php/frankenphp holds a health index of 81 out of 100, placing it in the Good band. It scores highest on Vitality (95/100) and lowest on Sustainability & Governance (66/100). It was last updated today. A single contributor accounts for most of its recent work.
81
overall / 100
Good
Software health index
Metrics are grouped into weighted categories on one standardized 1–100 scale. Overall starts as their weighted mean; when public evidence triggers the High-Risk Jurisdiction Policy, the rating is adjusted and receives an At risk ceiling of 49. AI Readiness sits outside the overall score.
81
Excellent85-100Exemplary; meets essentially all checked criteria
Good70-84Healthy; minor gaps
Moderate50-69Acceptable with notable gaps; review recommended
At risk30-49Significant weaknesses; adoption warrants caution
Critical1-29Severe problems (abandoned, single-maintainer, no hygiene)
Score profile
Each axis is a category. The shape matters more than the average — a healthy subject fills the whole shape, while a spike-and-crater profile means strength in one dimension is masking risk in another.
Direct dependencies free of known advisories — no direct dependency carries a known advisory
0/25
Indirect dependencies free of known advisories — transitive set not separable from development and test dependencies in this scope
0/40
No advisories left outstanding — no advisory carries a publication date
Inputs used
source
osv
advisories
4
affected_packages
4
assessed_packages
208
unassessed_packages
0
affected_by_severity
critical 2, moderate 1, unknown 1
direct_affected_packages
0
Excluded from scoring (no data or not applicable): Indirect dependencies free of known advisories, No advisories left outstanding. Remaining weights renormalized. Matched 208 resolved dependencies against OSV. This repository publishes no package the index resolves, so the repository dependency graph was assessed instead. That graph mixes development and test pins with shipped dependencies, so only the declared runtime dependencies are scored; transitive findings are reported as context and excluded from the score. Reachability is not analyzed.
How well is the repo equipped to be developed and maintained with AI coding agents? An independent, experimental badge — weight 0.0, so it is surfaced on its own and does not affect the overall health score.
Manageable file sizes — 2/249 source files over 60KB
Inputs used
primary_language
Go
largest_source_bytes
95,783
source_files_sampled
249
oversized_source_files
2
Key facts
11,242GitHub stars
97contributors
392commits, last 12 months
0days since last push
53releases
1bus factor
66open issues
Gopackage ecosystems
Data collection warnings
Star history unavailable: GitHub GraphQL error: Resource not accessible by personal access token
go package 'github.com/dunglas/frankenphp' points at a different repository (https://github.com/dunglas/frankenphp); excluded from ecosystem scoring
go package 'github.com/dunglas/frankenphp/caddy' points at a different repository (https://github.com/dunglas/frankenphp); excluded from ecosystem scoring
More detail
Star and fork history 0 ★ / 468 ⇿
0Stars
468Forks
52Releases
When each star and fork was added, collected from GitHub and bucketed by day. Cumulative growth sits directly above the daily additions it is made of, so the two read against each other: steady organic accretion looks nothing like an abrupt, short-lived burst. Where that difference is measurable, it is reported as growth authenticity.
Major 1Minor 12Patch 34
Each point covers 4 days.
OpenSSF Scorecard 6.5 / 10
6.5aggregate
Independent, tool-agnostic security assessment from the open-source OpenSSF Scorecard. Each check rewards a security practice, not a specific vendor's tool. Checks Scorecard could not determine are marked n/a and excluded from the security score (never counted as zero).Scorecard v5.5.0 · 2026-07-24 21:44 UTC
Full resolved dependency set from the GitHub dependency graph: 13 direct and 195 indirect (transitive) packages. The transitive closure is complete when the repository commits a lockfile.
This repository publishes no package the index resolves, so its own dependency graph was assessed — 208 packages, which also include development and test pins that never ship: 4 carry known advisories, of which 0 are direct.
Package
Version
Relation
Severity
Advisories
Fixed in
github.com/getkin/kin-openapi
v0.140.0
indirect
critical
1
0.144.0
google.golang.org/grpc
v1.81.1
indirect
critical
1
1.82.1
github.com/google/cel-go
v0.28.1
indirect
moderate
1
0.29.0
golang.org/x/crypto
v0.54.0
indirect
unknown
1
—
An advisory means the version recorded in the dependency graph falls inside an advisory’s affected range. Reachability is not analysed, and the graph includes development and test pins — a finding may concern tooling rather than shipped software.
Raw JSON report machine-readable
{
"data": {
"repo": {
"topics": [
"caddy",
"go",
"php",
"sapi",
"worker",
"frankenphp"
],
"is_fork": false,
"size_kb": 15506,
"has_wiki": false,
"homepage": "https://frankenphp.dev",
"languages": {
"C": 87494,
"Go": 767329,
"HCL": 6280,
"PHP": 5691,
"Hack": 95783,
"Shell": 30348,
"Dockerfile": 20688,
"PowerShell": 2018,
"Go Template": 14304
},
"pushed_at": "2026-07-24T10:05:04Z",
"created_at": "2022-03-25T09:37:54Z",
"owner_type": "Organization",
"updated_at": "2026-07-24T16:20:51Z",
"description": "🧟 The modern PHP app server",
"is_archived": false,
"is_disabled": false,
"license_spdx": "MIT",
"default_branch": "main",
"license_spdx_raw": "MIT",
"primary_language": "Go",
"significant_languages": [
"Go"
]
},
"owner": {
"blog": "https://www.php.net",
"name": "php.net",
"type": "Organization",
"login": "php",
"company": null,
"location": null,
"followers": 4041,
"avatar_url": "https://avatars.githubusercontent.com/u/25158?v=4",
"created_at": "2008-09-18T10:57:16Z",
"is_verified": null,
"public_repos": 152,
"account_age_days": 6518
},
"license": {
"state": "standard",
"spdx_id": "MIT",
"raw_spdx": "MIT",
"file_present": true,
"scorecard_found": true,
"profile_has_license": true
},
"activity": {
"releases": [
{
"tag": "v1.12.6",
"kind": "patch",
"published_at": "2026-07-21T13:45:03Z"
},
{
"tag": "v1.12.5",
"kind": "patch",
"published_at": "2026-07-20T12:45:16Z"
},
{
"tag": "v1.12.4",
"kind": "patch",
"published_at": "2026-06-04T10:29:19Z"
},
{
"tag": "v1.12.3",
"kind": "patch",
"published_at": "2026-05-15T23:09:45Z"
},
{
"tag": "v1.12.2",
"kind": "patch",
"published_at": "2026-04-09T15:43:18Z"
},
{
"tag": "v1.12.1",
"kind": "patch",
"published_at": "2026-03-10T15:32:11Z"
},
{
"tag": "v1.12.0",
"kind": "minor",
"published_at": "2026-03-06T17:30:50Z"
},
{
"tag": "v1.11.3",
"kind": "patch",
"published_at": "2026-02-24T12:40:17Z"
},
{
"tag": "v1.11.2",
"kind": "patch",
"published_at": "2026-02-12T12:32:18Z"
},
{
"tag": "v1.11.1",
"kind": "patch",
"published_at": "2025-12-24T13:34:11Z"
},
{
"tag": "v1.11.0",
"kind": "minor",
"published_at": "2025-12-19T12:50:24Z"
},
{
"tag": "v1.10.1",
"kind": "patch",
"published_at": "2025-11-25T12:43:33Z"
},
{
"tag": "v1.10.0",
"kind": "minor",
"published_at": "2025-11-23T15:44:15Z"
},
{
"tag": "v1.9.1",
"kind": "patch",
"published_at": "2025-08-29T12:51:16Z"
},
{
"tag": "v1.9.0",
"kind": "minor",
"published_at": "2025-07-18T13:48:49Z"
},
{
"tag": "v1.8.0",
"kind": "minor",
"published_at": "2025-07-06T07:30:58Z"
},
{
"tag": "v1.7.0",
"kind": "minor",
"published_at": "2025-06-03T09:44:26Z"
},
{
"tag": "v1.6.2",
"kind": "patch",
"published_at": "2025-05-23T09:57:59Z"
},
{
"tag": "v1.6.1",
"kind": "patch",
"published_at": "2025-05-23T09:57:46Z"
},
{
"tag": "v1.6.0",
"kind": "minor",
"published_at": "2025-05-19T18:24:02Z"
},
{
"tag": "v1.5.0",
"kind": "minor",
"published_at": "2025-03-26T08:37:21Z"
},
{
"tag": "v1.4.4",
"kind": "patch",
"published_at": "2025-02-19T12:29:28Z"
},
{
"tag": "v1.4.3",
"kind": "patch",
"published_at": "2025-02-18T08:22:39Z"
},
{
"tag": "v1.4.2",
"kind": "patch",
"published_at": "2025-01-28T18:46:28Z"
},
{
"tag": "v1.4.1",
"kind": "patch",
"published_at": "2025-01-20T13:11:38Z"
},
{
"tag": "v1.4.0",
"kind": "minor",
"published_at": "2025-01-10T08:52:30Z"
},
{
"tag": "v1.3.6",
"kind": "patch",
"published_at": "2024-12-22T20:49:20Z"
},
{
"tag": "v1.3.4",
"kind": "patch",
"published_at": "2024-12-20T14:40:08Z"
},
{
"tag": "v1.3.3",
"kind": "patch",
"published_at": "2024-11-29T10:29:10Z"
},
{
"tag": "v1.3.2",
"kind": "patch",
"published_at": "2024-11-23T20:02:20Z"
},
{
"tag": "v1.3.1",
"kind": "patch",
"published_at": "2024-11-14T23:25:45Z"
},
{
"tag": "v1.3.0",
"kind": "minor",
"published_at": "2024-11-13T11:26:39Z"
},
{
"tag": "v1.2.5",
"kind": "patch",
"published_at": "2024-08-27T16:08:03Z"
},
{
"tag": "v1.2.4",
"kind": "patch",
"published_at": "2024-08-12T14:36:27Z"
},
{
"tag": "v1.2.3",
"kind": "patch",
"published_at": "2024-08-06T14:16:33Z"
},
{
"tag": "v1.2.2",
"kind": "patch",
"published_at": "2024-07-12T09:32:03Z"
},
{
"tag": "v1.2.1",
"kind": "patch",
"published_at": "2024-06-25T08:40:26Z"
},
{
"tag": "v1.2.0",
"kind": "minor",
"published_at": "2024-06-06T09:17:40Z"
},
{
"tag": "v1.1.5",
"kind": "patch",
"published_at": "2024-05-14T07:33:31Z"
},
{
"tag": "v1.1.4",
"kind": "patch",
"published_at": "2024-04-25T14:55:48Z"
},
{
"tag": "v1.1.3",
"kind": "patch",
"published_at": "2024-04-25T14:55:04Z"
},
{
"tag": "v1.1.2",
"kind": "patch",
"published_at": "2024-03-25T09:11:14Z"
},
{
"tag": "v1.1.1",
"kind": "patch",
"published_at": "2024-03-19T08:34:46Z"
},
{
"tag": "v1.1.0",
"kind": "minor",
"published_at": "2024-02-04T10:16:00Z"
},
{
"tag": "v1.0.3",
"kind": "patch",
"published_at": "2024-01-06T11:26:10Z"
},
{
"tag": "v1.0.2",
"kind": "patch",
"published_at": "2023-12-25T20:18:45Z"
},
{
"tag": "v1.0.1",
"kind": "patch",
"published_at": "2023-12-18T18:40:01Z"
},
{
"tag": "v1.0.0",
"kind": "major",
"published_at": "2023-12-07T15:25:32Z"
},
{
"tag": "v1.0.0-rc.4",
"kind": "prerelease",
"published_at": "2023-11-30T07:46:23Z"
},
{
"tag": "v1.0.0-rc.3",
"kind": "prerelease",
"published_at": "2023-11-16T15:08:21Z"
},
{
"tag": "v1.0.0-rc.2",
"kind": "prerelease",
"published_at": "2023-10-30T22:05:14Z"
},
{
"tag": "v1.0.0-beta.2",
"kind": "prerelease",
"published_at": "2023-10-10T14:33:24Z"
},
{
"tag": "v1.0.0-beta.1",
"kind": "prerelease",
"published_at": "2023-09-20T14:08:06Z"
}
],
"recent_commits": [
{
"oid": "b1ccb0e14c6072884122c546764351bfabd979e8",
"body": "Fix #2481",
"is_bot": false,
"headline": "fix: report total threads as gauge (#2550)",
"author_name": "Ben Younes",
"author_login": "ousamabenyounes",
"committed_at": "2026-07-22T08:01:34Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "4397463323e425e91c1150fd7c2b810c116583a6",
"body": null,
"is_bot": true,
"headline": "chore: prepare release 1.12.6 [skip ci]",
"author_name": "dunglas-release[bot]",
"author_login": "dunglas-release[bot]",
"committed_at": "2026-07-20T14:58:29Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "85e2d406b64d85bd3d1eced610ec97efbe03edfe",
"body": "Update Go module dependencies in the root and `caddy/` modules.\n\n## Changes\n- `prometheus/client_golang` v1.23.2 → v1.24.0 (both modules)\n- `klauspost/compress` v1.19.0 (caddy indirect); pruned from root\nindirect by `go mod tidy`\n\n## Verification\n- `go mod tidy` + `go mod verify`: all modules verified.\n- Root non-cgo tests: 792 passed. cgo packages skipped locally (no\nPHP/brotli headers).",
"is_bot": false,
"headline": "chore: update Go dependencies (#2540)",
"author_name": "Kévin Dunglas",
"author_login": "dunglas",
"committed_at": "2026-07-20T14:04:10Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "b8fb79b27b77c72d6579b967b1782dadd6724f57",
"body": "Add worker-mode example bridging PSR-15 apps via nyholm/psr7 +\nnyholm/psr7-server, as asked in\nhttps://github.com/php/frankenphp/issues/1179.",
"is_bot": false,
"headline": "docs: add PSR-15 worker example (#2539)",
"author_name": "Kévin Dunglas",
"author_login": "dunglas",
"committed_at": "2026-07-20T13:39:46Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "a7d874970d087a0dc89979057b5c50368e3f6678",
"body": "…ed (#2538)\n\nFixes https://github.com/php/frankenphp/issues/2535.\n\n## Problem\n\n`frankenphp_finish_request()` (or any early context close) calls\n`closeContext()`, which closes `done`, so `ServeHTTP` returns and\nnet/http's HTTP/2 layer runs `handlerDone()` and nils out the\nresponseWriter's stream stat\n[…]\nread `php://input`); it segfaults without the fix and\npasses with it.\n- `TestRequestBodyTimeoutHTTP2` adds HTTP/2 coverage for the deadline\npath, which the suite previously exercised only over HTTP/1.",
"is_bot": false,
"headline": "fix: don't set request body read deadline after the request is finish…",
"author_name": "Kévin Dunglas",
"author_login": "dunglas",
"committed_at": "2026-07-20T13:35:59Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "1c4a8e09d7beecb8c327265f05cb5fc9068e5a27",
"body": "Translation updates for: extension-workers.md extensions.md migrate.md\nproduction.md .\n\nCo-authored-by: dunglas <57224+dunglas@users.noreply.github.com>",
"is_bot": true,
"headline": "docs: update translations (#2537)",
"author_name": "github-actions[bot]",
"author_login": "github-actions[bot]",
"committed_at": "2026-07-20T12:43:53Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "4c4b7e5c5de9ae2567374839713f80e0a2a2cbd8",
"body": "Align everything on \"normal case\" as it's pretty inconsistent across the\ndocs. Latest changes show we don't want to use title case.",
"is_bot": false,
"headline": "docs: remove title case (#2534)",
"author_name": "Alexandre Daubois",
"author_login": "alexandre-daubois",
"committed_at": "2026-07-20T12:18:06Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "842aa88a358de336c150b2ced0e77257740c5c8c",
"body": "…ithub-actions group (#2536)\n\nBumps the github-actions group with 1 update:\n[mislav/bump-homebrew-formula-action](https://github.com/mislav/bump-homebrew-formula-action).\n\nUpdates `mislav/bump-homebrew-formula-action` from 4.1 to 4.2\n<details>\n<summary>Release notes</summary>\n<p><em>Sourced from <a\n\n[…]\n of the specified dependency and ignore\nconditions\n\n\n</details>\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
"is_bot": true,
"headline": "ci: bump mislav/bump-homebrew-formula-action from 4.1 to 4.2 in the g…",
"author_name": "dependabot[bot]",
"author_login": "dependabot[bot]",
"committed_at": "2026-07-20T12:17:36Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "e41b848eb9f7517088a77f2836cee68da1be234b",
"body": null,
"is_bot": true,
"headline": "chore: prepare release 1.12.5 [skip ci]",
"author_name": "dunglas-release[bot]",
"author_login": "dunglas-release[bot]",
"committed_at": "2026-07-18T19:08:32Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "aa63f986f349b9396603a1860ff5ea196038ea88",
"body": "Bumps the github-actions group with 3 updates:\n[docker/setup-buildx-action](https://github.com/docker/setup-buildx-action),\n[docker/login-action](https://github.com/docker/login-action) and\n[docker/bake-action](https://github.com/docker/bake-action).\n\nUpdates `docker/setup-buildx-action` from 4.1.0 \n[…]\n of the specified dependency and ignore\nconditions\n\n\n</details>\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
"is_bot": true,
"headline": "ci: bump the github-actions group with 3 updates (#2516)",
"author_name": "dependabot[bot]",
"author_login": "dependabot[bot]",
"committed_at": "2026-07-18T17:37:26Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "1bec6a9bdf027ef607a6a7b17a4d25815f3efc32",
"body": "Updates Go dependencies in both modules (root and `caddy/`) to their\nlatest versions, including `github.com/dunglas/vulcain` v1.4.1 → v1.4.2.\n\n`go build`/`go test` pass in both modules.",
"is_bot": false,
"headline": "chore: update Go dependencies (#2526)",
"author_name": "Kévin Dunglas",
"author_login": "dunglas",
"committed_at": "2026-07-18T15:46:20Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "e8d987cdb62c85d10c6f8774a6196502b83f0eda",
"body": "…her (#2528)\n\n\\`TestWorkerWithInactiveWatcher\\` calls \\`tester.InitServer\\` and\nimmediately asserts against the app endpoint. \\`caddytest\\`'s own\nreadiness check only polls the admin API, not the app-facing listener,\nso under load a request can land in the gap and get an EOF (seen in CI:\nhttps://git\n[…]\n\\`waitForListener\\`, which polls a raw TCP dial/close (no HTTP, no\ncounter impact) until the listener accepts connections, before the\ncounted requests.\n\nVerified with repeated full-suite runs locally.",
"is_bot": false,
"headline": "fix(tests): wait for listener readiness in TestWorkerWithInactiveWatc…",
"author_name": "Kévin Dunglas",
"author_login": "dunglas",
"committed_at": "2026-07-18T15:46:06Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "1eaf042d8a2ebc398cc4d136b9713e32956c310f",
"body": "Fix #2400\n\n---------\n\nCo-authored-by: Kevin Dunglas <kevin@dunglas.dev>",
"is_bot": false,
"headline": "docs: add Italian translation (#2405)",
"author_name": "Massimiliano Arione",
"author_login": "garak",
"committed_at": "2026-07-18T15:45:24Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "9fd8297ddbeabbd70a04aa967ef3fa4f576b7caa",
"body": "## Problem\n\n`go_read_post` loops on `request.Body.Read` with no per-read deadline. A\nclient that announces a body (or a large `Content-Length`) then dribbles\nor stalls holds a PHP thread for the lifetime of the connection. With a\nbounded thread pool, `max_threads` such connections exhaust the pool a\n[…]\neployment with no SSE and no large uploads, `read_timeout` is the\nsimpler zero-code answer; this option is for the cases it can't express.\n\n---------\n\nCo-authored-by: Kevin Dunglas <kevin@dunglas.dev>",
"is_bot": false,
"headline": "feat: add WithRequestBodyTimeout to bound slow request bodies (#2465)",
