits_last_year",
"params": {
"count": 5823
}
}
],
"max_points": 18
},
{
"key": "openssf_scorecard_maintained",
"name": "OpenSSF Scorecard: Maintained",
"detail": "30 commit(s) and 12 issue activity found in the last 90 days -- score normalized to 10",
"points": 10,
"status": "met",
"details": [],
"max_points": 10
}
]
},
{
"key": "release_discipline",
"band": "excellent",
"name": "Release discipline",
"note": null,
"notes": [],
"value": 90,
"inputs": {
"releases_count": 18,
"latest_release_tag": "0.3.5",
"releases_from_tags": false,
"days_since_latest_release": 5,
"mean_days_between_releases": 13.9
},
"components": [
{
"key": "ships_releases",
"name": "Ships releases",
"detail": "18 releases published",
"points": 27,
"status": "met",
"details": [
{
"code": "releases_published",
"params": {
"count": 18
}
}
],
"max_points": 27
},
{
"key": "release_recency",
"name": "Release recency",
"detail": "latest release 5 days ago",
"points": 36,
"status": "met",
"details": [
{
"code": "release_recency",
"params": {
"days": 5
}
}
],
"max_points": 36
},
{
"key": "release_cadence",
"name": "Release cadence",
"detail": "a release every ~13.9 days",
"points": 27,
"status": "met",
"details": [
{
"code": "release_cadence",
"params": {
"gap": 13.9
}
}
],
"max_points": 27
},
{
"key": "openssf_scorecard_signed_releases",
"name": "OpenSSF Scorecard: Signed-Releases",
"detail": "Project has not signed or included provenance with any releases.",
"points": 0,
"status": "missed",
"details": [],
"max_points": 10
}
]
},
{
"key": "abandonment",
"band": "excellent",
"name": "Abandonment",
"note": null,
"notes": [],
"value": 100,
"inputs": {
"cap": null,
"state": "maintained",
"guards": [],
"signals": [],
"red_flag": false,
"multiplier_pct": 100,
"declared_reason": null,
"unverified_reason": null,
"unanswered_open_prs": null,
"unanswered_open_issues": null,
"days_since_last_merged_pr": null,
"days_since_last_human_commit": 0,
"days_since_last_human_commit_is_floor": false
},
"components": [
{
"key": "project_is_still_maintained",
"name": "Project is still maintained",
"detail": "last human commit 0 days ago",
"points": 100,
"status": "met",
"details": [
{
"code": "abandonment_maintained",
"params": {
"days": 0
}
}
],
"max_points": 100
}
]
}
],
"description": "Is the project alive — is code being written and are releases shipping?"
},
{
"key": "community",
"band": "good",
"name": "Community & Adoption",
"value": 84,
"weight": 0.18,
"metrics": [
{
"key": "popularity",
"band": "excellent",
"name": "Popularity & adoption",
"note": null,
"notes": [],
"value": 96,
"inputs": {
"forks": 1430,
"stars": 32085,
"watchers": 84,
"growth_state": "unverified",
"growth_factor_pct": 100,
"growth_unverified_reason": "no_history"
},
"components": [
{
"key": "stars",
"name": "Stars",
"detail": "32,085 stars",
"points": 60,
"status": "met",
"details": [
{
"code": "stars",
"params": {
"count": 32085
}
}
],
"max_points": 60
},
{
"key": "forks",
"name": "Forks",
"detail": "1,430 forks",
"points": 25,
"status": "met",
"details": [
{
"code": "forks",
"params": {
"count": 1430
}
}
],
"max_points": 25
},
{
"key": "watchers",
"name": "Watchers",
"detail": "84 watchers",
"points": 10.7,
"status": "partial",
"details": [
{
"code": "watchers",
"params": {
"count": 84
}
}
],
"max_points": 15
}
]
},
{
"key": "community_health",
"band": "good",
"name": "Community health",
"note": null,
"notes": [],
"value": 70,
"inputs": {
"has_readme": true,
"has_license": true,
"has_contributing": true,
"has_issue_template": false,
"has_code_of_conduct": false,
"has_pull_request_template": false
},
"components": [
{
"key": "readme",
"name": "README",
"detail": null,
"points": 22.5,
"status": "met",
"details": [],
"max_points": 22.5
},
{
"key": "license",
"name": "License",
"detail": "recognized license (AGPL-3.0)",
"points": 22.5,
"status": "met",
"details": [
{
"code": "license_standard",
"params": {}
},
{
"code": "license_spdx",
"params": {
"spdx": "AGPL-3.0"
}
}
],
"max_points": 22.5
},
{
"key": "contributing_guide",
"name": "CONTRIBUTING guide",
"detail": null,
"points": 18,
"status": "met",
"details": [],
"max_points": 18
},
{
"key": "code_of_conduct",
"name": "Code of conduct",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 13.5
},
{
"key": "issue_template",
"name": "Issue template",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.2
},
{
"key": "pr_template",
"name": "PR template",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 6.3
}
]
}
],
"description": "Does the project have users, downloads, attention, and a welcoming setup for contributors?"
},
{
"key": "governance",
"band": "good",
"name": "Sustainability & Governance",
"value": 70,
"weight": 0.24,
"metrics": [
{
"key": "maintainer_resilience",
"band": "moderate",
"name": "Maintainer resilience (bus factor)",
"note": null,
"notes": [],
"value": 62,
"inputs": {
"bus_factor": 2,
"contributors_sampled": 56,
"top_contributor_share": 0.402
},
"components": [
{
"key": "bus_factor",
"name": "Bus factor",
"detail": "2 contributor(s) cover half of all commits",
"points": 25.2,
"status": "partial",
"details": [
{
"code": "bus_factor",
"params": {
"count": 2
}
}
],
"max_points": 54
},
{
"key": "commit_distribution",
"name": "Commit distribution",
"detail": "top contributor authored 40% of commits",
"points": 13.5,
"status": "partial",
"details": [
{
"code": "top_contributor_share",
"params": {
"share": 40
}
}
],
"max_points": 22.5
},
{
"key": "contributor_breadth",
"name": "Contributor breadth",
"detail": "56 contributors",
"points": 13.5,
"status": "met",
"details": [
{
"code": "contributors_sampled",
"params": {
"count": 56
}
}
],
"max_points": 13.5
},
{
"key": "openssf_scorecard_contributors",
"name": "OpenSSF Scorecard: Contributors",
"detail": "project has 13 contributing companies or organizations",
"points": 10,
"status": "met",
"details": [],
"max_points": 10
}
]
},
{
"key": "responsiveness",
"band": "good",
"name": "Issue & PR responsiveness",
"note": null,
"notes": [],
"value": 84,
"inputs": {
"merged_prs": 2327,
"open_issues": 70,
"closed_issues": 412,
"issue_closed_ratio": 0.855,
"closed_unmerged_prs": 196
},
"components": [
{
"key": "issue_resolution",
"name": "Issue resolution",
"detail": "86% of issues closed",
"points": 40,
"status": "partial",
"details": [
{
"code": "issues_closed_share",
"params": {
"share": 86
}
}
],
"max_points": 46.75
},
{
"key": "pr_acceptance",
"name": "PR acceptance",
"detail": "2327/2523 decided PRs merged",
"points": 35.3,
"status": "partial",
"details": [
{
"code": "decided_prs_merged",
"params": {
"merged": 2327,
"decided": 2523
}
}
],
"max_points": 38.25
},
{
"key": "openssf_scorecard_code_review",
"name": "OpenSSF Scorecard: Code-Review",
"detail": "Found 9/13 approved changesets -- score normalized to 6",
"points": 9,
"status": "partial",
"details": [],
"max_points": 15
}
]
},
{
"key": "stewardship",
"band": "moderate",
"name": "Ownership & stewardship",
"note": null,
"notes": [],
"value": 65,
"inputs": {
"followers": 361,
"owner_type": "Organization",
"is_verified": null,
"owner_login": "lightpanda-io",
"public_repos": 32,
"account_age_days": 1031
},
"components": [
{
"key": "ownership_backing",
"name": "Ownership backing",
"detail": "organization-owned",
"points": 30,
"status": "met",
"details": [
{
"code": "owner_organization",
"params": {}
}
],
"max_points": 30
},
{
"key": "verified_domain",
"name": "Verified domain",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 20
},
{
"key": "owner_reach",
"name": "Owner reach",
"detail": "361 followers of lightpanda-io",
"points": 18.4,
"status": "partial",
"details": [
{
"code": "owner_followers",
"params": {
"count": 361,
"login": "lightpanda-io"
}
}
],
"max_points": 25
},
{
"key": "track_record",
"name": "Track record",
"detail": "32 public repos, account ~2 yr old",
"points": 16.7,
"status": "partial",
"details": [
{
"code": "public_repos",
"params": {
"count": 32
}
},
{
"code": "account_age_years",
"params": {
"years": 2
}
}
],
"max_points": 25
}
]
}
],
"description": "Will the project survive its people — bus factor, responsiveness, who backs it, and package upkeep?"