"author_name": "Ilia Alshanetsky",
"author_login": "iliaal",
"committed_at": "2026-07-18T15:44:22Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "a3d286ed626606fc07793624dbaf34c42cf35871",
"body": "…2484)",
"is_bot": false,
"headline": "fix: prevent panic on malformed RemoteAddr in CGI variable builder (#…",
"author_name": "Alexandre Daubois",
"author_login": "alexandre-daubois",
"committed_at": "2026-07-18T15:12:38Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "c4c5af82b268847f31e744f4bd2b596bf69df2e4",
"body": "Translation updates for: config.md .\n\n---------\n\nSigned-off-by: Kévin Dunglas <kevin@dunglas.fr>\nCo-authored-by: alexandre-daubois <2144837+alexandre-daubois@users.noreply.github.com>\nCo-authored-by: Kévin Dunglas <kevin@dunglas.fr>\nCo-authored-by: Kevin Dunglas <kevin@dunglas.dev>",
"is_bot": true,
"headline": "docs: update translations (#2345)",
"author_name": "github-actions[bot]",
"author_login": "github-actions[bot]",
"committed_at": "2026-07-18T14:16:45Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "d770606e79aa816c5b74748eba05b7cf22ea4310",
"body": "Translation updates for: extensions.md .\n\nCo-authored-by: dunglas <57224+dunglas@users.noreply.github.com>\nCo-authored-by: Kevin Dunglas <kevin@dunglas.dev>",
"is_bot": true,
"headline": "docs: update translations (#2313)",
"author_name": "github-actions[bot]",
"author_login": "github-actions[bot]",
"committed_at": "2026-07-18T14:16:43Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "4a43549271cd5bae8d966060847a4127cd965db7",
"body": "As spotted in\nhttps://medium.com/@paul.arlott/building-frankenscriptling-running-scriptling-inside-frankenphp-6d4ac95432d2",
"is_bot": false,
"headline": "fix(extgen): correct C param cast in class method wrapper calls (#2436)",
"author_name": "Alexandre Daubois",
"author_login": "alexandre-daubois",
"committed_at": "2026-07-18T13:56:19Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "0d521e10afebfadfd4ffbc8df75862902595652c",
"body": "The `Lint Code Base` job on `main` is red: the welcome page added in\n#2524 ends without a trailing newline, which violates `.editorconfig`\n(`insert_final_newline = true`). EDITORCONFIG was the only failing\nlinter.\n\nAppends the missing newline. No content change.",
"is_bot": false,
"headline": "fix(lint): add final newline to package/content/index.php (#2525)",
"author_name": "Kévin Dunglas",
"author_login": "dunglas",
"committed_at": "2026-07-18T13:50:29Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "17940ff2ee188a1e48aabd10c095df72b42539e0",
"body": "The default /app/public/index.php ran phpinfo(). Derived images without their own index served it verbatim, exposing environment variables, php.ini directives, versions and paths. Reuse the RPM/deb welcome page (package/content/index.php) as the single default index across Docker, RPM and deb. The page discloses nothing. See GHSA-cj57-c655-p798.\n\nWelcome page graphic design by @ginifizz.\n\nCo-authored-by: ginifizz <16579730+ginifizz@users.noreply.github.com>",
"is_bot": false,
"headline": "fix(docker): ship a static welcome page instead of phpinfo() (#2524)",
"author_name": "Kévin Dunglas",
"author_login": "dunglas",
"committed_at": "2026-07-18T13:43:23Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "be24d82531675f90862b8cde1e9fc7e9ee855aa5",
"body": "… (#2523)\n\nResets the PHP session module between worker requests when the session extension is loaded as a shared module (HAVE_PHP_SESSION undefined), so PS(id) cannot bleed across concurrent clients. Statically-linked builds are unchanged. See GHSA-v3ph-cgqh-r8p5.",
"is_bot": false,
"headline": "fix: reset session state when session ext is not linked at build time…",
"author_name": "Kévin Dunglas",
"author_login": "dunglas",
"committed_at": "2026-07-18T13:43:20Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "0a2d75deb87f5ee59bc3a6d3a2a0a51f706337a9",
"body": "This PR removes the experimental `DrainWorkers` function since it serves\nno purpose anymore (as also discussed in #2499).\n\nThe original use was to have a graceful shutdown of all workers on Caddy\nshutdown (added\n[here](https://github.com/php/frankenphp/pull/1405/changes)). Since\nshutdowns have long been fully safe, the function is not in use anymore.\nIt might only be confusing for library users, since it does not allow\nrecovering drained workers.",
"is_bot": false,
"headline": "cleanup: remove DrainWorkers (#2518)",
"author_name": "Alexander Stecher",
"author_login": "AlliBalliBaba",
"committed_at": "2026-07-15T22:02:18Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "118799465336663c5821364859229f4a3a1bdcd6",
"body": "Co-authored-by: Pierre Clavequin <pierre.clavequin@valueapex.com>",
"is_bot": false,
"headline": "docs: Chinese translations for logging and observability (#2515)",
"author_name": "Pierre",
"author_login": "pierresh",
"committed_at": "2026-07-13T10:32:20Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "bc9c6db8e92d3839918e9534db9493b0ef76aa55",
"body": "…492)\n\npcov is not thread-safe: it swaps the process-global zend_compile_file\nand zend_execute_ex engine hooks without synchronization, which races\nacross threads and crashes (SIGSEGV) in classic mode (krakjoe/pcov#132).\nImagick is unstable because ImageMagick's OpenMP threads conflict with\nFrankenPHP's threading model.",
"is_bot": false,
"headline": "docs: document pcov and imagick incompatibilities in known issues (#2…",
"author_name": "Alexandre Daubois",
"author_login": "alexandre-daubois",
"committed_at": "2026-07-10T08:35:36Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "a00bb02f73e6ccbfdbd131d4193118215419a4a1",
"body": "This folds a 3 instruction tls load on aarch64 to a single mrs.\nOn x86-64 gnu ld *should* have relaxed it to a single fs anyway, but\nthis guarantees it.\n\n---------\n\nSigned-off-by: Marc <m@pyc.ac>",
"is_bot": false,
"headline": "perf: small native tls optimisation (#2512)",
"author_name": "Marc",
"author_login": "henderkes",
"committed_at": "2026-07-08T23:57:46Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "56ace5942e78f6a7e7e3b451f1525a1e60272fce",
"body": null,
"is_bot": false,
"headline": "Fixes hangup.",
"author_name": "Alliballibaba",
"author_login": "AlliBalliBaba",
"committed_at": "2026-07-07T03:27:21Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "463c9693b742f99002554e7a1e53caf9feb367bb",
"body": "…hub-actions group across 1 directory (#2509)\n\nBumps the github-actions group with 1 update in the / directory:\n[golangci/golangci-lint-action](https://github.com/golangci/golangci-lint-action).\n\nUpdates `golangci/golangci-lint-action` from 9.2.1 to 9.3.0\n<details>\n<summary>Release notes</summary>\n<\n[…]\n of the specified dependency and ignore\nconditions\n\n\n</details>\n\nSigned-off-by: dependabot[bot] <support@github.com>\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
"is_bot": true,
"headline": "ci: bump golangci/golangci-lint-action from 9.2.1 to 9.3.0 in the git…",
"author_name": "dependabot[bot]",
"author_login": "dependabot[bot]",
"committed_at": "2026-07-06T14:21:00Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "e2eb0ceb91cd726122d94466df4962f771c2e63a",
"body": "…s (#2505)\n\nSupersedes #2493, #2494 and #2498",
"is_bot": false,
"headline": "chore: bump golang.org/x/net, caddyserver/certmagic and github-action…",
"author_name": "Alexandre Daubois",
"author_login": "alexandre-daubois",
"committed_at": "2026-07-06T13:22:04Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "164bc4d96b12ebb264b1b39c56f2d00b451dc773",
"body": "FrankenPHP runs natively on Windows since v1.12 (#2119), but the docs\ndon't mention it as a deployment target. This adds a \"Deploying on\nWindows\" section to the production guide (install, running as a Windows\nservice with WinSW as [recommended by the Caddy\ndocs](https://caddyserver.com/docs/running#windows-service), graceful\nreload) and a pointer to the Windows compilation instructions in the\ncompile docs.\n\nRelated to #2442. Follow-ups: #2501 (static/embed, see also #2503),\n#2502 (macOS).",
"is_bot": false,
"headline": "docs: deploying on Windows (#2500)",
"author_name": "m-this",
"author_login": "m-this",
"committed_at": "2026-07-06T06:44:05Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "51ca6e460db419c9880a2ddf2289f18d0356d0bd",
"body": "The production guide only covers Docker Compose on Linux. This documents\ndeploying natively on macOS with Homebrew and the `brew services`\nintegration provided by the formula.\n\nCompanion to #2500. Related to #2442.",
"is_bot": false,
"headline": "docs: deploying on macOS (#2502)",
"author_name": "m-this",
"author_login": "m-this",
"committed_at": "2026-07-04T15:46:55Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "1f216dd07d5dd75c79518d7586ae75c6e86b0c82",
"body": "closes https://github.com/php/frankenphp/issues/1674\n\nwas looking through old issues and found this one that already had a\nplan to solve it\n\n---------\n\nSigned-off-by: Marc <m@pyc.ac>\nCo-authored-by: Alliballibaba <alliballibaba@gmail.com>\nCo-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>",
"is_bot": false,
"headline": "fix: feat: add php_server's env vars to sandboxed environment (#2451)",
"author_name": "Marc",
"author_login": "henderkes",
"committed_at": "2026-07-02T12:08:02Z",
"body_truncated": false,
"is_coding_agent": true
},
{
"oid": "39b9692c08d5eb694ee5d98308c66e1ebb0f4687",
"body": "Instead of resetting the opcache (manually or on overflow), reboot all threads including the main thread while keeping requests queued. This avoids multiple races that exist in opcache and opcache ZTS. Does also affect resets when watching.\n---------\n\nCo-authored-by: henderkes <m@pyc.ac>",
"is_bot": false,
"headline": "fix: reboot threads instead of opcache_reset (#2364)",
"author_name": "Alexander Stecher",
"author_login": "AlliBalliBaba",
"committed_at": "2026-07-01T17:55:55Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "3bc35af9375cb4674cefd2822aa7e3a687256c9b",
"body": "…s to get stuck (#2445)",
"is_bot": false,
"headline": "fix: pcntl signal reaching Go runtime causing long running cli script…",
"author_name": "Marc",
"author_login": "henderkes",
"committed_at": "2026-07-01T15:41:04Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "570bbf2d8f188b4af94949d0022f38a5d3b68feb",
"body": "… #2477",
"is_bot": false,
"headline": "deduplicate registration-time duplicates from `match` directives, fix…",
"author_name": "henderkes",
"author_login": "henderkes",
"committed_at": "2026-07-01T14:37:53Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "cd1f4e006da030d7a90b9d3cdd0a826585fbf87b",
"body": "Enable auto-merge only for github_actions minor/patch bumps; majors and\nother ecosystems still need a human. The default GITHUB_TOKEN lacks the\nworkflows scope and is refused on PRs that touch .github/workflows, so use\nthe dunglas-release app token scoped to contents/pull-requests/workflows,\nrun from an unprotected dependabot environment. zizmor ignores the\nrequired pull_request_target trigger for this guarded workflow.",
"is_bot": false,
"headline": "ci: auto-merge minor and patch GitHub Actions Dependabot updates",
"author_name": "Kévin Dunglas",
"author_login": "dunglas",
"committed_at": "2026-06-30T15:11:21Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "b9a30e780941931061b2437090ab24351d2e53e3",
"body": "Pin every external action (workflows and composite actions) to a full\ncommit SHA with the exact version in the comment Dependabot keeps\ncurrent, then drop the zizmor unpinned-uses ref-pin override so the\ndefault hash-pin policy enforces it. Mitigates the tag-mutation\nsupply-chain class. The secrets-outside-env DOCKERHUB_TOKEN allowlist\nstays.",
"is_bot": false,
"headline": "ci: hash-pin all GitHub Actions to commit SHAs",
"author_name": "Kévin Dunglas",
"author_login": "dunglas",
"committed_at": "2026-06-30T15:11:21Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "7ff94809a01142a03c1e82953c78233ea4e014a3",
"body": "Main is red on the Lint Code Base job for two deterministic reasons.\n\n## clang-format\n`frankenphp.c:141` — the empty `while` body must sit on its own line.\n\n## zizmor `github-app`\nzizmor 1.26 added the `github-app` audit, which flags\n`actions/create-github-app-token` invocations that inherit blanket\n[…]\n releases\n- `actions: write` — `gh workflow run` dispatch of downstream builds\n(static/docker/windows)\n\nBoth verified locally: `zizmor` reports no findings, `clang-format\n--dry-run --Werror` is clean.",
"is_bot": false,
"headline": "ci: fix lint failures blocking main (#2496)",
"author_name": "Kévin Dunglas",
"author_login": "dunglas",
"committed_at": "2026-06-30T12:11:18Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "d0c8ca2c3c06a8cec199ace1b4d62e6cbf596050",
"body": null,
"is_bot": false,
"headline": "fix: untrack watcher/ build artifact committed by mistake",
"author_name": "Alexandre Daubois",
"author_login": "alexandre-daubois",
"committed_at": "2026-06-27T06:34:59Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "11d70ae6ba4f940c40229ec66fb17a9dd5329b6f",
"body": "…n replaced channels (#2470)\n\nfixes https://github.com/php/frankenphp/issues/2469",
"is_bot": false,
"headline": "fix: reuse created-once channels so queued requests don't get stuck o…",
"author_name": "Marc",
"author_login": "henderkes",
"committed_at": "2026-06-27T02:26:46Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "3de9d997be40c8d29b9e5c52dd2cd43f75973051",
"body": "adds extra safety handling for when frankenphp is forked:\n- on linux, when the parent thread dies, all children automatically\nreceive SIGKILL\n- likewise on freebsd, when the parent process dies\n- other *nix platforms manually listen on kqueue until parent (process)\nend is closed, then terminate\n- windows has no forking, so no changes thete\n\nunlikely to be needed, but better safe than sorry\n\n---------\n\nSigned-off-by: Marc <m@pyc.ac>\nCo-authored-by: Kévin Dunglas <kevin@dunglas.fr>",
"is_bot": false,
"headline": "chore: extra pthread handling safety (#2390)",
"author_name": "Marc",
"author_login": "henderkes",
"committed_at": "2026-06-26T12:43:50Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "a9893b4a634634d9c61727ad5a48d286fc44a7d4",
"body": "`addKnownVariablesToServer` stripped IPv6 brackets with an unchecked\nslice, so a malformed `RemoteAddr` like `\"[\"` or `\"[:9000\"` panicked.\nThis runs in the `go_register_server_variables` cgo callback, where a\npanic can't cross the C frame and crashes the whole process. Not\nreachable behind stock Cad\n[…]\nchable for library callers and real-IP\nrewrites.\n\nFix: parse via `net.SplitHostPort` with a bounds-safe fallback.\n`TestSplitRemoteAddr` covers the crashing inputs; well-formed addresses\nare unchanged.",
"is_bot": false,
"headline": "fix: guard RemoteAddr parsing against out-of-bounds slice panic (#2463)",
"author_name": "Ilia Alshanetsky",
"author_login": "iliaal",
"committed_at": "2026-06-26T07:37:26Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "ccb268d52cda9fe5ce597cc0f3e29aa65a76bd59",
"body": "…#2464)\n\n`frankenphp_send_headers` parsed the status with `atoi(http_status_line\n+ 9)`, assuming a fixed 9-byte `\"HTTP/x.y \"` prefix. `header(\"HTTP/\")`\n(5 bytes) makes `+9` read past the buffer. ASan confirms a\nheap-buffer-overflow read in `atoi`, 3 bytes past the `estrndup`'d line.\n\nPHP already par\n[…]\n` (via\n`sapi_update_response_code()`), so the reparse was redundant and unsafe.\nUse it directly. Tests in `statusline_test.go` (run under `-asan`) cover\nthe short line and a valid `HTTP/1.1 418` line.",
"is_bot": false,
"headline": "fix: avoid out-of-bounds read when parsing the response status line (…",
"author_name": "Ilia Alshanetsky",
"author_login": "iliaal",
"committed_at": "2026-06-26T07:36:48Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "3f562082c90275d7550c0417352f8cc5c3d0566a",
"body": "see https://github.com/caddyserver/caddy/pull/7811",
"is_bot": false,
"headline": "chore: update php-server max_header to 16kb to match caddy (#2475)",
"author_name": "Marc",
"author_login": "henderkes",
"committed_at": "2026-06-10T07:20:25Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "edaffab6a00cb6fe8a93ca5699be437b2eed5705",
"body": "`mislav/bump-homebrew-formula-action` uses two tokens:\n\n```js\nconst internalToken = process.env.GITHUB_TOKEN || process.env.COMMITTER_TOKEN || ''\nconst externalToken = process.env.COMMITTER_TOKEN || ''\n```\n\nThe internal token reads the source repo (release tag lookup, tarball\nchecksum); the external\n[…]\nse`. This broke the \"Bump Homebrew formula\"\nstep of the v1.12.4 release runs.\n\nSetting `GITHUB_TOKEN` restores the intended split: workflow token for\nreads here, tap-scoped PAT for the formula commit.",
"is_bot": false,
"headline": "fix(release): pass GITHUB_TOKEN to the Homebrew bump step (#2466)",
"author_name": "Kévin Dunglas",
"author_login": "dunglas",
"committed_at": "2026-06-04T06:28:59Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "8c9e33134ee8c0e5db938ecee7ec29572bf65603",
"body": null,
"is_bot": true,
"headline": "chore: prepare release 1.12.4 [skip ci]",
"author_name": "dunglas-release[bot]",
"author_login": "dunglas-release[bot]",
"committed_at": "2026-06-03T22:23:21Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "71e538ee23bd2a47231e6f6b57154ea24f04fc1d",
"body": "Routine dependency bump for the root and `caddy/` modules (`go get -u\nall` + `go mod tidy`).\n\n## Notable updates\n\n**Root**\n- OpenTelemetry `otel`/`otel/trace` 1.43.0 → 1.44.0\n- `golang.org/x/crypto` 0.51 → 0.52, `x/net` 0.54 → 0.55, `x/sys` 0.44 →\n0.45\n- `dunglas/mercure` 0.24.0 → 0.24.2\n- `RoaringB\n[…]\n0 → 0.81.1\n- `google.golang.org/api` 0.279 → 0.283, genproto + x509roots/fallback +\nx/exp pseudo-versions\n\n## Tests\n\n`go test ./...` passes in both modules. No incompatibilities, no\ndowngrades needed.",