},
{
"key": "engineering",
"band": "moderate",
"name": "Engineering Quality",
"value": 67,
"weight": 0.2,
"metrics": [
{
"key": "engineering_practices",
"band": "moderate",
"name": "Engineering practices",
"note": null,
"notes": [],
"value": 68,
"inputs": {
"has_ci": true,
"has_tests": true,
"has_editorconfig": false,
"has_linter_config": false,
"has_precommit_config": false
},
"components": [
{
"key": "ci_workflows",
"name": "CI workflows",
"detail": "9 workflow(s)",
"points": 24,
"status": "met",
"details": [
{
"code": "ci_workflows",
"params": {
"count": 9
}
}
],
"max_points": 24
},
{
"key": "tests_present",
"name": "Tests present",
"detail": null,
"points": 24,
"status": "met",
"details": [],
"max_points": 24
},
{
"key": "linter_config",
"name": "Linter config",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 16
},
{
"key": "pre_commit_hooks",
"name": "Pre-commit hooks",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 9.6
},
{
"key": "editorconfig",
"name": ".editorconfig",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 6.4
},
{
"key": "openssf_scorecard_ci_tests",
"name": "OpenSSF Scorecard: CI-Tests",
"detail": "13 out of 13 merged PRs checked by a CI test -- score normalized to 10",
"points": 20,
"status": "met",
"details": [],
"max_points": 20
}
]
},
{
"key": "documentation",
"band": "moderate",
"name": "Documentation",
"note": null,
"notes": [],
"value": 65,
"inputs": {
"topics": [
"browser",
"cdp",
"headless",
"playwright",
"puppeteer",
"zig",
"browser-automation",
"lightpanda"
],
"has_wiki": false,
"homepage": "https://lightpanda.io",
"has_readme": true,
"has_docs_dir": false,
"has_description": true
},
"components": [
{
"key": "readme",
"name": "README",
"detail": null,
"points": 30,
"status": "met",
"details": [],
"max_points": 30
},
{
"key": "documentation_directory",
"name": "Documentation directory",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 25
},
{
"key": "documentation_homepage_site",
"name": "Documentation / homepage site",
"detail": "https://lightpanda.io",
"points": 15,
"status": "met",
"details": [],
"max_points": 15
},
{
"key": "repository_description",
"name": "Repository description",
"detail": null,
"points": 10,
"status": "met",
"details": [],
"max_points": 10
},
{
"key": "topics",
"name": "Topics",
"detail": "8 topics",
"points": 10,
"status": "met",
"details": [
{
"code": "topics_count",
"params": {
"count": 8
}
}
],
"max_points": 10
},
{
"key": "wiki",
"name": "Wiki",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 10
}
]
}
],
"description": "Are baseline engineering and documentation practices in place?"
},
{
"key": "security",
"band": "moderate",
"name": "Security",
"value": 67,
"weight": 0.16,
"metrics": [
{
"key": "security_posture",
"band": "moderate",
"name": "Security posture",
"note": "Excluded from scoring (no data or not applicable): Branch-Protection, Packaging. Remaining weights renormalized.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"branch_protection",
"packaging"
]
}
},
{
"code": "weights_renormalized",
"params": {}
}
],
"value": 59,
"inputs": {
"source": "openssf_scorecard",
"checks_evaluated": 16,
"scorecard_version": "v5.5.0",
"checks_inconclusive": 2,
"scorecard_aggregate": 5.9
},
"components": [
{
"key": "binary_artifacts",
"name": "Binary-Artifacts",
"detail": "no binaries found in the repo",
"points": 7.5,
"status": "met",
"details": [],
"max_points": 7.5
},
{
"key": "branch_protection",
"name": "Branch-Protection",
"detail": "internal error: error during branchesHandler.setup: internal error: some github tokens can't read classic branch protection rules: https://github.com/ossf/scorecard-action/blob/main/docs/authentication/fine-grained-auth-token.md",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_data",
"params": {}
}
],
"max_points": 7.5
},
{
"key": "ci_tests",
"name": "CI-Tests",
"detail": "13 out of 13 merged PRs checked by a CI test -- score normalized to 10",
"points": 2.5,
"status": "met",
"details": [],
"max_points": 2.5
},
{
"key": "cii_best_practices",
"name": "CII-Best-Practices",
"detail": "no effort to earn an OpenSSF best practices badge detected",
"points": 0,
"status": "missed",
"details": [],
"max_points": 2.5
},
{
"key": "code_review",
"name": "Code-Review",
"detail": "Found 9/13 approved changesets -- score normalized to 6",
"points": 4.5,
"status": "partial",
"details": [],
"max_points": 7.5
},
{
"key": "contributors",
"name": "Contributors",
"detail": "project has 13 contributing companies or organizations",
"points": 2.5,
"status": "met",
"details": [],
"max_points": 2.5
},
{
"key": "dangerous_workflow",
"name": "Dangerous-Workflow",
"detail": "no dangerous workflow patterns detected",
"points": 10,
"status": "met",
"details": [],
"max_points": 10
},
{
"key": "dependency_update_tool",
"name": "Dependency-Update-Tool",
"detail": "no update tool detected",
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.5
},
{
"key": "fuzzing",
"name": "Fuzzing",
"detail": "project is not fuzzed",
"points": 0,
"status": "missed",
"details": [],
"max_points": 5
},
{
"key": "license",
"name": "License",
"detail": "license file detected",
"points": 2.5,
"status": "met",
"details": [],
"max_points": 2.5
},
{
"key": "maintained",
"name": "Maintained",
"detail": "30 commit(s) and 12 issue activity found in the last 90 days -- score normalized to 10",
"points": 7.5,
"status": "met",
"details": [],
"max_points": 7.5
},
{
"key": "packaging",
"name": "Packaging",
"detail": "packaging workflow not detected",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_data",
"params": {}
}
],
"max_points": 5
},
{
"key": "pinned_dependencies",
"name": "Pinned-Dependencies",
"detail": "dependency not pinned by hash detected -- score normalized to 7",
"points": 3.5,
"status": "partial",
"details": [],
"max_points": 5
},
{
"key": "sast",
"name": "SAST",
"detail": "SAST tool is not run on all commits -- score normalized to 6",
"points": 3,
"status": "partial",
"details": [],
"max_points": 5
},
{
"key": "security_policy",
"name": "Security-Policy",
"detail": "security policy file detected",
"points": 4.5,
"status": "partial",
"details": [],
"max_points": 5
},
{
"key": "signed_releases",
"name": "Signed-Releases",
"detail": "Project has not signed or included provenance with any releases.",
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.5
},
{
"key": "token_permissions",
"name": "Token-Permissions",
"detail": "detected GitHub workflow tokens with excessive permissions",
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.5
},
{
"key": "vulnerabilities",
"name": "Vulnerabilities",
"detail": "1 existing vulnerabilities detected",
"points": 6.8,
"status": "partial",
"details": [],
"max_points": 7.5
}
]
},
{
"key": "dependency_advisories",
"band": "excellent",
"name": "Dependency advisories",