"is_bot": false,
"headline": "chore: update Go dependencies (#2462)",
"author_name": "Kévin Dunglas",
"author_login": "dunglas",
"committed_at": "2026-06-03T21:04:54Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "4344949eeab63f075f25dcf063b4a959f0040048",
"body": null,
"is_bot": false,
"headline": "remove metrics shutdown assignments",
"author_name": "henderkes",
"author_login": "henderkes",
"committed_at": "2026-06-03T21:00:28Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "8876b384281c950d70f5b0a3aae42ea22d6d985c",
"body": "Cross-port of review feedback from\nhttps://github.com/dunglas/mercure/pull/1246, applied to the changes\nthat this workflow shares structurally with Mercure's.\n\n## Summary\n\n- **Validate the `version` input inside `release.yaml`.** The semver\nregex in `release.sh` only protects operators using the scr\n[…]\nn the previously hardcoded three paths.\n- **Restore the three-way behind/ahead/diverged diagnostic in\n`release.sh`** so the operator knows whether to `git pull`, `git push`,\nor reconcile a divergence.",
"is_bot": false,
"headline": "ci: harden release workflow inputs and tag detection (#2430)",
"author_name": "Kévin Dunglas",
"author_login": "dunglas",
"committed_at": "2026-06-03T20:58:01Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "d50ce61870b824c7400bd23e433f76a6dd34995e",
"body": null,
"is_bot": false,
"headline": "reset headers_sent flags on embed sapi startup",
"author_name": "henderkes",
"author_login": "henderkes",
"committed_at": "2026-06-03T20:56:31Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "1055f1c4de097d340ce89d6a044dec496f5ec768",
"body": null,
"is_bot": false,
"headline": "docs: add security model documentation",
"author_name": "Alexandre Daubois",
"author_login": "alexandre-daubois",
"committed_at": "2026-06-03T20:53:09Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "30ec3e6e94b5b1d3abbae3e92d704642f434592d",
"body": "…(#2460)\n\n## What\n\nDocument that `NewRequestWithContext` does not strip request headers\nwhose name contains an underscore.\n\n## Why\n\nCGI maps dashes to underscores (`Foo-Bar` becomes `HTTP_FOO_BAR`), so a\nclient-supplied `Foo_Bar` header is indistinguishable from a legitimate\n`Foo-Bar` in `$_SERVER` \n[…]\nthey explicitly whitelist\nthem.\n\n## Changes\n\n- Doc comment on `NewRequestWithContext` explaining the risk and\nmitigation.\n- `ExampleServeHTTP` now drops underscore headers before building the\nrequest.",
"is_bot": false,
"headline": "docs: warn about underscore header spoofing in NewRequestWithContext …",
"author_name": "Kévin Dunglas",
"author_login": "dunglas",
"committed_at": "2026-06-03T20:49:31Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "64bb386761b93031ac30a93e6eb41285f7f3dce5",
"body": null,
"is_bot": false,
"headline": "fix(metrics): replace mutex with read-write mutex (#2450)",
"author_name": "Alexandre Daubois",
"author_login": "alexandre-daubois",
"committed_at": "2026-05-31T09:28:37Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "88f64c8ba851067ea1434e01694369fd14eade42",
"body": "closes #2449, closes #2448, closes #2447",
"is_bot": false,
"headline": "chore: go mod update (#2454)",
"author_name": "Marc",
"author_login": "henderkes",
"committed_at": "2026-05-30T11:46:51Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "61077e1f5088ed99aa10af8ba8376b7944e2a518",
"body": "…dler (#2443)\n\nfixes https://github.com/php/frankenphp/issues/2368",
"is_bot": false,
"headline": "fix: clear in_save_handler state that blocks the subsequent close han…",
"author_name": "Marc",
"author_login": "henderkes",
"committed_at": "2026-05-27T00:31:17Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "e2a4abb04cbe4c5de7d1bb012c5622c50de501a0",
"body": "## Summary\n- Drop `\" \" -> \"_\"` from `headerNameReplacer`: Go's net/http rejects\nheader names containing spaces with `400 Bad Request: invalid header\nname` before requests reach the handler, so the branch is unreachable.\n- Drop unused explicit type parameters on `otter.Must`.\n- Add `TestHeaderWithSpaceIsRejectedByNetHTTP` proving the rejection\nhappens at the net/http layer.",
"is_bot": false,
"headline": "refactor: drop space-to-underscore replacement in header names (#2441)",
"author_name": "Kévin Dunglas",
"author_login": "dunglas",
"committed_at": "2026-05-26T09:26:51Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "95216b1a41add02896feef20c8c40b4ef60e0ac2",
"body": null,
"is_bot": false,
"headline": "update incompatibilities section (#2420)",
"author_name": "Marc",
"author_login": "henderkes",
"committed_at": "2026-05-25T11:13:05Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "3704b986acc266e72b448b5c2baafffa81c1d080",
"body": "ext-parallel threads now use their parents thread_index when reaching into the go runtime, fixes #2339\n\n---------\n\nSigned-off-by: Marc <m@pyc.ac>\nCo-authored-by: Kévin Dunglas <kevin@dunglas.fr>",
"is_bot": false,
"headline": "fix ext-parallel crashes (#2438)",
"author_name": "Marc",
"author_login": "henderkes",
"committed_at": "2026-05-22T05:50:46Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "7e1a13306864899f43c193869506c3e26a1ce6a5",
"body": null,
"is_bot": false,
"headline": "ci: introduce release app to restore main branch protection (#2439)",
"author_name": "Kévin Dunglas",
"author_login": "dunglas",
"committed_at": "2026-05-21T13:30:31Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "64f085baeb276e3a5715418962b02070964aa6b6",
"body": "This reverts commit d00900cc32ea0829e066f72c6d06efc0edfe9513.",
"is_bot": false,
"headline": "Revert \"fix #2339: propagate parent thread_index via SG(server_context)\"",
"author_name": "henderkes",
"author_login": "henderkes",
"committed_at": "2026-05-21T11:46:38Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "d00900cc32ea0829e066f72c6d06efc0edfe9513",
"body": null,
"is_bot": false,
"headline": "fix #2339: propagate parent thread_index via SG(server_context)",
"author_name": "henderkes",
"author_login": "henderkes",
"committed_at": "2026-05-21T11:29:09Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "1d8235dd8074f1e960e8ff008da83d1d07880f5f",
"body": "TestTransitionThreadsWhileDoingRequests spawned transition goroutines\nthat read mainThread.state via thread.shutdown(). isDone.Store(true)\nsignalled them to stop but the test returned without waiting, so they\ncould still be running when the next test's initPHPThreads wrote a\nfresh mainThread.state, producing a -race failure on macOS.",
"is_bot": false,
"headline": "test: wait for transition goroutines to exit",
"author_name": "Kévin Dunglas",
"author_login": "dunglas",
"committed_at": "2026-05-19T08:11:14Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "5fe2014de3f61787b299192055a85ea2d81ae17c",
"body": "Bumps the github-actions group with 1 update: [mislav/bump-homebrew-formula-action](https://github.com/mislav/bump-homebrew-formula-action).\n\n\nUpdates `mislav/bump-homebrew-formula-action` from 3 to 4\n- [Release notes](https://github.com/mislav/bump-homebrew-formula-action/releases)\n- [Commits](http\n[…]\non\n dependency-version: '4'\n dependency-type: direct:production\n update-type: version-update:semver-major\n dependency-group: github-actions\n...\n\nSigned-off-by: dependabot[bot] <support@github.com>",
"is_bot": true,
"headline": "ci: bump mislav/bump-homebrew-formula-action in the github-actions group",
"author_name": "dependabot[bot]",
"author_login": "dependabot[bot]",
"committed_at": "2026-05-18T22:02:34Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "1a03bc23ef509d7002da766ff558617ecc57b6c3",
"body": "## Summary\n\nUPX is now disabled by default for the static build. To pack the binary\nwith UPX (Linux only), set `COMPRESS=1` at build time. The previous\n`NO_COMPRESS` flag is removed; CI invocations and the\n`static-builder-{musl,gnu}` Dockerfiles were updated accordingly. Docs\n(all locales) were refr\n[…]\nifact size is the concern, `xz`-compressing the release\nasset gives similar savings without any of the runtime downsides.\n\nUsers who still want a packed binary can opt in explicitly with\n`COMPRESS=1`.",
"is_bot": false,
"headline": "build: make UPX packing opt-in via COMPRESS env var (#2429)",
"author_name": "Kévin Dunglas",
"author_login": "dunglas",
"committed_at": "2026-05-16T16:03:24Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "cb9e3dad73032b848b7fc8e1403d4cd9bc1864e9",
"body": "## Root cause\n\n`TestHotReload` was failing on\nhttps://github.com/php/frankenphp/actions/runs/25961840516/job/76318473726\n(`linux/arm/v7`, dispatched from\nhttps://github.com/php/frankenphp/pull/2430) with:\n\n> context deadline exceeded (Client.Timeout or context cancellation\nwhile reading body)\n\n`cadd\n[…]\nn the buffer,\nand Go's `-timeout` provides the outer deadline — the 5 s inner cap was\nredundant.\n\nThe other failing job on that run (`linux/amd64`, e-dant/watcher cmake\nbuild) is unrelated to this PR.",
"is_bot": false,
"headline": "test(hotreload): increase caddytest's Client.Timeout (#2431)",
"author_name": "Kévin Dunglas",
"author_login": "dunglas",
"committed_at": "2026-05-16T15:11:38Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "586076825fca50e9f38be43f2a2410093dbb6ce8",
"body": "## Root cause\n\n`runner-php-8-3-31-trixie` on\nhttps://github.com/php/frankenphp/actions/runs/25961840516/job/76318473755\n(PR https://github.com/php/frankenphp/pull/2430, `linux/amd64`) failed\nwith:\n\n> curl: (2) no URL specified\n> tar: Child returned status 1\n\nTwo converging issues:\n\n1. **`.github/wor\n[…]\n check that prints a useful error. Heredoc form\nfor readability; logic kept POSIX so it works under both `bash` (Debian)\nand `ash` (Alpine).\n\nCmake/build flags and final `ldconfig` step are unchanged.",
"is_bot": false,
"headline": "build(docker): make e-dant/watcher install robust (#2432)",
"author_name": "Kévin Dunglas",
"author_login": "dunglas",
"committed_at": "2026-05-16T15:01:35Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "a6db7892e636e07b4d9aaa2e4925a3bfae5a4ba8",
"body": "Signed-off-by: Sascha Greuel <github@1-2.dev>",
"is_bot": false,
"headline": "docs: Add WoltLab Suite Example",
"author_name": "Sascha Greuel",
"author_login": "SoftCreatR",
"committed_at": "2026-05-16T10:00:34Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "63a3f6b9b4198f155efc5bc18f3ca1453c6f4018",
"body": null,
"is_bot": false,
"headline": "fix(docker): qualify attest subject with registry hostname (#2427)",
"author_name": "Kévin Dunglas",
"author_login": "dunglas",
"committed_at": "2026-05-15T23:42:14Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "3c9ce2acce5f050de7feb0dbb00435ccfacbc0e6",
"body": "The prepare job's `ref` output fell through to `inputs.version` for\nworkflow_dispatch, which my release.yaml passes without the leading\n`v` (the workflow's \"version\" input is the bare semver). The build\njob's actions/checkout@v6 then tried to fetch a ref named `1.12.3`\nwhich doesn't exist, so the en\n[…]\ns downstream builds) without breaking the\nexisting manual-dispatch-with-version-input path.\n\nCaught by failed run https://github.com/php/frankenphp/actions/runs/25923390001\nduring the v1.12.3 release.",
"is_bot": false,
"headline": "fix(docker): respect github.ref_name when dispatched against a tag",
"author_name": "Kévin Dunglas",
"author_login": "dunglas",
"committed_at": "2026-05-15T15:24:56Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "77b8e8e478890173c18add18523a8c4185d96d42",
"body": "TestHotReload reads the Mercure SSE stream in a loop and asserted\n`require.NoError(t, err)` immediately after each Read. On Windows CI\nthe server occasionally returns (n>0, io.EOF) on the same syscall it\nflushes the matching event — the test was throwing away the n bytes\nalready in the buffer and fa\n[…]\ne\nerror. Also writes only the n actual bytes instead of the whole 1024\nbuffer (which was including stale data past n on each iteration).\n\nFlaky run that prompted this: php#2424 Windows job 76193101402",
"is_bot": false,
"headline": "test(hotreload): tolerate (n>0, EOF) on Windows SSE read",
"author_name": "Kévin Dunglas",
"author_login": "dunglas",
"committed_at": "2026-05-15T15:18:28Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "2bc9866a04197b3488ec6d29f75e9daa31645f4f",
"body": "The v3 action's input is `homebrew-tap`, not `tap`, and it wants the\ntap repository name (e.g. `dunglas/homebrew-frankenphp`) rather than\nthe brew tap shorthand. The unknown `tap` input was silently ignored,\nso the action defaulted to `Homebrew/homebrew-core` and the v1.12.3\ndispatch failed with HTTP 403 trying to push there.",
"is_bot": false,
"headline": "fix(release): correct mislav/bump-homebrew-formula-action inputs",
"author_name": "Kévin Dunglas",
"author_login": "dunglas",
"committed_at": "2026-05-15T14:24:07Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "f650727ccdca84b1f911121d56de6fdcab9a061e",
"body": null,
"is_bot": false,
"headline": "fix(release): detect resume by tag, not by HEAD commit message (#2423)",
"author_name": "Kévin Dunglas",
"author_login": "dunglas",
"committed_at": "2026-05-15T13:54:24Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "c8022898097dab35bdd0166bf985c2fc05c3cf74",
"body": "`gh release create --verify-tag` (and the underlying draft creation)\nuses a GraphQL ref lookup that lagged behind the Git Data API we use\nto push the tag. Hitting the draft step seconds after tag creation\ngot us \"no matches found for `v1.12.3`\" or, without --verify-tag,\nan `untagged-*` placeholder r\n[…]\n/generate-notes` + `/releases` POST\nendpoints. They consult the same backend that already serves the\nfreshly-pushed tag, so the draft attaches cleanly to v<version>.\n\nCaught while dispatching v1.12.3.",
"is_bot": false,
"headline": "fix(release): draft via REST to dodge gh CLI GraphQL tag lag",
"author_name": "Kévin Dunglas",
"author_login": "dunglas",
"committed_at": "2026-05-15T13:30:46Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "86fb32e829cbb414df74e1f1c23855915d399ac5",
"body": null,
"is_bot": true,
"headline": "chore: prepare release 1.12.3 [skip ci]",
"author_name": "github-actions[bot]",
"author_login": "github-actions[bot]",
"committed_at": "2026-05-15T13:18:54Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "d13806a9b7947db4e2b5de815fe02e0576076727",
"body": "## Summary\n\nThe `Commit and tag via GitHub API` step in `release.yaml` blew up on\nits first real dispatch\n(https://github.com/php/frankenphp/actions/runs/25914409401):\n\n```\n/usr/bin/jq: Argument list too long\ngh: Validation Failed (HTTP 422)\n```\n\n`jq --arg content \"$(base64 -w0 <default.pgo)\" ...` w\n[…]\n feed it via `--rawfile` so jq\nreads it from disk, not the argv. `go.mod` and `go.sum` keep going\nthrough `--rawfile` for consistency.\n\nThis needs to land before the next release dispatch can succeed.",
"is_bot": false,
"headline": "fix(release): stage PGO blob through --rawfile to avoid ARG_MAX (#2421)",
"author_name": "Kévin Dunglas",
"author_login": "dunglas",
"committed_at": "2026-05-15T12:08:41Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "2d0f480329a02571d6f635dad9fdb066e1a11e81",
"body": "* fix: drop Unicode-aware fallback in CGI splitPos\n\nBoth fallbacks in splitPos relied on golang.org/x/text/search with\nsearch.IgnoreCase, which performs Unicode equivalence matching far beyond\nASCII case folding. Combined with the validated-ASCII guarantee on every\nsplit entry, that fallback turned \n[…]\n.golang.org/grpc v1.81.0 -> v1.81.1\n\noasdiff/yaml is held at v0.0.9: v0.1.0 drops\nyaml.UnmarshalWithOriginTree, which getkin/kin-openapi@v0.138.0 still\nreferences, breaking the caddy/frankenphp build.",
"is_bot": false,
"headline": "Merge commit from fork",
"author_name": "Kévin Dunglas",
"author_login": "dunglas",
"committed_at": "2026-05-15T10:55:46Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "166684f811f7e04d4e42fa2e37e130b7ae9a706c",
"body": "## Summary\n\n- `release.sh` is reduced to a thin dispatcher: validates the semver,\nchecks the operator is on a clean local `main` in sync with\n`origin/main`, then `gh workflow run release.yaml -f version=$1`.\nTag-existence pre-check lives in the workflow itself, not the\ndispatcher.\n- New `.github/wor\n[…]\nnvironment.\n- Provision `HOMEBREW_TOKEN`: PAT with write access to\n`dunglas/homebrew-frankenphp`. `GITHUB_TOKEN` covers everything else\n(commit/tag via REST API, draft release, downstream dispatches).",
"is_bot": false,
"headline": "ci: move release flow into a GitHub Actions workflow (#2417)",
"author_name": "Kévin Dunglas",
"author_login": "dunglas",
"committed_at": "2026-05-15T09:50:14Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "138b6f46d86211626ce2f959de5f84ee67fb8d62",
"body": "Generate SLSA build-provenance attestations for every released\nartifact via actions/attest@v4 (the recommended action that\nauto-fills the SLSA v1 predicate).\n\n- static.yaml: switch the three existing attest-build-provenance\n calls to actions/attest and add the artifact-metadata:write\n permission r\n[…]\n\n- windows.yaml: attest the released frankenphp-windows-x86_64.zip.\n- docker.yaml: attest each pushed manifest list (builder + runner\n per variant) by digest, pushing the attestation to the registry.",
"is_bot": false,
"headline": "ci: attest release artifacts with actions/attest",
"author_name": "Kévin Dunglas",
"author_login": "dunglas",
"committed_at": "2026-05-14T14:41:24Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "f1ed91f4ba8c1d1993d169f433a19c7b6f755ac0",