"note": "Excluded from scoring (no data or not applicable): Indirect dependencies free of known advisories, No advisories left outstanding. Remaining weights renormalized. Matched 78 resolved dependencies against OSV. This repository publishes no package the index resolves, so the repository dependency graph was assessed instead. That graph mixes development and test pins with shipped dependencies, so only the declared runtime dependencies are scored; transitive findings are reported as context and excluded from the score. Reachability is not analyzed.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"indirect_dependencies_free_of_known_advisories",
"no_advisories_left_outstanding"
]
}
},
{
"code": "weights_renormalized",
"params": {}
},
{
"code": "advisories_scope_repository",
"params": {
"assessed": 78
}
},
{
"code": "advisories_repo_graph_caveat",
"params": {}
},
{
"code": "advisories_reachability",
"params": {}
}
],
"value": 100,
"inputs": {
"source": "osv",
"advisories": 1,
"affected_packages": 1,
"assessed_packages": 78,
"unassessed_packages": 0,
"affected_by_severity": "unknown 1",
"direct_affected_packages": 0
},
"components": [
{
"key": "direct_dependencies_free_of_known_advisories",
"name": "Direct dependencies free of known advisories",
"detail": "no direct dependency carries a known advisory",
"points": 35,
"status": "met",
"details": [
{
"code": "no_direct_advisories",
"params": {}
}
],
"max_points": 35
},
{
"key": "indirect_dependencies_free_of_known_advisories",
"name": "Indirect dependencies free of known advisories",
"detail": "transitive set not separable from development and test dependencies in this scope",
"points": 0,
"status": "excluded",
"details": [
{
"code": "advisories_scope_not_separable",
"params": {}
}
],
"max_points": 25
},
{
"key": "no_advisories_left_outstanding",
"name": "No advisories left outstanding",
"detail": "no advisory carries a publication date",
"points": 0,
"status": "excluded",
"details": [
{
"code": "advisories_no_publication_date",
"params": {}
}
],
"max_points": 40
}
]
},
{
"key": "malicious_dependencies",
"band": "excellent",
"name": "Malicious dependencies",
"note": null,
"notes": [],
"value": 100,
"inputs": {
"source": "osv",
"meaning": "reported as a malicious package by the OpenSSF corpus; the remedy is removal or moving off the compromised name, never an upgrade of the same artifact. Versions the registry has since pulled are listed but not scored",
"packages": [],
"red_flag": false,
"assessed_packages": 78,
"malicious_packages": 0,
"direct_malicious_packages": 0,
"withdrawn_malicious_packages": 0,
"installable_malicious_packages": 0
},
"components": [
{
"key": "no_dependency_reported_as_a_malicious_package",
"name": "No dependency reported as a malicious package",
"detail": "no dependency is reported as a malicious package",
"points": 100,
"status": "met",
"details": [
{
"code": "no_malicious_dependencies",
"params": {}
}
],
"max_points": 100
}
]
},
{
"key": "high_risk_jurisdiction_exposure",
"band": "excellent",
"name": "High-Risk Jurisdiction Exposure",
"note": "Only high-confidence self-published location evidence affects this multiplier. Ambiguous matches are review-only; country evidence is not proof of nationality, citizenship, legal registration, malicious intent, or sanctions status.",
"notes": [
{
"code": "jurisdiction_evidence_limits",
"params": {}
}
],
"value": 100,
"inputs": {
"meaning": "self-published location evidence; not nationality or citizenship",
"red_flag": false,
"exposures": [],
"policy_countries": [
"Russia",
"Iran",
"North Korea"
],
"review_only_matches": 0,
"assessed_self_published_locations": 6
},
"components": [
{
"key": "policy_exposure_multiplier",
"name": "Policy exposure multiplier",
"detail": "no confirmed policy-scope location match",
"points": 100,
"status": "met",
"details": [
{
"code": "jurisdiction_no_match",
"params": {}
}
],
"max_points": 100
}
]
}
],
"description": "Are visible security and supply-chain practices strong, with no malicious dependency and no unresolved high-risk jurisdiction exposure?"
},
{
"key": "ai_readiness",
"band": "moderate",
"name": "AI Readiness",
"value": 68,
"weight": 0,
"metrics": [
{
"key": "ai_agent_context",
"band": "excellent",
"name": "Agent context & guidance",
"note": null,
"notes": [],
"value": 85,
"inputs": {
"has_llms_txt": false,
"legible_history_share": 0.8,
"agent_instruction_files": [
"AGENTS.md",
"CLAUDE.md"
],
"agent_instruction_max_bytes": 1174
},
"components": [
{
"key": "agent_instructions",
"name": "Agent instructions",
"detail": "AGENTS.md, CLAUDE.md",
"points": 45,
"status": "met",
"details": [
{
"code": "file_list",
"params": {
"files": "AGENTS.md, CLAUDE.md"
}
}
],
"max_points": 45
},
{
"key": "machine_readable_docs_llms_txt",
"name": "Machine-readable docs (llms.txt)",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 15