"body": "Factor repeated CI plumbing into three composite actions under\n`.github/actions/`:\n\n- **`setup-go/`** — reads `go-version-file: go.mod` with `check-latest:\ntrue` so future Go upgrades only require bumping `go.mod`. Disables the\nGo module cache on tag-triggered runs (`!startsWith(github.ref,\n'refs/ta\n[…]\nte actions get\nauto-bumped.\n- Zero zizmor ignore pragmas added by this PR (`cache-poisoning` and\n`github-env` were both eliminated by structural changes rather than\nsilencing).\n\nNet: +96 / -107 lines.",
"is_bot": false,
"headline": "ci: factor plumbing calls into a composite actions (#2412)",
"author_name": "Kévin Dunglas",
"author_login": "dunglas",
"committed_at": "2026-05-13T14:07:08Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "17c0911ed60cb2683904b8a2bd815b8ce4904943",
"body": "Automated refresh of `caddy/frankenphp/default.pgo` from\n`65abcbbf6ee1791d364b3ac5f9cb05d866228440`, generated with\n`BENCH_SEC=30` across every script in `profiles/app/` in both regular\nand worker mode.\n\nCo-authored-by: dunglas <57224+dunglas@users.noreply.github.com>",
"is_bot": true,
"headline": "perf(pgo): refresh PGO profile (#2414)",
"author_name": "github-actions[bot]",
"author_login": "github-actions[bot]",
"committed_at": "2026-05-13T13:33:54Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "65abcbbf6ee1791d364b3ac5f9cb05d866228440",
"body": "`TestAutoScaleRegularThreadsOnAutomaticThreadLimit` (and its sibling\n`TestAutoScaleWorkerThreads`) in `caddy/admin_test.go` would burn the\npackage-wide 10 minute Go test timeout whenever the PHP server returned\na connection error during the load loop. This was observed on the PHP\n8.5 / Linux CI matr\n[…]\nents the\nWaitGroup.\n- Break out of the retry loop once `t.Failed()` is true so we don't keep\nhammering an already-broken server for another 9 rounds.\n\nNet diff: +6 / -2 lines per test, no new imports.",
"is_bot": false,
"headline": "test: stop autoscale tests from hanging on request failure (#2413)",
"author_name": "Kévin Dunglas",
"author_login": "dunglas",
"committed_at": "2026-05-13T13:07:26Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "6ae610c6d8da4c91e9b7bc51d7f3ee059151220f",
"body": "## Summary\n\nThe PGO refresh workflow at\nhttps://github.com/php/frankenphp/actions/runs/25779871543/job/75719971682\n(and the two prior runs - the job has never succeeded) failed when\nbuilding `frankenphp-pgo` with:\n\n```\npreprofile: error parsing profile: profile missing Function.start_line data (Go v\n[…]\nutput\" only when\nits symbolization preserves metadata - that's true with\nllvm-symbolizer's JSON path added in\nhttps://github.com/google/pprof/pull/891, but not with the addr2line\nfallback used in CI.)",
"is_bot": false,
"headline": "fix(pgo): skip re-symbolization when merging pprof profiles (#2407)",
"author_name": "Kévin Dunglas",
"author_login": "dunglas",
"committed_at": "2026-05-13T08:52:48Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "19a290790180d3ffe2c6f570b60c89b532d7e044",
"body": "…#2403)\n\n## Summary\n\n- `docs/translate.php`: rebuild the Gemini request payload to match the\nv1beta API contract — use top-level `systemInstruction` and make `parts`\nan array of objects. The previous shape (`role: \"model\"` first + `parts`\nas a single object) returned `HTTP 400` (see [run\n25736017574\n[…]\nr prompts in `translate.php`\n- Drop the `/en/`, `/es/`, `/fr/`, `/zh/` language segments from every\n`php.net/manual/...` URL across `docs/**/*.md` so links resolve to the\nvisitor's preferred language.",
"is_bot": false,
"headline": "fix: translate.php Gemini payload + drop /<lang>/ from php.net URLs (…",
"author_name": "Kévin Dunglas",
"author_login": "dunglas",
"committed_at": "2026-05-13T08:35:44Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "9457da650548f8fd36f0b37b20bee20312e52313",
"body": null,
"is_bot": false,
"headline": "fix: reinstall libbrotli-dev in pgo-CI (#2406)",
"author_name": "Marc",
"author_login": "henderkes",
"committed_at": "2026-05-13T05:16:52Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "d7f582aabc396becd023882a0e79c168432ce1ba",
"body": "… misleading conditionals (#2381)",
"is_bot": false,
"headline": "test(extgen): tighten parser tests by asserting warnings and dropping…",
"author_name": "Alexandre Daubois",
"author_login": "alexandre-daubois",
"committed_at": "2026-05-12T13:55:37Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "d50aef2bd8edce33015c730a8d4aee8acefee70c",
"body": null,
"is_bot": false,
"headline": "chore: bump deps (#2402)",
"author_name": "Kévin Dunglas",
"author_login": "dunglas",
"committed_at": "2026-05-12T13:50:15Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "be23f0ae1269f82ba0f00acd96b39abc6564d31c",
"body": "…d throughput) (#2361)\n\n- [x] add basic benchmark php files and script to generate pgo profiles\n(requires wrk)\n- [x] actual proper benchmarking\n- [x] github action to auto-sync pgo profiles on merge to main\n- [ ] use pgo in builds (to be done after this PR is merged)\n\ncloses https://github.com/php/f\n[…]\nsource and compiled into a static musl binary, in case\nyou can't get wrk from package manager (like on rhel):\nhttps://files.henderkes.com/x86_64-linux/wrk\nhttps://files.henderkes.com/aarch64-linux/wrk",
"is_bot": false,
"headline": "perf: use PGO to improve FrankenPHP's go performance (7-8% Hello Worl…",
"author_name": "Marc",
"author_login": "henderkes",
"committed_at": "2026-05-12T13:35:52Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "37401185d593818eb0dfc40b8e39ef80910ac5a2",
"body": "…ounting (#2379)",
"is_bot": false,
"headline": "fix(extgen): extract Go function bodies via go/ast instead of brace c…",
"author_name": "Alexandre Daubois",
"author_login": "alexandre-daubois",
"committed_at": "2026-05-12T13:27:39Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "c82ee0722c9efa834466ce79c27417e2355da684",
"body": "Fixes previously broken link in to Laravel's Trusted Proxies setup.\n\n---------\n\nSigned-off-by: Miro Toman <44134862+mtmn@users.noreply.github.com>\nCo-authored-by: Kévin Dunglas <kevin@dunglas.fr>",
"is_bot": false,
"headline": "docs: fix laravel trusted proxies url (#2359)",
"author_name": "Miro Toman",
"author_login": "mtmn",
"committed_at": "2026-05-12T12:59:24Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "9b5111139d2fb248691f111bf38a9b1de098262b",
"body": "…t32 coercion (#2380)\n\nPreviously *float64 silently accepted *float32, while float64 rejected\nfloat32, which lets broken bindings compile.",
"is_bot": false,
"headline": "fix(extgen): make Go type compatibility check symmetric and drop floa…",
"author_name": "Alexandre Daubois",
"author_login": "alexandre-daubois",
"committed_at": "2026-05-12T12:56:36Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "918ee7a70d79fb8eb666d5c463788ed12b4ba352",
"body": "…377)",
"is_bot": false,
"headline": "fix(extgen): escape quotes and control chars in C string literals (#2…",
"author_name": "Alexandre Daubois",
"author_login": "alexandre-daubois",
"committed_at": "2026-05-12T12:56:17Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "d1e33cbfa03efb0acd8136d1f360b6e3c3ecb5d4",
"body": null,
"is_bot": false,
"headline": "perf(extgen): hoist const block regexes out of parser loop (#2378)",
"author_name": "Alexandre Daubois",
"author_login": "alexandre-daubois",
"committed_at": "2026-05-12T12:55:52Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "5c20828e1e8110c19c6eeed73faff33f1bb75281",
"body": null,
"is_bot": false,
"headline": "fix(extgen): reset iota counter at the start of each const block (#2375)",
"author_name": "Alexandre Daubois",
"author_login": "alexandre-daubois",
"committed_at": "2026-05-12T12:55:41Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "d90c7283360d61fb3b41d6e04d2c9e6e9b43b122",
"body": null,
"is_bot": false,
"headline": "refactor(extgen): share signature and parameter parsing helpers (#2376)",
"author_name": "Alexandre Daubois",
"author_login": "alexandre-daubois",
"committed_at": "2026-05-12T12:55:27Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "68573a9b640a679cbf420169cdbb960317c6db16",
"body": "## Summary\n\nThe Caddy module under `caddy/` has its own `go.mod` and was never\nlinted by CI. Enabling lint surfaced a handful of real issues; this PR\nfixes them and wires the linter in.\n\n### Workflow\n\nAdds a second `golangci/golangci-lint-action@v9` step with\n`working-directory: caddy`, gated on `ma\n[…]\n with the CI build tags\n`nobadger,nomysql,nopgx`.\n\n---------\n\nSigned-off-by: Kévin Dunglas <kevin@dunglas.fr>\nCo-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>",
"is_bot": false,
"headline": "ci: run golangci-lint on the Caddy module (#2397)",
"author_name": "Kévin Dunglas",
"author_login": "dunglas",
"committed_at": "2026-05-07T09:49:32Z",
"body_truncated": true,
"is_coding_agent": true
},
{
"oid": "24be66812a4ef5db6624133ee5cc7c1acdaa8a00",
"body": "## Summary\n\n- Adds YAML frontmatter (`title`, `description`) to every English doc\nunder `docs/*.md` for SEO and LLM/RAG ingestion.\n- Renames generic headings (`## Setup`, `## Configuration`, etc.) to\ntopic-specific ones; updates the one inbound cross-link affected by an\nanchor rename.\n- Tightens cod\n[…]\nouched. Re-run\n`docs/translate.php` after merge to propagate the new frontmatter and\nrenamed headings.\n- Anchor renames are scoped to genuinely generic headings;\nalready-specific ones were left alone.",
"is_bot": false,
"headline": "docs: add SEO frontmatter, llms.txt, and code-block hygiene (#2394)",
"author_name": "Kévin Dunglas",
"author_login": "dunglas",
"committed_at": "2026-05-06T15:24:49Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "2ac6c419fec9c80f2bcecb174faecae42b58eac1",
"body": "First step of the split suggested in #2287: land the force-kill\ninfrastructure as a standalone, reviewable primitive independent of\nbackground workers.\n\n## Design\n\nEach PHP thread, at boot from its own TSRM context, hands a\n`force_kill_slot` (pointers to its `EG(vm_interrupt)` and\n`EG(timed_out)`\nat\n[…]\nckThread` drives the full path via a\nmarker file so `RestartWorkers` only arms once the worker is proven\nparked in `sleep()`, then asserts bounded elapsed time and that the\npost-sleep echo never runs.",
"is_bot": false,
"headline": "feat: cross-platform force-kill primitive for stuck PHP threads (#2365)",
"author_name": "Nicolas Grekas",
"author_login": "nicolas-grekas",
"committed_at": "2026-05-04T14:38:32Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "9208c550b29e012dce36ff8c39238f4493592289",
"body": "…#2366)\n\nSecond step of the split suggested in #2287: land the persistent-zval\nsubsystem as a standalone, reviewable header, independent of background\nworkers. This is the subsystem most likely to hide latent refcount or\nmemory-lifetime bugs; reviewing it in isolation is higher-signal than\nfinding i\n[…]\nPHP_TEST_HOOKS` guard around the header include goes\n away in the PR that lands the first real caller; the test hook\n itself goes away in that same step once end-to-end tests cover the\n code paths.",
"is_bot": false,
"headline": "feat: persistent-zval helpers (deep-copy zval trees across threads) (…",
"author_name": "Nicolas Grekas",
"author_login": "nicolas-grekas",
"committed_at": "2026-05-04T14:23:22Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "28570123c3331f5569d8cd2499bc629b3f386ce4",
"body": null,
"is_bot": false,
"headline": "fix(extgen): emit parser warnings to stderr instead of stdout (#2374)",
"author_name": "Alexandre Daubois",
"author_login": "alexandre-daubois",
"committed_at": "2026-05-04T13:54:26Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "a1334b6fc523121fa02f8131d6ff23300b7f8154",
"body": "Third step of the split suggested in #2287: land the handler-interface\nextension point that later handler types (background workers) need,\nwithout introducing any new behaviour.\n\nEach handler gains a `drain()` method, called by `drainWorkerThreads`\nright before `drainChan` is closed. All current imp\n[…]\nve.go` /\n `threadtasks_test.go` — empty `drain()` on each handler.\n- `worker.go` — `drainWorkerThreads` calls `thread.handler.drain()`\n right before `close(thread.drainChan)`.\n\nNet change: +15 / -0.",
"is_bot": false,
"headline": "refactor: add drain() seam to threadHandler interface (#2367)",
"author_name": "Nicolas Grekas",
"author_login": "nicolas-grekas",
"committed_at": "2026-05-04T13:08:14Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "09bf0470adc02a4b8d7b122962e03d158c8e811a",
"body": "The Linux Caddy module tests fail at compile time:\n\n```\n../../../../go/pkg/mod/github.com/google/brotli/go/cbrotli@v1.1.0/reader.go:13:10: fatal error: brotli/decode.h: No such file or directory\n```\n\n`caddy/` pulls in\n[`github.com/dunglas/caddy-cbrotli`](https://github.com/dunglas/caddy-cbrotli),\nwh\n[…]\nnphp/actions/runs/25315574252/job/74212221237\nand on every recent main run, e.g.\nhttps://github.com/php/frankenphp/actions/runs/25286789334.\n\n---------\n\nSigned-off-by: Kévin Dunglas <kevin@dunglas.fr>",
"is_bot": false,
"headline": "ci: reinstall libbrotli-dev on Linux test runners (#2391)",
"author_name": "Kévin Dunglas",
"author_login": "dunglas",
"committed_at": "2026-05-04T12:36:05Z",
"body_truncated": true,
"is_coding_agent": false
}
],
"releases_count": 53,
"commits_last_year": 392,
"latest_release_at": "2026-07-21T13:45:03Z",
"latest_release_tag": "v1.12.6",
"releases_from_tags": false,
"days_since_last_push": 0,
"active_weeks_last_year": 51,
"days_since_latest_release": 3,
"mean_days_between_releases": 23.2
},
"community": {
"has_readme": true,
"has_license": true,
"has_description": true,
"has_contributing": true,
"health_percentage": 62,
"has_issue_template": false,
"has_code_of_conduct": false,
"has_pull_request_template": false
},
"ecosystem": {
"packages": [
{
"name": "github.com/dunglas/frankenphp",
"exists": true,
"license": null,
"keywords": [],
"ecosystem": "go",
"matches_repo": false,
"registry_url": "https://pkg.go.dev/github.com/dunglas/frankenphp",
"is_deprecated": false,
"latest_version": "v1.12.6",
"repository_url": "https://github.com/dunglas/frankenphp",
"versions_count": 55,
"total_downloads": null,
"dependents_count": null,
"deprecation_note": null,
"maintainers_count": null,
"monthly_downloads": null,
"first_published_at": null,
"latest_published_at": "2026-07-20T14:58:29Z",
"latest_version_yanked": null,
"days_since_latest_publish": 4
},
{
"name": "github.com/dunglas/frankenphp/caddy",
"exists": true,
"license": null,
"keywords": [],
"ecosystem": "go",
"matches_repo": false,
"registry_url": "https://pkg.go.dev/github.com/dunglas/frankenphp/caddy",
"is_deprecated": false,
"latest_version": "v1.12.6",
"repository_url": "https://github.com/dunglas/frankenphp",
"versions_count": 55,
"total_downloads": null,
"dependents_count": null,
"deprecation_note": null,
"maintainers_count": null,
"monthly_downloads": null,
"first_published_at": null,
"latest_published_at": "2026-07-20T14:58:29Z",
"latest_version_yanked": null,
"days_since_latest_publish": 4
}
]
},
"popularity": {
"forks": 468,
"stars": 11242,
"watchers": 85,
"fork_history": {
"days": [
{
"date": "2022-10-14",
"count": 4
},
{
"date": "2022-10-15",
"count": 10
},
{
"date": "2022-10-16",
"count": 10
},
{
"date": "2022-10-17",
"count": 8
},
{
"date": "2022-10-18",
"count": 1
},
{
"date": "2022-10-19",
"count": 5
},
{
"date": "2022-10-20",
"count": 1
},
{
"date": "2022-10-21",
"count": 1
},
{
"date": "2022-10-23",
"count": 1
},
{
"date": "2022-10-24",
"count": 1
},
{
"date": "2022-10-26",
"count": 1
},
{
"date": "2022-10-27",
"count": 1
},
{
"date": "2022-10-31",
"count": 2
},
{
"date": "2022-11-07",
"count": 1
},
{
"date": "2022-11-08",
"count": 2
},
{
"date": "2022-11-10",
"count": 1
},
{
"date": "2022-11-12",
"count": 1
},
{
"date": "2022-11-14",
"count": 1
},
{
"date": "2022-11-18",
"count": 1
},
{
"date": "2022-11-21",
"count": 1
},
{
"date": "2022-11-24",
"count": 1
},
{
"date": "2022-12-02",
"count": 1
},
{
"date": "2022-12-21",
"count": 1
},
{
"date": "2023-01-09",
"count": 1
},
{
"date": "2023-01-16",
"count": 1
},
{
"date": "2023-02-21",
"count": 1
},
{
"date": "2023-02-23",
"count": 1
},
{
"date": "2023-03-09",
"count": 1
},
{
"date": "2023-03-19",
"count": 1
},
{
"date": "2023-04-17",
"count": 1
},
{
"date": "2023-04-28",
"count": 1
},
{
"date": "2023-05-05",
"count": 1
},
{
"date": "2023-05-22",
"count": 1
},
{
"date": "2023-07-16",
"count": 1
},
{
"date": "2023-09-13",
"count": 1
},
{
"date": "2023-09-19",
"count": 1
},
{
"date": "2023-09-23",
"count": 1
},
{
"date": "2023-09-25",
"count": 1
},
{
"date": "2023-10-05",
"count": 1
},
{
"date": "2023-10-09",
"count": 2
},
{
"date": "2023-10-10",
"count": 1
},
{
"date": "2023-10-11",
"count": 1
},
{
"date": "2023-10-14",
"count": 1
},
{
"date": "2023-10-17",
"count": 1
},
{
"date": "2023-10-20",
"count": 1
},
{
"date": "2023-10-23",
"count": 1
},
{
"date": "2023-10-30",
"count": 1
},
{
"date": "2023-11-01",
"count": 1
},
{
"date": "2023-11-06",
"count": 1
},
{
"date": "2023-11-08",
"count": 1
},
{
"date": "2023-11-22",
"count": 1
},
{
"date": "2023-11-25",
"count": 2
},
{
"date": "2023-12-07",
"count": 1
},
{
"date": "2023-12-08",
"count": 3
},
{
"date": "2023-12-09",
"count": 2
},
{
"date": "2023-12-10",
"count": 2
},
{
"date": "2023-12-11",
"count": 3
},
{
"date": "2023-12-12",
"count": 1
},
{
"date": "2023-12-13",
"count": 1
},
{
"date": "2023-12-14",
"count": 2
},
{
"date": "2023-12-15",
"count": 1
},
{
"date": "2023-12-17",
"count": 1
},
{
"date": "2023-12-18",
"count": 1
},
{
"date": "2023-12-20",
"count": 4
},
{
"date": "2023-12-22",
"count": 1
},
{
"date": "2023-12-23",
"count": 1
},
{
"date": "2023-12-25",
"count": 1
},
{
"date": "2023-12-26",
"count": 2
},
{
"date": "2023-12-28",
"count": 1
},
{
"date": "2024-01-08",
"count": 1
},
{
"date": "2024-01-09",
"count": 2
},
{
"date": "2024-01-10",
"count": 1
},
{
"date": "2024-01-19",
"count": 1
},
{