},
{
"key": "legible_commit_history",
"name": "Legible commit history",
"detail": "80 of 100 human commits state their intent (structured subject or explanatory body)",
"points": 40,
"status": "met",
"details": [
{
"code": "legible_history",
"params": {
"legible": 80,
"sampled": 100
}
}
],
"max_points": 40
}
]
},
{
"key": "ai_verify_loop",
"band": "moderate",
"name": "Verify loop (build / test / typecheck)",
"note": null,
"notes": [],
"value": 61,
"inputs": {
"has_nix": true,
"has_tests": true,
"lockfiles": [
"Cargo.lock"
],
"has_dockerfile": true,
"typed_language": false,
"bootstrap_files": [
"Makefile"
],
"has_devcontainer": false,
"has_linter_config": false,
"typecheck_configs": [],
"agent_commit_share": 0.02,
"toolchain_manifests": [
"src/html5ever/Cargo.toml"
],
"dependency_bot_commit_share": 0
},
"components": [
{
"key": "one_command_bootstrap",
"name": "One-command bootstrap",
"detail": "Makefile",
"points": 18,
"status": "met",
"details": [
{
"code": "file_list",
"params": {
"files": "Makefile"
}
}
],
"max_points": 18
},
{
"key": "automated_tests",
"name": "Automated tests",
"detail": null,
"points": 22,
"status": "met",
"details": [],
"max_points": 22
},
{
"key": "lint_format_config",
"name": "Lint / format config",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 11
},
{
"key": "static_type_checking",
"name": "Static type checking",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 11
},
{
"key": "reproducible_environment",
"name": "Reproducible environment",
"detail": "Dockerfile, Nix, lockfile",
"points": 10,
"status": "met",
"details": [
{
"code": "file_list",
"params": {
"files": "Dockerfile, Nix, lockfile"
}
}
],
"max_points": 10
},
{
"key": "demonstrated_agent_practice",
"name": "Demonstrated agent practice",
"detail": "2 of the last 100 commits agent-authored or agent-credited",
"points": 4,
"status": "partial",
"details": [
{
"code": "agent_authored_commits",
"params": {
"count": 2,
"sampled": 100
}
}
],
"max_points": 10
},
{
"key": "automated_maintenance",
"name": "Automated maintenance",
"detail": "no automated dependency updates observed",
"points": 0,
"status": "missed",
"details": [
{
"code": "no_dependency_automation",
"params": {}
}
],
"max_points": 8
},
{
"key": "openssf_scorecard_pinned_dependencies",
"name": "OpenSSF Scorecard: Pinned-Dependencies",
"detail": "dependency not pinned by hash detected -- score normalized to 7",
"points": 7,
"status": "partial",
"details": [],
"max_points": 10
}
]
},
{
"key": "ai_code_legibility",
"band": "moderate",
"name": "Code legibility for models",
"note": null,
"notes": [],
"value": 55,
"inputs": {
"primary_language": "Zig",
"largest_source_bytes": 28947,
"source_files_sampled": 74,
"oversized_source_files": 0
},
"components": [
{
"key": "type_checkable_code",
"name": "Type-checkable code",
"detail": "Zig without a type-check config",
"points": 0,
"status": "missed",
"details": [
{
"code": "no_typecheck_config_language",
"params": {
"language": "Zig"
}
}
],
"max_points": 45
},
{
"key": "manageable_file_sizes",
"name": "Manageable file sizes",
"detail": "0/74 source files over 60KB",
"points": 55,
"status": "met",
"details": [
{
"code": "oversized_source_files",
"params": {
"kb": 60,
"sampled": 74,
"oversized": 0
}
}
],
"max_points": 55
}
]
}
],
"description": "How well is the repo equipped to be developed and maintained with AI coding agents? An independent, experimental badge — weight 0.0, so it is surfaced on its own and does not affect the overall health score."
}
],
"metrics_version": "1.13.0"
},
"warnings": [
"Star history unavailable: GitHub GraphQL error: Resource not accessible by personal access token",
"Could not fetch crates package 'litefetch-html5ever' from its registry"
],
"report_type": "repository",
"generated_at": "2026-07-23T08:51:06.821777Z",
"schema_version": "0.27.0",
"badge_url": "https://raw.githubusercontent.com/inspect-software/badges/main/v1/l/lightpanda-io/browser.svg",
"full_name": "lightpanda-io/browser",
"license_state": "standard",
"license_spdx": "AGPL-3.0"
}
Related records
Inspected repositories sharing catalogue tags or ecosystems with lightpanda-io/browser. Read them side by side →
Scores are signals, not warranties. They reflect publicly visible practices on GitHub — not a code audit, and not a security guarantee.
Missing data is excluded and weights renormalized, never scored as zero. Methodology is versioned and open: metrics v1.13.0, schema v0.27.0 — full methodology · metrics wiki.