"date": "2024-01-22",
"count": 1
},
{
"date": "2024-01-26",
"count": 1
},
{
"date": "2024-01-28",
"count": 1
},
{
"date": "2024-02-05",
"count": 2
},
{
"date": "2024-02-07",
"count": 2
},
{
"date": "2024-02-09",
"count": 1
},
{
"date": "2024-02-10",
"count": 1
},
{
"date": "2024-02-11",
"count": 1
},
{
"date": "2024-02-14",
"count": 1
},
{
"date": "2024-02-16",
"count": 1
},
{
"date": "2024-02-17",
"count": 1
},
{
"date": "2024-02-18",
"count": 1
},
{
"date": "2024-02-22",
"count": 1
},
{
"date": "2024-02-25",
"count": 1
},
{
"date": "2024-02-27",
"count": 1
},
{
"date": "2024-02-28",
"count": 2
},
{
"date": "2024-02-29",
"count": 2
},
{
"date": "2024-03-01",
"count": 1
},
{
"date": "2024-03-03",
"count": 1
},
{
"date": "2024-03-04",
"count": 2
},
{
"date": "2024-03-11",
"count": 2
},
{
"date": "2024-03-12",
"count": 1
},
{
"date": "2024-03-13",
"count": 2
},
{
"date": "2024-03-19",
"count": 1
},
{
"date": "2024-03-21",
"count": 1
},
{
"date": "2024-03-24",
"count": 1
},
{
"date": "2024-03-26",
"count": 1
},
{
"date": "2024-03-28",
"count": 2
},
{
"date": "2024-03-29",
"count": 1
},
{
"date": "2024-04-07",
"count": 1
},
{
"date": "2024-04-11",
"count": 1
},
{
"date": "2024-04-14",
"count": 1
},
{
"date": "2024-04-16",
"count": 1
},
{
"date": "2024-04-22",
"count": 1
},
{
"date": "2024-04-23",
"count": 1
},
{
"date": "2024-04-28",
"count": 1
},
{
"date": "2024-04-30",
"count": 1
},
{
"date": "2024-05-11",
"count": 1
},
{
"date": "2024-05-23",
"count": 1
},
{
"date": "2024-05-30",
"count": 4
},
{
"date": "2024-06-01",
"count": 2
},
{
"date": "2024-06-02",
"count": 1
},
{
"date": "2024-06-18",
"count": 1
},
{
"date": "2024-06-24",
"count": 1
},
{
"date": "2024-06-25",
"count": 1
},
{
"date": "2024-06-28",
"count": 1
},
{
"date": "2024-07-05",
"count": 1
},
{
"date": "2024-07-09",
"count": 2
},
{
"date": "2024-07-11",
"count": 1
},
{
"date": "2024-07-13",
"count": 1
},
{
"date": "2024-07-15",
"count": 1
},
{
"date": "2024-07-24",
"count": 1
},
{
"date": "2024-07-26",
"count": 1
},
{
"date": "2024-08-04",
"count": 1
},
{
"date": "2024-08-07",
"count": 2
},
{
"date": "2024-08-08",
"count": 2
},
{
"date": "2024-08-14",
"count": 1
},
{
"date": "2024-08-27",
"count": 1
},
{
"date": "2024-09-10",
"count": 1
},
{
"date": "2024-09-12",
"count": 1
},
{
"date": "2024-09-14",
"count": 1
},
{
"date": "2024-09-21",
"count": 1
},
{
"date": "2024-09-22",
"count": 1
},
{
"date": "2024-09-29",
"count": 1
},
{
"date": "2024-10-01",
"count": 2
},
{
"date": "2024-10-05",
"count": 1
},
{
"date": "2024-10-07",
"count": 1
},
{
"date": "2024-10-08",
"count": 1
},
{
"date": "2024-10-12",
"count": 2
},
{
"date": "2024-10-13",
"count": 2
},
{
"date": "2024-10-18",
"count": 1
},
{
"date": "2024-10-30",
"count": 1
},
{
"date": "2024-11-01",
"count": 1
},
{
"date": "2024-11-07",
"count": 1
},
{
"date": "2024-11-13",
"count": 1
},
{
"date": "2024-11-14",
"count": 1
},
{
"date": "2024-11-15",
"count": 2
},
{
"date": "2024-11-16",
"count": 2
},
{
"date": "2024-11-18",
"count": 2
},
{
"date": "2024-12-02",
"count": 1
},
{
"date": "2024-12-03",
"count": 3
},
{
"date": "2024-12-04",
"count": 1
},
{
"date": "2024-12-11",
"count": 1
},
{
"date": "2024-12-12",
"count": 1
},
{
"date": "2024-12-13",
"count": 1
},
{
"date": "2024-12-16",
"count": 1
},
{
"date": "2024-12-20",
"count": 2
},
{
"date": "2024-12-23",
"count": 1
},
{
"date": "2024-12-24",
"count": 2
},
{
"date": "2024-12-27",
"count": 1
},
{
"date": "2024-12-31",
"count": 1
},
{
"date": "2025-01-04",
"count": 1
},
{
"date": "2025-01-05",
"count": 1
},
{
"date": "2025-01-06",
"count": 1
},
{
"date": "2025-01-08",
"count": 1
},
{
"date": "2025-01-09",
"count": 2
},
{
"date": "2025-01-13",
"count": 1
},
{
"date": "2025-01-18",
"count": 1
},
{
"date": "2025-01-19",
"count": 1
},
{
"date": "2025-01-21",
"count": 2
},
{
"date": "2025-01-23",
"count": 1
},
{
"date": "2025-01-25",
"count": 1
},
{
"date": "2025-02-04",
"count": 1
},
{
"date": "2025-02-17",
"count": 4
},
{
"date": "2025-02-18",
"count": 1
},
{
"date": "2025-02-20",
"count": 2
},
{
"date": "2025-02-25",
"count": 1
},
{
"date": "2025-02-28",
"count": 1
},
{
"date": "2025-03-09",
"count": 1
},
{
"date": "2025-03-11",
"count": 1
},
{
"date": "2025-03-23",
"count": 1
},
{
"date": "2025-03-26",
"count": 1
},
{
"date": "2025-03-27",
"count": 1
},
{
"date": "2025-03-30",
"count": 2
},
{
"date": "2025-03-31",
"count": 1
},
{
"date": "2025-04-01",
"count": 1
},
{
"date": "2025-04-07",
"count": 1
},
{
"date": "2025-04-10",
"count": 1
},
{
"date": "2025-04-11",
"count": 1
},
{
"date": "2025-04-13",
"count": 1
},
{
"date": "2025-04-17",
"count": 1
},
{
"date": "2025-04-26",
"count": 1
},
{
"date": "2025-04-29",
"count": 1
},
{
"date": "2025-05-02",
"count": 1
},
{
"date": "2025-05-05",
"count": 1
},
{
"date": "2025-05-10",
"count": 1
},
{
"date": "2025-05-14",
"count": 1
},
{
"date": "2025-05-16",
"count": 1
},
{
"date": "2025-05-17",
"count": 1
},
{
"date": "2025-05-18",
"count": 1
},
{
"date": "2025-05-20",
"count": 3
},
{
"date": "2025-05-22",
"count": 1
},
{
"date": "2025-05-25",
"count": 2
},
{
"date": "2025-05-27",
"count": 1
},
{
"date": "2025-05-30",
"count": 1
},
{
"date": "2025-06-05",
"count": 1
},
{
"date": "2025-06-10",
"count": 1
},
{
"date": "2025-06-12",
"count": 1
},
{
"date": "2025-06-16",
"count": 1
},
{
"date": "2025-06-17",
"count": 2
},
{
"date": "2025-06-18",
"count": 1
},
{
"date": "2025-06-19",
"count": 6
},
{
"date": "2025-06-20",
"count": 4
},
{
"date": "2025-06-21",
"count": 3
},
{
"date": "2025-06-22",
"count": 1
},
{
"date": "2025-06-23",
"count": 3
},
{
"date": "2025-06-24",
"count": 2
},
{
"date": "2025-06-25",
"count": 2
},
{
"date": "2025-06-29",
"count": 1
},
{
"date": "2025-07-01",
"count": 3
},
{
"date": "2025-07-04",
"count": 2
},
{
"date": "2025-07-08",
"count": 2
},
{
"date": "2025-07-11",
"count": 1
},
{
"date": "2025-07-14",
"count": 2
},
{
"date": "2025-07-17",
"count": 2
},
{
"date": "2025-07-19",
"count": 2
},
{
"date": "2025-07-20",
"count": 2
},
{
"date": "2025-07-21",
"count": 1
},
{
"date": "2025-07-23",
"count": 1
},
{
"date": "2025-07-28",
"count": 1
},
{
"date": "2025-07-29",
"count": 1
},
{
"date": "2025-08-05",
"count": 2
},
{
"date": "2025-08-07",
"count": 1
},
{
"date": "2025-08-09",
"count": 2
},
{
"date": "2025-08-12",
"count": 1
},
{
"date": "2025-08-14",
"count": 1
},
{
"date": "2025-08-16",
"count": 1
},
{
"date": "2025-08-20",
"count": 1
},
{
"date": "2025-08-21",
"count": 1
},
{
"date": "2025-08-23",
"count": 1
},
{
"date": "2025-08-25",
"count": 1
},
{
"date": "2025-08-28",
"count": 1
},
{
"date": "2025-08-30",
"count": 1
},
{
"date": "2025-09-09",
"count": 1
},
{
"date": "2025-09-13",
"count": 1
},
{
"date": "2025-09-15",
"count": 2
},
{
"date": "2025-09-16",
"count": 2
},
{
"date": "2025-09-17",
"count": 1
},
{
"date": "2025-09-19",
"count": 2
},
{
"date": "2025-09-20",
"count": 1
},
{
"date": "2025-09-24",
"count": 1
},
{
"date": "2025-09-26",
"count": 1
},
{
"date": "2025-09-27",
"count": 1
},
{
"date": "2025-09-28",
"count": 1
},
{
"date": "2025-09-29",
"count": 1
},
{
"date": "2025-10-02",
"count": 1
},
{
"date": "2025-10-05",
"count": 1
},
{
"date": "2025-10-06",
"count": 1
},
{
"date": "2025-10-15",
"count": 1
},
{
"date": "2025-10-16",
"count": 1
},
{
"date": "2025-10-22",
"count": 2
},
{
"date": "2025-10-27",
"count": 1
},
{
"date": "2025-10-30",
"count": 1
},
{
"date": "2025-11-03",
"count": 1
},
{
"date": "2025-11-05",
"count": 1
},
{
"date": "2025-11-11",
"count": 1
},
{
"date": "2025-11-16",
"count": 1
},
{
"date": "2025-11-17",
"count": 1
},
{
"date": "2025-11-18",
"count": 1
},
{
"date": "2025-11-21",
"count": 2
},
{
"date": "2025-11-23",
"count": 1
},
{
"date": "2025-11-27",
"count": 1
},
{
"date": "2025-11-28",
"count": 1
},
{
"date": "2025-12-01",
"count": 1
},
{
"date": "2025-12-03",
"count": 1
},
{
"date": "2025-12-06",
"count": 2
},
{
"date": "2025-12-08",
"count": 2
},
{
"date": "2025-12-12",
"count": 1
},
{
"date": "2025-12-16",
"count": 2
},
{
"date": "2025-12-17",
"count": 1
},
{
"date": "2025-12-19",
"count": 1
},
{
"date": "2025-12-20",
"count": 1
},
{
"date": "2025-12-21",
"count": 1
},
{
"date": "2025-12-22",
"count": 1
},
{
"date": "2025-12-29",
"count": 1
},
{
"date": "2025-12-30",
"count": 2
},
{
"date": "2026-01-01",
"count": 1
},
{
"date": "2026-01-09",
"count": 1
},
{
"date": "2026-01-14",
"count": 1
},
{
"date": "2026-01-16",
"count": 1
},
{
"date": "2026-01-20",
"count": 1
},
{
"date": "2026-01-24",
"count": 1
},
{
"date": "2026-02-03",
"count": 1
},
{
"date": "2026-02-05",
"count": 1
},
{
"date": "2026-02-08",
"count": 1
},
{
"date": "2026-02-11",
"count": 2
},
{
"date": "2026-02-16",
"count": 1
},
{
"date": "2026-02-21",
"count": 1
},
{
"date": "2026-02-22",
"count": 1
},
{
"date": "2026-02-24",
"count": 1
},
{
"date": "2026-02-27",
"count": 1
},
{
"date": "2026-02-28",
"count": 1
},
{
"date": "2026-03-03",
"count": 1
},
{
"date": "2026-03-04",
"count": 1
},
{
"date": "2026-03-06",
"count": 1
},
{
"date": "2026-03-11",
"count": 1
},
{
"date": "2026-03-15",
"count": 1
},
{
"date": "2026-03-16",
"count": 1
},
{
"date": "2026-03-23",
"count": 2
},
{
"date": "2026-03-27",
"count": 1
},
{
"date": "2026-03-29",
"count": 2
},
{
"date": "2026-04-10",
"count": 1
},
{
"date": "2026-04-13",
"count": 1
},
{
"date": "2026-04-15",
"count": 2
},
{
"date": "2026-04-17",
"count": 1
},
{
"date": "2026-04-21",
"count": 1
},
{
"date": "2026-04-25",
"count": 1
},
{
"date": "2026-04-29",
"count": 2
},
{
"date": "2026-04-30",
"count": 1
},
{
"date": "2026-05-08",
"count": 1
},
{
"date": "2026-05-10",
"count": 2
},
{
"date": "2026-05-13",
"count": 1
},
{
"date": "2026-05-15",
"count": 1
},
{
"date": "2026-05-17",
"count": 1
},
{
"date": "2026-05-22",
"count": 1
},
{
"date": "2026-05-28",
"count": 1
},
{
"date": "2026-06-03",
"count": 1
},
{
"date": "2026-06-04",
"count": 1
},
{
"date": "2026-06-10",
"count": 1
},
{
"date": "2026-06-13",
"count": 1
},
{
"date": "2026-06-18",
"count": 1
},
{
"date": "2026-06-19",
"count": 1
},
{
"date": "2026-07-01",
"count": 1
},
{
"date": "2026-07-03",
"count": 1
},
{
"date": "2026-07-12",
"count": 1
},
{
"date": "2026-07-16",
"count": 2
},
{
"date": "2026-07-17",
"count": 1
},
{
"date": "2026-07-21",
"count": 1
},
{
"date": "2026-07-23",
"count": 1
}
],
"complete": true,
"collected": 466,
"total_forks": 468
},
"star_history": null,
"open_issues_and_prs": 98
},
"ai_readiness": {
"has_nix": false,
"example_dirs": [],
"has_llms_txt": true,
"has_dockerfile": true,
"has_mcp_signal": false,
"bootstrap_files": [],
"api_schema_files": [],
"has_devcontainer": false,
"typecheck_configs": [],
"toolchain_manifests": [
"caddy/go.mod",
"go.mod"
],
"largest_source_bytes": 95783,
"source_files_sampled": 249,
"oversized_source_files": 2,
"agent_instruction_files": [],
"agent_instruction_max_bytes": null
},
"dependencies": {
"manifests": [
"caddy/go.mod",
"go.mod"
],
"advisories": {
"error": null,
"scope": "repository_graph",
"source": "osv",
"findings": [
{
"name": "github.com/getkin/kin-openapi",
"direct": false,
"version": "v0.140.0",
"severity": "critical",
"ecosystem": "go",
"cvss_score": 9.1,
"advisory_ids": [
"GHSA-r277-6w6q-xmqw"
],
"fixed_version": "0.144.0",
"advisory_count": 1,
"oldest_advisory_days": 0
},
{
"name": "google.golang.org/grpc",
"direct": false,
"version": "v1.81.1",
"severity": "critical",
"ecosystem": "go",
"cvss_score": 9.1,
"advisory_ids": [
"GHSA-hrxh-6v49-42gf"
],
"fixed_version": "1.82.1",
"advisory_count": 1,
"oldest_advisory_days": 2
},
{
"name": "github.com/google/cel-go",
"direct": false,
"version": "v0.28.1",
"severity": "moderate",
"ecosystem": "go",
"cvss_score": 5.3,
"advisory_ids": [
"GHSA-gcjh-h69q-9w9g"
],
"fixed_version": "0.29.0",
"advisory_count": 1,
"oldest_advisory_days": 0
},
{
"name": "golang.org/x/crypto",
"direct": false,
"version": "v0.54.0",
"severity": "unknown",
"ecosystem": "go",
"cvss_score": null,
"advisory_ids": [
"GO-2026-5932"
],
"fixed_version": null,
"advisory_count": 1,
"oldest_advisory_days": 16
}
],
"collected": true,
"malicious": [],
"truncated": false,
"by_severity": {
"unknown": 1,
"critical": 2,
"moderate": 1
},
"advisory_count": 4,
"affected_count": 4,
"assessed_count": 208,
"malicious_count": 0,
"assessed_package": null,
"unassessed_count": 0,
"direct_affected_count": 0
},
"ecosystems": [
"go"
],
"dependencies": [
{
"name": "github.com/caddyserver/caddy/v2",
"manifest": "caddy/go.mod",
"ecosystem": "go",
"version_constraint": "v2.11.4"
},
{
"name": "github.com/caddyserver/certmagic",
"manifest": "caddy/go.mod",
"ecosystem": "go",
"version_constraint": "v0.25.4"
},
{
"name": "github.com/dunglas/caddy-cbrotli",
"manifest": "caddy/go.mod",
"ecosystem": "go",
"version_constraint": "v1.0.1"
},
{
"name": "github.com/dunglas/frankenphp",
"manifest": "caddy/go.mod",
"ecosystem": "go",
"version_constraint": "v1.12.6"
},
{
"name": "github.com/dunglas/mercure",
"manifest": "caddy/go.mod",
"ecosystem": "go",
"version_constraint": "v0.24.2"
},
{
"name": "github.com/dunglas/mercure/caddy",
"manifest": "caddy/go.mod",
"ecosystem": "go",
"version_constraint": "v0.24.2"
},
{
"name": "github.com/dunglas/vulcain/caddy",
"manifest": "caddy/go.mod",
"ecosystem": "go",
"version_constraint": "v1.4.2"
},
{
"name": "github.com/prometheus/client_golang",
"manifest": "caddy/go.mod",
"ecosystem": "go",
"version_constraint": "v1.24.0"
},
{
"name": "github.com/spf13/cobra",
"manifest": "caddy/go.mod",
"ecosystem": "go",
"version_constraint": "v1.10.2"
},
{
"name": "github.com/stretchr/testify",
"manifest": "caddy/go.mod",
"ecosystem": "go",
"version_constraint": "v1.11.1"
},
{
"name": "github.com/Masterminds/sprig/v3",
"manifest": "go.mod",
"ecosystem": "go",
"version_constraint": "v3.3.0"
},
{
"name": "github.com/dunglas/mercure",
"manifest": "go.mod",
"ecosystem": "go",
"version_constraint": "v0.24.2"
},
{
"name": "github.com/e-dant/watcher",
"manifest": "go.mod",
"ecosystem": "go",
"version_constraint": "v0.0.0-20260223030516-06f84a1314be"
},
{
"name": "github.com/maypok86/otter/v2",
"manifest": "go.mod",
"ecosystem": "go",
"version_constraint": "v2.3.0"
},
{
"name": "github.com/prometheus/client_golang",
"manifest": "go.mod",
"ecosystem": "go",
"version_constraint": "v1.24.0"
},
{
"name": "github.com/stretchr/testify",
"manifest": "go.mod",
"ecosystem": "go",
"version_constraint": "v1.11.1"
},
{
"name": "golang.org/x/net",
"manifest": "go.mod",
"ecosystem": "go",
"version_constraint": "v0.57.0"
}
],
"all_dependencies": {
"error": null,
"source": "github-sbom",
"packages": [
{
"name": "github.com/caddyserver/caddy/v2",
"direct": true,
"version": "v2.11.4",
"ecosystem": "go"
},
{
"name": "github.com/caddyserver/certmagic",
"direct": true,
"version": "v0.25.4",
"ecosystem": "go"
},
{
"name": "github.com/dunglas/caddy-cbrotli",
"direct": true,
"version": "v1.0.1",
"ecosystem": "go"
},
{
"name": "github.com/dunglas/mercure",
"direct": true,
"version": "v0.24.2",
"ecosystem": "go"
},
{
"name": "github.com/dunglas/mercure/caddy",
"direct": true,
"version": "v0.24.2",
"ecosystem": "go"
},
{
"name": "github.com/dunglas/vulcain/caddy",
"direct": true,
"version": "v1.4.2",
"ecosystem": "go"
},
{
"name": "github.com/e-dant/watcher",
"direct": true,
"version": "v0.0.0-20260223030516-06f84a1314be",
"ecosystem": "go"
},
{
"name": "github.com/masterminds/sprig/v3",
"direct": true,
"version": "v3.3.0",
"ecosystem": "go"
},
{
"name": "github.com/maypok86/otter/v2",
"direct": true,
"version": "v2.3.0",
"ecosystem": "go"
},
{
"name": "github.com/prometheus/client_golang",
"direct": true,
"version": "v1.24.0",
"ecosystem": "go"
},
{
"name": "github.com/spf13/cobra",
"direct": true,
"version": "v1.10.2",
"ecosystem": "go"
},
{
"name": "github.com/stretchr/testify",
"direct": true,
"version": "v1.11.1",
"ecosystem": "go"
},
{
"name": "golang.org/x/net",
"direct": true,
"version": "v0.57.0",
"ecosystem": "go"
},
{
"name": "cel.dev/expr",
"direct": false,
"version": "v0.25.2",
"ecosystem": "go"
},
{
"name": "cloud.google.com/go/auth",
"direct": false,
"version": "v0.20.0",
"ecosystem": "go"
},
{
"name": "cloud.google.com/go/auth/oauth2adapt",
"direct": false,
"version": "v0.2.8",
"ecosystem": "go"
},
{
"name": "cloud.google.com/go/compute/metadata",
"direct": false,
"version": "v0.9.0",
"ecosystem": "go"
},
{
"name": "dario.cat/mergo",
"direct": false,
"version": "v1.0.2",
"ecosystem": "go"
},
{
"name": "filippo.io/bigmod",
"direct": false,
"version": "v0.1.0",
"ecosystem": "go"
},
{
"name": "filippo.io/edwards25519",
"direct": false,
"version": "v1.2.0",
"ecosystem": "go"
},
{
"name": "github.com/alecthomas/chroma/v2",
"direct": false,
"version": "v2.26.1",
"ecosystem": "go"
},
{
"name": "github.com/andreasbriese/bbloom",
"direct": false,
"version": "v0.0.0-20190825152654-46b345b51c96",
"ecosystem": "go"
},
{
"name": "github.com/antlr4-go/antlr/v4",
"direct": false,
"version": "v4.13.1",
"ecosystem": "go"
},
{
"name": "github.com/aryann/difflib",
"direct": false,
"version": "v0.0.0-20210328193216-ff5ff6dc229b",
"ecosystem": "go"
},
{
"name": "github.com/beorn7/perks",
"direct": false,
"version": "v1.0.1",
"ecosystem": "go"
},
{
"name": "github.com/bits-and-blooms/bitset",
"direct": false,
"version": "v1.24.6",
"ecosystem": "go"
},
{
"name": "github.com/burntsushi/toml",
"direct": false,
"version": "v1.6.0",
"ecosystem": "go"
},
{
"name": "github.com/caddyserver/zerossl",
"direct": false,
"version": "v0.1.5",
"ecosystem": "go"
},
{
"name": "github.com/ccoveille/go-safecast/v2",
"direct": false,
"version": "v2.0.1",
"ecosystem": "go"
},
{
"name": "github.com/cenkalti/backoff/v5",
"direct": false,
"version": "v5.0.3",
"ecosystem": "go"
},
{
"name": "github.com/cespare/xxhash",
"direct": false,
"version": "v1.1.0",
"ecosystem": "go"
},
{
"name": "github.com/cespare/xxhash/v2",
"direct": false,
"version": "v2.3.0",
"ecosystem": "go"
},
{
"name": "github.com/chzyer/readline",
"direct": false,
"version": "v1.5.1",
"ecosystem": "go"
},
{
"name": "github.com/cloudflare/circl",
"direct": false,
"version": "v1.6.3",
"ecosystem": "go"
},
{
"name": "github.com/coreos/go-oidc/v3",
"direct": false,
"version": "v3.18.0",
"ecosystem": "go"
},
{
"name": "github.com/cpuguy83/go-md2man/v2",
"direct": false,
"version": "v2.0.7",
"ecosystem": "go"
},
{
"name": "github.com/davecgh/go-spew",
"direct": false,
"version": "v1.1.2-0.20180830191138-d8f796af33cc",
"ecosystem": "go"
},
{
"name": "github.com/deruina/timberjack",
"direct": false,
"version": "v1.4.5",
"ecosystem": "go"
},
{
"name": "github.com/dgraph-io/badger",
"direct": false,
"version": "v1.6.2",
"ecosystem": "go"
},
{
"name": "github.com/dgraph-io/badger/v2",
"direct": false,
"version": "v2.2007.4",
"ecosystem": "go"
},
{
"name": "github.com/dgraph-io/ristretto",
"direct": false,
"version": "v0.2.0",
"ecosystem": "go"
},
{
"name": "github.com/dgryski/go-farm",
"direct": false,
"version": "v0.0.0-20240924180020-3414d57e47da",
"ecosystem": "go"
},
{
"name": "github.com/dlclark/regexp2/v2",
"direct": false,
"version": "v2.1.1",
"ecosystem": "go"
},
{
"name": "github.com/dunglas/httpsfv",
"direct": false,
"version": "v1.1.0",
"ecosystem": "go"
},
{
"name": "github.com/dunglas/skipfilter",
"direct": false,
"version": "v1.0.0",
"ecosystem": "go"
},
{
"name": "github.com/dunglas/vulcain",
"direct": false,
"version": "v1.4.2",
"ecosystem": "go"
},
{
"name": "github.com/dustin/go-humanize",
"direct": false,
"version": "v1.0.1",
"ecosystem": "go"
},
{
"name": "github.com/felixge/httpsnoop",
"direct": false,
"version": "v1.1.0",
"ecosystem": "go"
},
{
"name": "github.com/fsnotify/fsnotify",
"direct": false,
"version": "v1.10.1",
"ecosystem": "go"
},
{
"name": "github.com/fxamacker/cbor/v2",
"direct": false,
"version": "v2.9.2",
"ecosystem": "go"
},
{
"name": "github.com/getkin/kin-openapi",
"direct": false,
"version": "v0.140.0",
"ecosystem": "go"
},
{
"name": "github.com/go-chi/chi/v5",
"direct": false,
"version": "v5.3.0",
"ecosystem": "go"
},
{
"name": "github.com/go-jose/go-jose/v3",
"direct": false,
"version": "v3.0.5",
"ecosystem": "go"
},
{
"name": "github.com/go-jose/go-jose/v4",
"direct": false,
"version": "v4.1.4",
"ecosystem": "go"
},
{
"name": "github.com/go-logr/logr",
"direct": false,
"version": "v1.4.3",
"ecosystem": "go"
},
{
"name": "github.com/go-logr/stdr",
"direct": false,
"version": "v1.2.2",
"ecosystem": "go"
},
{
"name": "github.com/go-openapi/jsonpointer",
"direct": false,
"version": "v0.23.1",
"ecosystem": "go"
},
{
"name": "github.com/go-openapi/swag/jsonname",
"direct": false,
"version": "v0.26.0",
"ecosystem": "go"
},
{
"name": "github.com/go-sql-driver/mysql",
"direct": false,
"version": "v1.10.0",
"ecosystem": "go"
},
{
"name": "github.com/go-viper/mapstructure/v2",
"direct": false,
"version": "v2.5.0",
"ecosystem": "go"
},
{
"name": "github.com/gofrs/uuid",
"direct": false,
"version": "v4.4.0+incompatible",
"ecosystem": "go"
},
{
"name": "github.com/gofrs/uuid/v5",
"direct": false,
"version": "v5.4.0",
"ecosystem": "go"
},
{
"name": "github.com/golang-jwt/jwt/v5",
"direct": false,
"version": "v5.3.1",
"ecosystem": "go"
},
{
"name": "github.com/golang/protobuf",
"direct": false,
"version": "v1.5.4",
"ecosystem": "go"
},
{
"name": "github.com/golang/snappy",
"direct": false,
"version": "v1.0.0",
"ecosystem": "go"
},
{
"name": "github.com/google/brotli/go/cbrotli",
"direct": false,
"version": "v1.1.0",
"ecosystem": "go"
},
{
"name": "github.com/google/cel-go",
"direct": false,
"version": "v0.28.1",
"ecosystem": "go"
},
{
"name": "github.com/google/certificate-transparency-go",
"direct": false,
"version": "v1.3.3",
"ecosystem": "go"
},
{
"name": "github.com/google/go-tpm",
"direct": false,
"version": "v0.9.8",
"ecosystem": "go"
},
{
"name": "github.com/google/go-tspi",
"direct": false,
"version": "v0.3.0",
"ecosystem": "go"
},
{
"name": "github.com/google/s2a-go",
"direct": false,
"version": "v0.1.9",
"ecosystem": "go"
},
{
"name": "github.com/google/uuid",
"direct": false,
"version": "v1.6.0",
"ecosystem": "go"
},
{
"name": "github.com/googleapis/enterprise-certificate-proxy",
"direct": false,
"version": "v0.3.16",
"ecosystem": "go"
},
{
"name": "github.com/googleapis/gax-go/v2",
"direct": false,
"version": "v2.22.0",
"ecosystem": "go"
},
{
"name": "github.com/gorilla/handlers",
"direct": false,
"version": "v1.5.2",
"ecosystem": "go"
},
{
"name": "github.com/gorilla/mux",
"direct": false,
"version": "v1.8.1",
"ecosystem": "go"
},
{
"name": "github.com/grpc-ecosystem/grpc-gateway/v2",
"direct": false,
"version": "v2.29.0",
"ecosystem": "go"
},
{
"name": "github.com/huandu/xstrings",
"direct": false,
"version": "v1.5.0",
"ecosystem": "go"
},
{
"name": "github.com/inconshreveable/mousetrap",
"direct": false,
"version": "v1.1.0",
"ecosystem": "go"
},
{
"name": "github.com/jackc/pgpassfile",
"direct": false,
"version": "v1.0.0",
"ecosystem": "go"
},
{
"name": "github.com/jackc/pgservicefile",
"direct": false,
"version": "v0.0.0-20240606120523-5a60cdf6a761",
"ecosystem": "go"
},
{
"name": "github.com/jackc/pgx/v5",
"direct": false,
"version": "v5.10.0",
"ecosystem": "go"
},
{
"name": "github.com/jackc/puddle/v2",
"direct": false,
"version": "v2.2.2",
"ecosystem": "go"
},
{
"name": "github.com/kimmachinegun/automemlimit",
"direct": false,
"version": "v0.7.5",
"ecosystem": "go"
},
{
"name": "github.com/klauspost/compress",
"direct": false,
"version": "v1.19.0",
"ecosystem": "go"
},
{
"name": "github.com/klauspost/cpuid/v2",
"direct": false,
"version": "v2.3.0",
"ecosystem": "go"
},
{
"name": "github.com/kylelemons/godebug",
"direct": false,
"version": "v1.1.0",
"ecosystem": "go"
},
{
"name": "github.com/libdns/libdns",
"direct": false,
"version": "v1.1.1",
"ecosystem": "go"
},
{
"name": "github.com/manifoldco/promptui",
"direct": false,
"version": "v0.9.0",
"ecosystem": "go"
},
{
"name": "github.com/masterminds/goutils",
"direct": false,
"version": "v1.1.1",
"ecosystem": "go"
},
{
"name": "github.com/masterminds/semver/v3",
"direct": false,
"version": "v3.5.0",
"ecosystem": "go"
},
{
"name": "github.com/mattn/go-colorable",
"direct": false,
"version": "v0.1.15",
"ecosystem": "go"
},
{
"name": "github.com/mattn/go-isatty",
"direct": false,
"version": "v0.0.22",
"ecosystem": "go"
},
{
"name": "github.com/mauricegit/skiplist",
"direct": false,
"version": "v0.0.0-20211105230623-77f5c8d3e145",
"ecosystem": "go"
},
{
"name": "github.com/mgutz/ansi",
"direct": false,
"version": "v0.0.0-20200706080929-d51e80ef957d",
"ecosystem": "go"
},
{
"name": "github.com/mholt/acmez/v3",
"direct": false,
"version": "v3.1.6",
"ecosystem": "go"
},
{
"name": "github.com/micahparks/jwkset",
"direct": false,
"version": "v0.11.0",
"ecosystem": "go"
},
{
"name": "github.com/micahparks/keyfunc/v3",
"direct": false,
"version": "v3.8.0",
"ecosystem": "go"
},
{
"name": "github.com/miekg/dns",
"direct": false,
"version": "v1.1.72",
"ecosystem": "go"
},
{
"name": "github.com/mitchellh/copystructure",
"direct": false,
"version": "v1.2.0",
"ecosystem": "go"
},
{
"name": "github.com/mitchellh/go-ps",
"direct": false,
"version": "v1.0.0",
"ecosystem": "go"
},
{
"name": "github.com/mitchellh/reflectwalk",
"direct": false,
"version": "v1.0.2",
"ecosystem": "go"
},
{
"name": "github.com/mschoch/smat",
"direct": false,
"version": "v0.2.0",
"ecosystem": "go"
},
{
"name": "github.com/munnerz/goautoneg",
"direct": false,
"version": "v0.0.0-20191010083416-a7dc8b61c822",
"ecosystem": "go"
},
{
"name": "github.com/oasdiff/yaml",
"direct": false,
"version": "v0.1.0",
"ecosystem": "go"
},
{
"name": "github.com/oasdiff/yaml3",
"direct": false,
"version": "v0.0.13",
"ecosystem": "go"
},
{
"name": "github.com/pbnjay/memory",
"direct": false,
"version": "v0.0.0-20210728143218-7b4eea64cf58",
"ecosystem": "go"
},
{
"name": "github.com/pelletier/go-toml/v2",
"direct": false,
"version": "v2.4.3",
"ecosystem": "go"
},
{
"name": "github.com/pires/go-proxyproto",
"direct": false,
"version": "v0.12.0",
"ecosystem": "go"
},
{
"name": "github.com/pkg/errors",
"direct": false,
"version": "v0.9.1",
"ecosystem": "go"
},
{
"name": "github.com/pmezard/go-difflib",
"direct": false,
"version": "v1.0.1-0.20181226105442-5d4384ee4fb2",
"ecosystem": "go"
},
{
"name": "github.com/prometheus/client_model",
"direct": false,
"version": "v0.6.2",
"ecosystem": "go"
},
{
"name": "github.com/prometheus/common",
"direct": false,
"version": "v0.70.0",
"ecosystem": "go"
},
{
"name": "github.com/prometheus/otlptranslator",
"direct": false,
"version": "v1.0.0",
"ecosystem": "go"
},
{
"name": "github.com/prometheus/procfs",
"direct": false,
"version": "v0.21.1",
"ecosystem": "go"
},
{
"name": "github.com/quic-go/qpack",
"direct": false,
"version": "v0.6.0",
"ecosystem": "go"
},
{
"name": "github.com/quic-go/quic-go",
"direct": false,
"version": "v0.59.1",
"ecosystem": "go"
},
{
"name": "github.com/roaringbitmap/roaring/v2",
"direct": false,
"version": "v2.21.0",
"ecosystem": "go"
},
{
"name": "github.com/rogpeppe/go-internal",
"direct": false,
"version": "v1.13.1",
"ecosystem": "go"
},
{
"name": "github.com/rs/cors",
"direct": false,
"version": "v1.11.1",
"ecosystem": "go"
},
{
"name": "github.com/rs/xid",
"direct": false,
"version": "v1.6.0",
"ecosystem": "go"
},
{
"name": "github.com/russross/blackfriday/v2",
"direct": false,
"version": "v2.1.0",
"ecosystem": "go"
},
{
"name": "github.com/sagikazarmark/locafero",
"direct": false,
"version": "v0.12.0",
"ecosystem": "go"
},
{
"name": "github.com/santhosh-tekuri/jsonschema/v6",
"direct": false,
"version": "v6.0.2",
"ecosystem": "go"
},
{
"name": "github.com/shopspring/decimal",
"direct": false,
"version": "v1.4.0",
"ecosystem": "go"
},
{
"name": "github.com/shurcool/sanitized_anchor_name",
"direct": false,
"version": "v1.0.0",
"ecosystem": "go"
},
{
"name": "github.com/sirupsen/logrus",
"direct": false,
"version": "v1.9.4",
"ecosystem": "go"
},
{
"name": "github.com/slackhq/nebula",
"direct": false,
"version": "v1.10.3",
"ecosystem": "go"
},
{
"name": "github.com/smallstep/certificates",
"direct": false,
"version": "v0.30.2",
"ecosystem": "go"
},
{
"name": "github.com/smallstep/cli-utils",
"direct": false,
"version": "v0.12.2",
"ecosystem": "go"
},
{
"name": "github.com/smallstep/go-attestation",
"direct": false,
"version": "v0.4.9",
"ecosystem": "go"
},
{
"name": "github.com/smallstep/linkedca",
"direct": false,
"version": "v0.25.0",
"ecosystem": "go"
},
{
"name": "github.com/smallstep/nosql",
"direct": false,
"version": "v0.8.0",
"ecosystem": "go"
},
{
"name": "github.com/smallstep/pkcs7",
"direct": false,
"version": "v0.2.1",
"ecosystem": "go"
},
{
"name": "github.com/smallstep/scep",
"direct": false,
"version": "v0.0.0-20260331191114-261f960a40d1",
"ecosystem": "go"
},
{
"name": "github.com/smallstep/truststore",
"direct": false,
"version": "v0.13.0",
"ecosystem": "go"
},
{
"name": "github.com/spf13/afero",
"direct": false,
"version": "v1.15.0",
"ecosystem": "go"
},
{
"name": "github.com/spf13/cast",
"direct": false,
"version": "v1.10.0",
"ecosystem": "go"
},
{
"name": "github.com/spf13/pflag",
"direct": false,
"version": "v1.0.10",
"ecosystem": "go"
},
{
"name": "github.com/spf13/viper",
"direct": false,
"version": "v1.21.0",
"ecosystem": "go"
},
{
"name": "github.com/subosito/gotenv",
"direct": false,
"version": "v1.6.0",
"ecosystem": "go"
},
{
"name": "github.com/tailscale/go-winio",
"direct": false,
"version": "v0.0.0-20231025203758-c4f33415bf55",
"ecosystem": "go"
},
{
"name": "github.com/tailscale/tscert",
"direct": false,
"version": "v0.0.0-20251216020129-aea342f6d747",
"ecosystem": "go"
},
{
"name": "github.com/tidwall/gjson",
"direct": false,
"version": "v1.19.0",
"ecosystem": "go"
},
{
"name": "github.com/tidwall/match",
"direct": false,
"version": "v1.2.0",
"ecosystem": "go"
},
{
"name": "github.com/tidwall/pretty",
"direct": false,
"version": "v1.2.1",
"ecosystem": "go"
},
{
"name": "github.com/tidwall/sjson",
"direct": false,
"version": "v1.2.5",
"ecosystem": "go"
},
{
"name": "github.com/unrolled/secure",
"direct": false,
"version": "v1.17.0",
"ecosystem": "go"
},
{
"name": "github.com/urfave/cli",
"direct": false,
"version": "v1.22.17",
"ecosystem": "go"
},
{
"name": "github.com/x448/float16",
"direct": false,
"version": "v0.8.4",
"ecosystem": "go"
},
{
"name": "github.com/yosida95/uritemplate/v3",
"direct": false,
"version": "v3.0.2",
"ecosystem": "go"
},
{
"name": "github.com/yuin/goldmark",
"direct": false,
"version": "v1.8.2",
"ecosystem": "go"
},
{
"name": "github.com/yuin/goldmark-highlighting/v2",
"direct": false,
"version": "v2.0.0-20230729083705-37449abec8cc",
"ecosystem": "go"
},
{
"name": "github.com/zeebo/blake3",
"direct": false,
"version": "v0.2.4",
"ecosystem": "go"
},
{
"name": "go.etcd.io/bbolt",
"direct": false,
"version": "v1.5.0",
"ecosystem": "go"
},
{
"name": "go.opentelemetry.io/auto/sdk",
"direct": false,
"version": "v1.2.1",
"ecosystem": "go"
},
{
"name": "go.opentelemetry.io/contrib/bridges/prometheus",
"direct": false,
"version": "v0.69.0",
"ecosystem": "go"
},
{
"name": "go.opentelemetry.io/contrib/exporters/autoexport",
"direct": false,
"version": "v0.69.0",
"ecosystem": "go"
},
{
"name": "go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp",
"direct": false,
"version": "v0.69.0",
"ecosystem": "go"
},
{
"name": "go.opentelemetry.io/contrib/propagators/autoprop",
"direct": false,
"version": "v0.69.0",
"ecosystem": "go"
},
{
"name": "go.opentelemetry.io/contrib/propagators/aws",
"direct": false,
"version": "v1.44.0",
"ecosystem": "go"
},
{
"name": "go.opentelemetry.io/contrib/propagators/b3",
"direct": false,
"version": "v1.44.0",
"ecosystem": "go"
},
{
"name": "go.opentelemetry.io/contrib/propagators/jaeger",
"direct": false,
"version": "v1.44.0",
"ecosystem": "go"
},
{
"name": "go.opentelemetry.io/contrib/propagators/ot",
"direct": false,
"version": "v1.44.0",
"ecosystem": "go"
},
{
"name": "go.opentelemetry.io/otel",
"direct": false,
"version": "v1.44.0",
"ecosystem": "go"
},
{
"name": "go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc",
"direct": false,
"version": "v0.20.0",
"ecosystem": "go"
},
{
"name": "go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp",
"direct": false,
"version": "v0.20.0",
"ecosystem": "go"
},
{
"name": "go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc",
"direct": false,
"version": "v1.44.0",
"ecosystem": "go"
},
{
"name": "go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp",
"direct": false,
"version": "v1.44.0",
"ecosystem": "go"
},
{
"name": "go.opentelemetry.io/otel/exporters/otlp/otlptrace",
"direct": false,
"version": "v1.44.0",
"ecosystem": "go"
},
{
"name": "go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc",
"direct": false,
"version": "v1.44.0",
"ecosystem": "go"
},
{
"name": "go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp",
"direct": false,
"version": "v1.44.0",
"ecosystem": "go"
},
{
"name": "go.opentelemetry.io/otel/exporters/prometheus",
"direct": false,
"version": "v0.66.0",
"ecosystem": "go"
},
{
"name": "go.opentelemetry.io/otel/exporters/stdout/stdoutlog",
"direct": false,
"version": "v0.20.0",
"ecosystem": "go"
},
{
"name": "go.opentelemetry.io/otel/exporters/stdout/stdoutmetric",
"direct": false,
"version": "v1.44.0",
"ecosystem": "go"
},
{
"name": "go.opentelemetry.io/otel/exporters/stdout/stdouttrace",
"direct": false,
"version": "v1.44.0",
"ecosystem": "go"
},
{
"name": "go.opentelemetry.io/otel/log",
"direct": false,
"version": "v0.20.0",
"ecosystem": "go"
},
{
"name": "go.opentelemetry.io/otel/metric",
"direct": false,
"version": "v1.44.0",
"ecosystem": "go"
},
{
"name": "go.opentelemetry.io/otel/sdk",
"direct": false,
"version": "v1.44.0",
"ecosystem": "go"
},
{
"name": "go.opentelemetry.io/otel/sdk/log",
"direct": false,
"version": "v0.20.0",
"ecosystem": "go"
},
{
"name": "go.opentelemetry.io/otel/sdk/metric",
"direct": false,
"version": "v1.44.0",
"ecosystem": "go"
},
{
"name": "go.opentelemetry.io/otel/trace",
"direct": false,
"version": "v1.44.0",
"ecosystem": "go"
},
{
"name": "go.opentelemetry.io/proto/otlp",
"direct": false,
"version": "v1.10.0",
"ecosystem": "go"
},
{
"name": "go.step.sm/crypto",
"direct": false,
"version": "v0.81.1",
"ecosystem": "go"
},
{
"name": "go.uber.org/automaxprocs",
"direct": false,
"version": "v1.6.0",
"ecosystem": "go"
},
{
"name": "go.uber.org/multierr",
"direct": false,
"version": "v1.11.0",
"ecosystem": "go"
},
{
"name": "go.uber.org/zap",
"direct": false,
"version": "v1.28.0",
"ecosystem": "go"
},
{
"name": "go.uber.org/zap/exp",
"direct": false,
"version": "v0.3.0",
"ecosystem": "go"
},
{
"name": "go.yaml.in/yaml/v3",
"direct": false,
"version": "v3.0.4",
"ecosystem": "go"
},
{
"name": "golang.org/x/crypto",
"direct": false,
"version": "v0.54.0",
"ecosystem": "go"
},
{
"name": "golang.org/x/crypto/x509roots/fallback",
"direct": false,
"version": "v0.0.0-20260602072539-e2ffffe738fb",
"ecosystem": "go"
},
{
"name": "golang.org/x/exp",
"direct": false,
"version": "v0.0.0-20260529124908-c761662dc8c9",
"ecosystem": "go"
},
{
"name": "golang.org/x/mod",
"direct": false,
"version": "v0.37.0",
"ecosystem": "go"
},
{
"name": "golang.org/x/oauth2",
"direct": false,
"version": "v0.36.0",
"ecosystem": "go"
},
{
"name": "golang.org/x/sync",
"direct": false,
"version": "v0.22.0",
"ecosystem": "go"
},
{
"name": "golang.org/x/sys",
"direct": false,
"version": "v0.47.0",
"ecosystem": "go"
},
{
"name": "golang.org/x/term",
"direct": false,
"version": "v0.45.0",
"ecosystem": "go"
},
{
"name": "golang.org/x/text",
"direct": false,
"version": "v0.40.0",
"ecosystem": "go"
},
{
"name": "golang.org/x/time",
"direct": false,
"version": "v0.15.0",
"ecosystem": "go"
},
{
"name": "golang.org/x/tools",
"direct": false,
"version": "v0.47.0",
"ecosystem": "go"
},
{
"name": "google.golang.org/api",
"direct": false,
"version": "v0.283.0",
"ecosystem": "go"
},
{
"name": "google.golang.org/genproto/googleapis/api",
"direct": false,
"version": "v0.0.0-20260526163538-3dc84a4a5aaa",
"ecosystem": "go"
},
{
"name": "google.golang.org/genproto/googleapis/rpc",
"direct": false,
"version": "v0.0.0-20260526163538-3dc84a4a5aaa",
"ecosystem": "go"
},
{
"name": "google.golang.org/grpc",
"direct": false,
"version": "v1.81.1",
"ecosystem": "go"
},
{
"name": "google.golang.org/grpc/cmd/protoc-gen-go-grpc",
"direct": false,
"version": "v1.6.2",
"ecosystem": "go"
},
{
"name": "google.golang.org/protobuf",
"direct": false,
"version": "v1.36.11",
"ecosystem": "go"
},
{
"name": "gopkg.in/yaml.v3",
"direct": false,
"version": "v3.0.1",
"ecosystem": "go"
},
{
"name": "howett.net/plist",
"direct": false,
"version": "v1.0.1",
"ecosystem": "go"
}
],
"collected": true,
"truncated": false,
"total_count": 208,
"direct_count": 13,
"indirect_count": 195
}
},
"maintainership": {
"issues": {
"open_prs": 32,
"merged_prs": 1090,
"open_issues": 66,
"closed_ratio": 0.925,
"closed_issues": 815,
"closed_unmerged_prs": 267
},
"bus_factor": 1,
"bot_contributors": 3,
"top_contributors": [
{
"type": "User",
"login": "dunglas",
"commits": 648,
"avatar_url": "https://avatars.githubusercontent.com/u/57224?v=4"
},
{
"type": "User",
"login": "AlliBalliBaba",
"commits": 85,
"avatar_url": "https://avatars.githubusercontent.com/u/45872305?v=4"
},
{
"type": "User",
"login": "alexandre-daubois",
"commits": 84,
"avatar_url": "https://avatars.githubusercontent.com/u/2144837?v=4"
},
{
"type": "User",
"login": "henderkes",
"commits": 80,
"avatar_url": "https://avatars.githubusercontent.com/u/7896469?v=4"
},
{
"type": "User",
"login": "withinboredom",
"commits": 39,
"avatar_url": "https://avatars.githubusercontent.com/u/1883296?v=4"
},
{
"type": "User",
"login": "IndraGunawan",
"commits": 14,
"avatar_url": "https://avatars.githubusercontent.com/u/2704730?v=4"
},
{
"type": "User",
"login": "pierredup",
"commits": 7,
"avatar_url": "https://avatars.githubusercontent.com/u/144858?v=4"
},
{
"type": "User",
"login": "nicolas-grekas",
"commits": 6,
"avatar_url": "https://avatars.githubusercontent.com/u/243674?v=4"
},
{
"type": "User",
"login": "crazywhalecc",
"commits": 5,
"avatar_url": "https://avatars.githubusercontent.com/u/20330940?v=4"
},
{
"type": "User",
"login": "xavierleune",
"commits": 4,
"avatar_url": "https://avatars.githubusercontent.com/u/2320425?v=4"
}
],
"contributors_sampled": 97,
"top_contributor_share": 0.587
},
"quality_signals": {
"has_ci": true,
"has_tests": true,
"ci_workflows": [
"dependabot.yaml",
"docker.yaml",
"docs.yaml",
"lint.yaml",
"release.yaml",
"sanitizers.yaml",
"static.yaml",
"tests.yaml",
"translate.yaml",
"windows.yaml",
"wrap-issue-details.yaml"
],
"has_docs_dir": true,
"linter_configs": [
".golangci.yaml"
],
"has_editorconfig": true,
"has_linter_config": true,
"has_precommit_config": false
},
"security_signals": {
"lockfiles": [
"go.sum"
],
"scorecard": {
"checks": [
{
"name": "Binary-Artifacts",
"score": 10,
"reason": "no binaries found in the repo",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#binary-artifacts"
},
{
"name": "Branch-Protection",
"score": 3,
"reason": "branch protection is not maximal on development and all release branches",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#branch-protection"
},
{
"name": "CI-Tests",
"score": 10,
"reason": "28 out of 28 merged PRs checked by a CI test -- score normalized to 10",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#ci-tests"
},
{
"name": "CII-Best-Practices",
"score": 0,
"reason": "no effort to earn an OpenSSF best practices badge detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#cii-best-practices"
},
{
"name": "Code-Review",
"score": 5,
"reason": "Found 14/24 approved changesets -- score normalized to 5",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#code-review"
},
{
"name": "Contributors",
"score": 10,
"reason": "project has 25 contributing companies or organizations",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#contributors"
},
{
"name": "Dangerous-Workflow",
"score": 10,
"reason": "no dangerous workflow patterns detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dangerous-workflow"
},
{
"name": "Dependency-Update-Tool",
"score": 10,
"reason": "update tool detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dependency-update-tool"
},
{
"name": "Fuzzing",
"score": 10,
"reason": "project is fuzzed",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#fuzzing"
},
{
"name": "License",
"score": 10,
"reason": "license file detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#license"
},
{
"name": "Maintained",
"score": 10,
"reason": "30 commit(s) and 22 issue activity found in the last 90 days -- score normalized to 10",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#maintained"
},
{
"name": "Packaging",
"score": 10,
"reason": "packaging workflow detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#packaging"
},
{
"name": "Pinned-Dependencies",
"score": 5,
"reason": "dependency not pinned by hash detected -- score normalized to 5",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#pinned-dependencies"
},
{
"name": "SAST",
"score": 0,
"reason": "SAST tool is not run on all commits -- score normalized to 0",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#sast"
},
{
"name": "Security-Policy",
"score": 10,
"reason": "security policy file detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#security-policy"
},
{
"name": "Signed-Releases",
"score": 0,
"reason": "Project has not signed or included provenance with any releases.",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#signed-releases"
},
{
"name": "Token-Permissions",
"score": 0,
"reason": "detected GitHub workflow tokens with excessive permissions",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#token-permissions"
},
{
"name": "Vulnerabilities",
"score": 6,
"reason": "4 existing vulnerabilities detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#vulnerabilities"
}
],
"commit": "b1ccb0e14c6072884122c546764351bfabd979e8",
"ran_at": "2026-07-24T21:44:42Z",
"aggregate_score": 6.5,
"scorecard_version": "v5.5.0"
},
"has_codeql_workflow": false,
"has_security_policy": true,
"has_dependabot_config": true
},
"contribution_flow": {
"collected": true,
"ci_last_run_at": "2026-07-24T18:26:50Z",
"oldest_open_prs": [
{
"number": 598,
"created_at": "2024-02-26T09:14:02Z",
"last_comment_at": null,
"last_comment_author": null
},
{
"number": 1630,
"created_at": "2025-06-05T16:02:09Z",
"last_comment_at": "2026-03-16T02:35:37Z",
"last_comment_author": "henderkes"
},
{
"number": 1658,
"created_at": "2025-06-18T16:39:16Z",
"last_comment_at": "2026-05-03T18:17:48Z",
"last_comment_author": "dunglas"
},
{
"number": 1757,
"created_at": "2025-07-19T14:16:50Z",
"last_comment_at": "2026-03-06T10:52:20Z",
"last_comment_author": "henderkes"
},
{
"number": 1786,
"created_at": "2025-08-03T19:32:52Z",
"last_comment_at": "2026-02-27T09:05:48Z",
"last_comment_author": "alexandre-daubois"
},
{
"number": 1819,
"created_at": "2025-08-19T10:31:28Z",
"last_comment_at": "2025-08-25T14:17:26Z",
"last_comment_author": "dunglas"
},
{
"number": 1926,
"created_at": "2025-10-15T12:23:01Z",
"last_comment_at": null,
"last_comment_author": null
},
{
"number": 1941,
"created_at": "2025-10-24T12:19:19Z",
"last_comment_at": "2025-11-10T09:40:14Z",
"last_comment_author": "henderkes"
},
{
"number": 2041,
"created_at": "2025-11-27T15:36:02Z",
"last_comment_at": "2025-11-28T12:10:50Z",
"last_comment_author": "AlliBalliBaba"
},
{
"number": 2079,
"created_at": "2025-12-17T14:59:49Z",
"last_comment_at": "2026-01-04T17:08:56Z",
"last_comment_author": "ikrestov"
},
{
"number": 2090,
"created_at": "2025-12-19T22:34:13Z",
"last_comment_at": "2025-12-29T10:39:02Z",
"last_comment_author": "AlliBalliBaba"
},
{
"number": 2106,
"created_at": "2026-01-01T11:23:13Z",
"last_comment_at": "2026-01-05T16:46:38Z",
"last_comment_author": "henderkes"
},
{
"number": 2287,
"created_at": "2026-03-16T18:53:17Z",
"last_comment_at": "2026-04-23T06:32:08Z",
"last_comment_author": "nicolas-grekas"
},
{
"number": 2305,
"created_at": "2026-03-25T18:48:57Z",
"last_comment_at": "2026-03-31T10:56:06Z",
"last_comment_author": "johanjanssens"
},
{
"number": 2306,
"created_at": "2026-03-25T18:52:22Z",
"last_comment_at": "2026-07-18T14:55:27Z",
"last_comment_author": "johanjanssens"
},
{
"number": 2316,
"created_at": "2026-03-27T14:07:13Z",
"last_comment_at": null,
"last_comment_author": null
},
{
"number": 2319,
"created_at": "2026-03-28T14:39:20Z",
"last_comment_at": null,
"last_comment_author": null
},
{
"number": 2382,
"created_at": "2026-04-25T23:29:53Z",
"last_comment_at": "2026-05-04T19:09:11Z",
"last_comment_author": "AlliBalliBaba"
},
{
"number": 2393,
"created_at": "2026-05-04T18:08:59Z",
"last_comment_at": "2026-05-07T17:48:09Z",
"last_comment_author": "nicolas-grekas"
},
{
"number": 2399,
"created_at": "2026-05-09T05:40:17Z",
"last_comment_at": "2026-05-09T06:28:25Z",
"last_comment_author": "henderkes"
}
],
"last_merged_pr_at": "2026-07-22T08:01:35Z",
"ci_last_conclusion": "SUCCESS",
"oldest_open_issues": [
{
"number": 58,
"created_at": "2022-10-22T14:51:39Z",
"last_comment_at": "2022-10-23T13:57:41Z",
"last_comment_author": "withinboredom"
},
{
"number": 454,
"created_at": "2023-12-31T03:57:09Z",
"last_comment_at": "2025-11-06T09:10:39Z",
"last_comment_author": "mpskovvang"
},
{
"number": 463,
"created_at": "2024-01-09T06:53:59Z",
"last_comment_at": "2025-08-24T11:33:12Z",
"last_comment_author": "nickchomey"
},
{
"number": 477,
"created_at": "2024-01-16T10:00:17Z",
"last_comment_at": "2025-12-23T10:49:53Z",
"last_comment_author": "ochorocho"
},
{
"number": 481,
"created_at": "2024-01-17T21:00:25Z",
"last_comment_at": "2025-09-09T00:12:05Z",
"last_comment_author": "nickchomey"
},
{
"number": 560,
"created_at": "2024-02-06T19:08:05Z",
"last_comment_at": "2024-02-08T21:45:47Z",
"last_comment_author": "mholt"
},
{
"number": 587,
"created_at": "2024-02-20T09:14:03Z",
"last_comment_at": "2026-05-28T04:36:09Z",
"last_comment_author": "henderkes"
},
{
"number": 601,
"created_at": "2024-02-26T14:15:39Z",
"last_comment_at": "2026-05-28T04:04:14Z",
"last_comment_author": "henderkes"
},
{
"number": 691,
"created_at": "2024-03-28T18:20:01Z",
"last_comment_at": "2024-04-04T09:36:30Z",
"last_comment_author": "aszenz"
},
{
"number": 702,
"created_at": "2024-04-02T11:30:46Z",
"last_comment_at": "2026-05-28T04:24:55Z",
"last_comment_author": "henderkes"
},
{
"number": 774,
"created_at": "2024-05-09T23:46:11Z",
"last_comment_at": "2024-05-23T15:43:49Z",
"last_comment_author": "jbcr"
},
{
"number": 965,
"created_at": "2024-08-11T11:02:08Z",
"last_comment_at": "2024-12-26T19:38:27Z",
"last_comment_author": "francoism90"
},
{
"number": 1074,
"created_at": "2024-10-08T06:15:57Z",
"last_comment_at": "2026-07-20T13:19:31Z",
"last_comment_author": "dunglas"
},
{
"number": 1122,
"created_at": "2024-10-28T19:51:19Z",
"last_comment_at": "2024-11-02T13:30:46Z",
"last_comment_author": "withinboredom"
},
{
"number": 1176,
"created_at": "2024-11-17T10:43:08Z",
"last_comment_at": "2024-11-18T16:55:39Z",
"last_comment_author": "tigitz"
},
{
"number": 1177,
"created_at": "2024-11-17T14:15:49Z",
"last_comment_at": "2024-11-18T13:00:48Z",
"last_comment_author": "dunglas"
},
{
"number": 1216,
"created_at": "2024-11-29T20:02:36Z",
"last_comment_at": "2025-04-03T23:09:59Z",
"last_comment_author": "AlliBalliBaba"
},
{
"number": 1217,
"created_at": "2024-12-01T14:34:30Z",
"last_comment_at": "2024-12-13T02:24:54Z",
"last_comment_author": "kohenkatz"
},
{
"number": 1227,
"created_at": "2024-12-06T12:40:15Z",
"last_comment_at": "2024-12-09T21:48:46Z",
"last_comment_author": "Huggyduggy"
},
{
"number": 1245,
"created_at": "2024-12-14T03:04:47Z",
"last_comment_at": "2024-12-15T11:06:11Z",
"last_comment_author": "devkurrt011"
}
]
}
},
"config": {
"disabled_metrics": [],
"disabled_categories": [],
"disabled_components": {}
},
"source": {
"url": "https://github.com/php/frankenphp",
"host": "github.com",
"name": "frankenphp",
"owner": "php"
},
"metrics": {
"overall": {
"key": "overall",
"band": "good",
"name": "Overall health",
"note": null,
"notes": [],
"value": 81,
"inputs": {
"security": 72,
"vitality": 95,
"community": 82,
"governance": 66,
"engineering": 90
},
"components": []
},
"categories": [
{
"key": "vitality",
"band": "excellent",
"name": "Vitality",
"value": 95,
"weight": 0.22,
"metrics": [
{
"key": "development_activity",
"band": "excellent",
"name": "Development activity",
"note": null,
"notes": [],
"value": 99,
"inputs": {
"commits_last_year": 392,
"human_commit_share": 0.88,
"days_since_last_push": 0,
"active_weeks_last_year": 51
},
"components": [
{
"key": "push_recency",
"name": "Push recency",
"detail": "last push 0 days ago",
"points": 36,
"status": "met",
"details": [
{
"code": "push_recency",
"params": {
"days": 0
}
}
],
"max_points": 36
},
{
"key": "commit_cadence",
"name": "Commit cadence",
"detail": "51/52 weeks with commits",
"points": 35.3,
"status": "partial",
"details": [
{
"code": "commit_cadence_weeks",
"params": {
"weeks": 51
}
}
],
"max_points": 36
},
{
"key": "commit_volume",
"name": "Commit volume",
"detail": "392 commits in the last year",
"points": 18,
"status": "met",
"details": [
{
"code": "commits_last_year",
"params": {
"count": 392
}
}
],
"max_points": 18
},
{
"key": "openssf_scorecard_maintained",
"name": "OpenSSF Scorecard: Maintained",
"detail": "30 commit(s) and 22 issue activity found in the last 90 days -- score normalized to 10",
"points": 10,
"status": "met",
"details": [],
"max_points": 10
}
]
},
{
"key": "release_discipline",
"band": "excellent",
"name": "Release discipline",
"note": null,
"notes": [],
"value": 90,
"inputs": {
"releases_count": 53,
"latest_release_tag": "v1.12.6",
"releases_from_tags": false,
"days_since_latest_release": 3,
"mean_days_between_releases": 23.2
},
"components": [
{
"key": "ships_releases",
"name": "Ships releases",
"detail": "53 releases published",
"points": 27,
"status": "met",
"details": [
{
"code": "releases_published",
"params": {
"count": 53
}
}
],
"max_points": 27
},
{
"key": "release_recency",
"name": "Release recency",
"detail": "latest release 3 days ago",
"points": 36,
"status": "met",
"details": [
{
"code": "release_recency",
"params": {
"days": 3
}
}
],
"max_points": 36
},
{
"key": "release_cadence",
"name": "Release cadence",
"detail": "a release every ~23.2 days",
"points": 27,
"status": "met",
"details": [
{
"code": "release_cadence",
"params": {
"gap": 23.2
}
}
],
"max_points": 27
},
{
"key": "openssf_scorecard_signed_releases",
"name": "OpenSSF Scorecard: Signed-Releases",
"detail": "Project has not signed or included provenance with any releases.",
"points": 0,
"status": "missed",
"details": [],
"max_points": 10
}
]
},
{
"key": "abandonment",
"band": "excellent",
"name": "Abandonment",
"note": null,
"notes": [],
"value": 100,
"inputs": {
"cap": null,
"state": "maintained",
"guards": [],
"signals": [],
"red_flag": false,
"multiplier_pct": 100,
"declared_reason": null,
"unverified_reason": null,
"unanswered_open_prs": null,
"unanswered_open_issues": null,
"days_since_last_merged_pr": null,
"days_since_last_human_commit": 2,
"days_since_last_human_commit_is_floor": false
},
"components": [
{
"key": "project_is_still_maintained",
"name": "Project is still maintained",
"detail": "last human commit 2 days ago",
"points": 100,
"status": "met",
"details": [
{
"code": "abandonment_maintained",
"params": {
"days": 2
}
}
],
"max_points": 100
}
]
}
],
"description": "Is the project alive — is code being written and are releases shipping?"
},
{
"key": "community",
"band": "good",
"name": "Community & Adoption",
"value": 82,
"weight": 0.18,
"metrics": [
{
"key": "popularity",
"band": "excellent",
"name": "Popularity & adoption",
"note": null,
"notes": [],
"value": 93,
"inputs": {
"forks": 468,
"stars": 11242,
"watchers": 85,
"growth_state": "unverified",
"growth_factor_pct": 100,
"growth_unverified_reason": "no_history"
},
"components": [
{
"key": "stars",
"name": "Stars",
"detail": "11,242 stars",
"points": 60,
"status": "met",
"details": [
{
"code": "stars",
"params": {
"count": 11242
}
}
],
"max_points": 60
},
{
"key": "forks",
"name": "Forks",
"detail": "468 forks",
"points": 22.2,
"status": "partial",
"details": [
{
"code": "forks",
"params": {
"count": 468
}
}
],
"max_points": 25
},
{
"key": "watchers",
"name": "Watchers",
"detail": "85 watchers",
"points": 10.7,
"status": "partial",
"details": [
{
"code": "watchers",
"params": {
"count": 85
}
}
],
"max_points": 15
}
]
},
{
"key": "community_health",
"band": "good",
"name": "Community health",
"note": null,
"notes": [],
"value": 70,
"inputs": {
"has_readme": true,
"has_license": true,
"has_contributing": true,
"has_issue_template": false,
"has_code_of_conduct": false,
"has_pull_request_template": false
},
"components": [
{
"key": "readme",
"name": "README",
"detail": null,
"points": 22.5,
"status": "met",
"details": [],
"max_points": 22.5
},
{
"key": "license",
"name": "License",
"detail": "recognized license (MIT)",
"points": 22.5,
"status": "met",
"details": [
{
"code": "license_standard",
"params": {}
},
{
"code": "license_spdx",
"params": {
"spdx": "MIT"
}
}
],
"max_points": 22.5
},
{
"key": "contributing_guide",
"name": "CONTRIBUTING guide",
"detail": null,
"points": 18,
"status": "met",
"details": [],
"max_points": 18
},
{
"key": "code_of_conduct",
"name": "Code of conduct",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 13.5
},
{
"key": "issue_template",
"name": "Issue template",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.2
},
{
"key": "pr_template",
"name": "PR template",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 6.3
}
]
}
],
"description": "Does the project have users, downloads, attention, and a welcoming setup for contributors?"
},
{
"key": "governance",
"band": "moderate",
"name": "Sustainability & Governance",
"value": 66,
"weight": 0.24,
"metrics": [
{
"key": "maintainer_resilience",
"band": "at_risk",
"name": "Maintainer resilience (bus factor)",
"note": null,
"notes": [],
"value": 42,
"inputs": {
"bus_factor": 1,
"contributors_sampled": 97,
"top_contributor_share": 0.587
},
"components": [
{
"key": "bus_factor",
"name": "Bus factor",
"detail": "1 contributor(s) cover half of all commits",
"points": 9,
"status": "partial",
"details": [
{
"code": "bus_factor",
"params": {
"count": 1
}
}
],
"max_points": 54
},
{
"key": "commit_distribution",
"name": "Commit distribution",
"detail": "top contributor authored 59% of commits",
"points": 9.3,
"status": "partial",
"details": [
{
"code": "top_contributor_share",
"params": {
"share": 59
}
}
],
"max_points": 22.5
},
{
"key": "contributor_breadth",
"name": "Contributor breadth",
"detail": "97 contributors",
"points": 13.5,
"status": "met",
"details": [
{
"code": "contributors_sampled",
"params": {
"count": 97
}
}
],
"max_points": 13.5
},
{
"key": "openssf_scorecard_contributors",
"name": "OpenSSF Scorecard: Contributors",
"detail": "project has 25 contributing companies or organizations",
"points": 10,
"status": "met",
"details": [],
"max_points": 10
}
]
},
{
"key": "responsiveness",
"band": "good",
"name": "Issue & PR responsiveness",
"note": null,
"notes": [],
"value": 81,
"inputs": {
"merged_prs": 1090,
"open_issues": 66,
"closed_issues": 815,
"issue_closed_ratio": 0.925,
"closed_unmerged_prs": 267
},
"components": [
{
"key": "issue_resolution",
"name": "Issue resolution",
"detail": "92% of issues closed",
"points": 43.2,
"status": "partial",
"details": [
{
"code": "issues_closed_share",
"params": {
"share": 92
}
}
],
"max_points": 46.75
},
{
"key": "pr_acceptance",
"name": "PR acceptance",
"detail": "1090/1357 decided PRs merged",
"points": 30.7,
"status": "partial",
"details": [
{
"code": "decided_prs_merged",
"params": {
"merged": 1090,
"decided": 1357
}
}
],
"max_points": 38.25
},
{
"key": "openssf_scorecard_code_review",
"name": "OpenSSF Scorecard: Code-Review",
"detail": "Found 14/24 approved changesets -- score normalized to 5",
"points": 7.5,
"status": "partial",
"details": [],
"max_points": 15
}
]
},
{
"key": "stewardship",
"band": "good",
"name": "Ownership & stewardship",
"note": null,
"notes": [],
"value": 80,
"inputs": {
"followers": 4041,
"owner_type": "Organization",
"is_verified": null,
"owner_login": "php",
"public_repos": 152,
"account_age_days": 6518
},
"components": [
{
"key": "ownership_backing",
"name": "Ownership backing",
"detail": "organization-owned",
"points": 30,
"status": "met",
"details": [
{
"code": "owner_organization",
"params": {}
}
],
"max_points": 30
},
{
"key": "verified_domain",
"name": "Verified domain",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 20
},
{
"key": "owner_reach",
"name": "Owner reach",
"detail": "4,041 followers of php",
"points": 25,
"status": "met",
"details": [
{
"code": "owner_followers",
"params": {
"count": 4041,
"login": "php"
}
}
],
"max_points": 25
},
{
"key": "track_record",
"name": "Track record",
"detail": "152 public repos, account ~17 yr old",
"points": 25,
"status": "met",
"details": [
{
"code": "public_repos",
"params": {
"count": 152
}
},
{
"code": "account_age_years",
"params": {
"years": 17
}
}
],
"max_points": 25
}
]
}
],
"description": "Will the project survive its people — bus factor, responsiveness, who backs it, and package upkeep?"
},
{
"key": "engineering",
"band": "excellent",
"name": "Engineering Quality",
"value": 90,
"weight": 0.2,
"metrics": [
{
"key": "engineering_practices",
"band": "excellent",
"name": "Engineering practices",
"note": null,
"notes": [],
"value": 90,
"inputs": {
"has_ci": true,
"has_tests": true,
"has_editorconfig": true,
"has_linter_config": true,
"has_precommit_config": false
},
"components": [
{
"key": "ci_workflows",
"name": "CI workflows",
"detail": "11 workflow(s)",
"points": 24,
"status": "met",
"details": [
{
"code": "ci_workflows",
"params": {
"count": 11
}
}
],
"max_points": 24
},
{
"key": "tests_present",
"name": "Tests present",
"detail": null,
"points": 24,
"status": "met",
"details": [],
"max_points": 24
},
{
"key": "linter_config",
"name": "Linter config",
"detail": ".golangci.yaml",
"points": 16,
"status": "met",
"details": [
{
"code": "file_list",
"params": {
"files": ".golangci.yaml"
}
}
],
"max_points": 16
},
{
"key": "pre_commit_hooks",
"name": "Pre-commit hooks",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 9.6
},
{
"key": "editorconfig",
"name": ".editorconfig",
"detail": null,
"points": 6.4,
"status": "met",
"details": [],
"max_points": 6.4
},
{
"key": "openssf_scorecard_ci_tests",
"name": "OpenSSF Scorecard: CI-Tests",
"detail": "28 out of 28 merged PRs checked by a CI test -- score normalized to 10",
"points": 20,
"status": "met",
"details": [],
"max_points": 20
}
]
},
{
"key": "documentation",
"band": "excellent",
"name": "Documentation",
"note": null,
"notes": [],
"value": 90,
"inputs": {
"topics": [
"caddy",
"go",
"php",
"sapi",
"worker",
"frankenphp"
],
"has_wiki": false,
"homepage": "https://frankenphp.dev",
"has_readme": true,
"has_docs_dir": true,
"has_description": true
},
"components": [
{
"key": "readme",
"name": "README",
"detail": null,
"points": 30,
"status": "met",
"details": [],
"max_points": 30
},
{
"key": "documentation_directory",
"name": "Documentation directory",
"detail": null,
"points": 25,
"status": "met",
"details": [],
"max_points": 25
},
{
"key": "documentation_homepage_site",
"name": "Documentation / homepage site",
"detail": "https://frankenphp.dev",
"points": 15,
"status": "met",
"details": [],
"max_points": 15
},
{
"key": "repository_description",
"name": "Repository description",
"detail": null,
"points": 10,
"status": "met",
"details": [],
"max_points": 10
},
{
"key": "topics",
"name": "Topics",
"detail": "6 topics",
"points": 10,
"status": "met",
"details": [
{
"code": "topics_count",
"params": {
"count": 6
}
}
],
"max_points": 10
},
{
"key": "wiki",
"name": "Wiki",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 10
}
]
}
],
"description": "Are baseline engineering and documentation practices in place?"
},
{
"key": "security",
"band": "good",
"name": "Security",
"value": 72,
"weight": 0.16,
"metrics": [
{
"key": "security_posture",
"band": "moderate",
"name": "Security posture",
"note": null,
"notes": [],
"value": 65,
"inputs": {
"source": "openssf_scorecard",
"checks_evaluated": 18,
"scorecard_version": "v5.5.0",
"checks_inconclusive": 0,
"scorecard_aggregate": 6.5
},
"components": [
{
"key": "binary_artifacts",
"name": "Binary-Artifacts",
"detail": "no binaries found in the repo",
"points": 7.5,
"status": "met",
"details": [],
"max_points": 7.5
},
{
"key": "branch_protection",
"name": "Branch-Protection",
"detail": "branch protection is not maximal on development and all release branches",
"points": 2.2,
"status": "partial",
"details": [],
"max_points": 7.5
},
{
"key": "ci_tests",
"name": "CI-Tests",
"detail": "28 out of 28 merged PRs checked by a CI test -- score normalized to 10",
"points": 2.5,
"status": "met",
"details": [],
"max_points": 2.5
},
{
"key": "cii_best_practices",
"name": "CII-Best-Practices",
"detail": "no effort to earn an OpenSSF best practices badge detected",
"points": 0,
"status": "missed",
"details": [],
"max_points": 2.5
},
{
"key": "code_review",
"name": "Code-Review",
"detail": "Found 14/24 approved changesets -- score normalized to 5",
"points": 3.8,
"status": "partial",
"details": [],
"max_points": 7.5
},
{
"key": "contributors",
"name": "Contributors",
"detail": "project has 25 contributing companies or organizations",
"points": 2.5,
"status": "met",
"details": [],
"max_points": 2.5
},
{
"key": "dangerous_workflow",
"name": "Dangerous-Workflow",
"detail": "no dangerous workflow patterns detected",
"points": 10,
"status": "met",
"details": [],
"max_points": 10
},
{
"key": "dependency_update_tool",
"name": "Dependency-Update-Tool",
"detail": "update tool detected",
"points": 7.5,
"status": "met",
"details": [],
"max_points": 7.5
},
{
"key": "fuzzing",
"name": "Fuzzing",
"detail": "project is fuzzed",
"points": 5,
"status": "met",
"details": [],
"max_points": 5
},
{
"key": "license",
"name": "License",
"detail": "license file detected",
"points": 2.5,
"status": "met",
"details": [],
"max_points": 2.5
},
{
"key": "maintained",
"name": "Maintained",
"detail": "30 commit(s) and 22 issue activity found in the last 90 days -- score normalized to 10",
"points": 7.5,
"status": "met",
"details": [],
"max_points": 7.5
},
{
"key": "packaging",
"name": "Packaging",
"detail": "packaging workflow detected",
"points": 5,
"status": "met",
"details": [],
"max_points": 5
},
{
"key": "pinned_dependencies",
"name": "Pinned-Dependencies",
"detail": "dependency not pinned by hash detected -- score normalized to 5",
"points": 2.5,
"status": "partial",
"details": [],
"max_points": 5
},
{
"key": "sast",
"name": "SAST",
"detail": "SAST tool is not run on all commits -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 5
},
{
"key": "security_policy",
"name": "Security-Policy",
"detail": "security policy file detected",
"points": 5,
"status": "met",
"details": [],
"max_points": 5
},
{
"key": "signed_releases",
"name": "Signed-Releases",
"detail": "Project has not signed or included provenance with any releases.",
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.5
},
{
"key": "token_permissions",
"name": "Token-Permissions",
"detail": "detected GitHub workflow tokens with excessive permissions",
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.5
},
{
"key": "vulnerabilities",
"name": "Vulnerabilities",
"detail": "4 existing vulnerabilities detected",
"points": 4.5,
"status": "partial",
"details": [],
"max_points": 7.5
}
]
},
{
"key": "dependency_advisories",
"band": "excellent",
"name": "Dependency advisories",
"note": "Excluded from scoring (no data or not applicable): Indirect dependencies free of known advisories, No advisories left outstanding. Remaining weights renormalized. Matched 208 resolved dependencies against OSV. This repository publishes no package the index resolves, so the repository dependency graph was assessed instead. That graph mixes development and test pins with shipped dependencies, so only the declared runtime dependencies are scored; transitive findings are reported as context and excluded from the score. Reachability is not analyzed.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"indirect_dependencies_free_of_known_advisories",
"no_advisories_left_outstanding"
]
}
},
{
"code": "weights_renormalized",
"params": {}
},
{
"code": "advisories_scope_repository",
"params": {
"assessed": 208
}
},
{
"code": "advisories_repo_graph_caveat",
"params": {}
},
{
"code": "advisories_reachability",
"params": {}
}
],
"value": 100,
"inputs": {
"source": "osv",
"advisories": 4,
"affected_packages": 4,
"assessed_packages": 208,
"unassessed_packages": 0,
"affected_by_severity": "critical 2, moderate 1, unknown 1",
"direct_affected_packages": 0
},
"components": [
{
"key": "direct_dependencies_free_of_known_advisories",
"name": "Direct dependencies free of known advisories",
"detail": "no direct dependency carries a known advisory",
"points": 35,
"status": "met",
"details": [
{
"code": "no_direct_advisories",
"params": {}
}
],
"max_points": 35
},
{
"key": "indirect_dependencies_free_of_known_advisories",
"name": "Indirect dependencies free of known advisories",
"detail": "transitive set not separable from development and test dependencies in this scope",
"points": 0,
"status": "excluded",
"details": [
{
"code": "advisories_scope_not_separable",
"params": {}
}
],
"max_points": 25
},
{
"key": "no_advisories_left_outstanding",
"name": "No advisories left outstanding",
"detail": "no advisory carries a publication date",
"points": 0,
"status": "excluded",
"details": [
{
"code": "advisories_no_publication_date",
"params": {}
}
],
"max_points": 40
}
]
},
{
"key": "malicious_dependencies",
"band": "excellent",
"name": "Malicious dependencies",
"note": null,
"notes": [],
"value": 100,
"inputs": {
"source": "osv",
"meaning": "reported as a malicious package by the OpenSSF corpus; the remedy is removal or moving off the compromised name, never an upgrade of the same artifact. Versions the registry has since pulled are listed but not scored",
"packages": [],
"red_flag": false,
"assessed_packages": 208,
"malicious_packages": 0,
"direct_malicious_packages": 0,
"withdrawn_malicious_packages": 0,
"installable_malicious_packages": 0
},
"components": [
{
"key": "no_dependency_reported_as_a_malicious_package",
"name": "No dependency reported as a malicious package",
"detail": "no dependency is reported as a malicious package",
"points": 100,
"status": "met",
"details": [
{
"code": "no_malicious_dependencies",
"params": {}
}
],
"max_points": 100
}
]
},
{
"key": "high_risk_jurisdiction_exposure",
"band": "excellent",
"name": "High-Risk Jurisdiction Exposure",
"note": "Only high-confidence self-published location evidence affects this multiplier. Ambiguous matches are review-only; country evidence is not proof of nationality, citizenship, legal registration, malicious intent, or sanctions status.",
"notes": [
{
"code": "jurisdiction_evidence_limits",
"params": {}
}
],
"value": 100,
"inputs": {
"meaning": "self-published location evidence; not nationality or citizenship",
"red_flag": false,
"exposures": [],
"policy_countries": [
"Russia",
"Iran",
"North Korea"
],
"review_only_matches": 0,
"assessed_self_published_locations": 26
},
"components": [
{
"key": "policy_exposure_multiplier",
"name": "Policy exposure multiplier",
"detail": "no confirmed policy-scope location match",
"points": 100,
"status": "met",
"details": [
{
"code": "jurisdiction_no_match",
"params": {}
}
],
"max_points": 100
}
]
}
],
"description": "Are visible security and supply-chain practices strong, with no malicious dependency and no unresolved high-risk jurisdiction exposure?"
},
{
"key": "ai_readiness",
"band": "good",
"name": "AI Readiness",
"value": 77,
"weight": 0,
"metrics": [
{
"key": "ai_agent_context",
"band": "moderate",
"name": "Agent context & guidance",
"note": null,
"notes": [],
"value": 55,
"inputs": {
"has_llms_txt": true,
"legible_history_share": 0.955,
"agent_instruction_files": [],
"agent_instruction_max_bytes": null
},
"components": [
{
"key": "agent_instructions",
"name": "Agent instructions",
"detail": "no CLAUDE.md / AGENTS.md / editor rules",
"points": 0,
"status": "missed",
"details": [
{
"code": "no_agent_instructions",
"params": {}
}
],
"max_points": 45
},
{
"key": "machine_readable_docs_llms_txt",
"name": "Machine-readable docs (llms.txt)",
"detail": "llms.txt present",
"points": 15,
"status": "met",
"details": [
{
"code": "llms_txt_present",
"params": {}
}
],
"max_points": 15
},
{
"key": "legible_commit_history",
"name": "Legible commit history",
"detail": "84 of 88 human commits state their intent (structured subject or explanatory body)",
"points": 40,
"status": "met",
"details": [
{
"code": "legible_history",
"params": {
"legible": 84,
"sampled": 88
}
}
],
"max_points": 40
}
]
},
{
"key": "ai_verify_loop",
"band": "good",
"name": "Verify loop (build / test / typecheck)",
"note": null,
"notes": [],
"value": 84,
"inputs": {
"has_nix": false,
"has_tests": true,
"lockfiles": [
"go.sum"
],
"has_dockerfile": true,
"typed_language": true,
"bootstrap_files": [],
"has_devcontainer": false,
"has_linter_config": true,
"typecheck_configs": [],
"agent_commit_share": 0.02,
"toolchain_manifests": [
"caddy/go.mod",
"go.mod"
],
"dependency_bot_commit_share": 0.04
},
"components": [
{
"key": "one_command_bootstrap",
"name": "One-command bootstrap",
"detail": "caddy/go.mod, go.mod (toolchain convention, no task runner)",
"points": 12.6,
"status": "partial",
"details": [
{
"code": "toolchain_convention",
"params": {
"files": "caddy/go.mod, go.mod"
}
}
],
"max_points": 18
},
{
"key": "automated_tests",
"name": "Automated tests",
"detail": null,
"points": 22,
"status": "met",
"details": [],
"max_points": 22
},
{
"key": "lint_format_config",
"name": "Lint / format config",
"detail": ".golangci.yaml",
"points": 11,
"status": "met",
"details": [
{
"code": "file_list",
"params": {
"files": ".golangci.yaml"
}
}
],
"max_points": 11
},
{
"key": "static_type_checking",
"name": "Static type checking",
"detail": "Go (statically typed)",
"points": 11,
"status": "met",
"details": [
{
"code": "statically_typed_language",
"params": {
"language": "Go"
}
}
],
"max_points": 11
},
{
"key": "reproducible_environment",
"name": "Reproducible environment",
"detail": "Dockerfile, lockfile",
"points": 10,
"status": "met",
"details": [
{
"code": "file_list",
"params": {
"files": "Dockerfile, lockfile"
}
}
],
"max_points": 10
},
{
"key": "demonstrated_agent_practice",
"name": "Demonstrated agent practice",
"detail": "2 of the last 100 commits agent-authored or agent-credited",
"points": 4,
"status": "partial",
"details": [
{
"code": "agent_authored_commits",
"params": {
"count": 2,
"sampled": 100
}
}
],
"max_points": 10
},
{
"key": "automated_maintenance",
"name": "Automated maintenance",
"detail": "4 of the last 100 commits are automated dependency updates",
"points": 8,
"status": "met",
"details": [
{
"code": "dependency_bot_commits",
"params": {
"count": 4,
"sampled": 100
}
}
],
"max_points": 8
},
{
"key": "openssf_scorecard_pinned_dependencies",
"name": "OpenSSF Scorecard: Pinned-Dependencies",
"detail": "dependency not pinned by hash detected -- score normalized to 5",
"points": 5,
"status": "partial",
"details": [],
"max_points": 10
}
]
},
{
"key": "ai_code_legibility",
"band": "excellent",
"name": "Code legibility for models",
"note": null,
"notes": [],
"value": 100,
"inputs": {
"primary_language": "Go",
"largest_source_bytes": 95783,
"source_files_sampled": 249,
"oversized_source_files": 2
},
"components": [
{
"key": "type_checkable_code",
"name": "Type-checkable code",
"detail": "Go (statically typed)",
"points": 45,
"status": "met",
"details": [
{
"code": "statically_typed_language",
"params": {
"language": "Go"
}
}
],
"max_points": 45
},
{
"key": "manageable_file_sizes",
"name": "Manageable file sizes",
"detail": "2/249 source files over 60KB",
"points": 54.6,
"status": "partial",
"details": [
{
"code": "oversized_source_files",
"params": {
"kb": 60,
"sampled": 249,
"oversized": 2
}
}
],
"max_points": 55
}
]
}
],
"description": "How well is the repo equipped to be developed and maintained with AI coding agents? An independent, experimental badge — weight 0.0, so it is surfaced on its own and does not affect the overall health score."
}
],
"metrics_version": "1.13.0"
},
"warnings": [
"Star history unavailable: GitHub GraphQL error: Resource not accessible by personal access token",
"go package 'github.com/dunglas/frankenphp' points at a different repository (https://github.com/dunglas/frankenphp); excluded from ecosystem scoring",
"go package 'github.com/dunglas/frankenphp/caddy' points at a different repository (https://github.com/dunglas/frankenphp); excluded from ecosystem scoring"
],
"report_type": "repository",
"generated_at": "2026-07-24T21:45:10.799340Z",
"schema_version": "0.27.0",
"badge_url": "https://raw.githubusercontent.com/inspect-software/badges/main/v1/p/php/frankenphp.svg",
"full_name": "php/frankenphp",
"license_state": "standard",
"license_spdx": "MIT"
}
Related records
Inspected repositories sharing catalogue tags or ecosystems with php/frankenphp. Read them side by side →
Scores are signals, not warranties. They reflect publicly visible practices on GitHub — not a code audit, and not a security guarantee.
Missing data is excluded and weights renormalized, never scored as zero. Methodology is versioned and open: metrics v1.13.0, schema v0.27.0 — full methodology · metrics wiki.
