vRallev/app-platform holds a health index of 68 out of 100, placing it in the Moderate band. It scores highest on Vitality (90/100) and lowest on Community & Adoption (54/100). It was last updated today. A single contributor accounts for most of its recent work.
68
overall / 100
Moderate
Software health index
Metrics are grouped into weighted categories on one standardized 1–100 scale. Overall starts as their weighted mean; when public evidence triggers the High-Risk Jurisdiction Policy, the rating is adjusted and receives an At risk ceiling of 49. AI Readiness sits outside the overall score.
68
Excellent85-100Exemplary; meets essentially all checked criteria
Good70-84Healthy; minor gaps
Moderate50-69Acceptable with notable gaps; review recommended
At risk30-49Significant weaknesses; adoption warrants caution
Critical1-29Severe problems (abandoned, single-maintainer, no hygiene)
Score profile
Each axis is a category. The shape matters more than the average — a healthy subject fills the whole shape, while a spike-and-crater profile means strength in one dimension is masking risk in another.
Direct dependencies free of known advisories — no direct dependency carries a known advisory
0/25
Indirect dependencies free of known advisories — transitive set not separable from development and test dependencies in this scope
0/40
No advisories left outstanding — no advisory carries a publication date
Inputs used
source
osv
advisories
6
affected_packages
4
assessed_packages
237
unassessed_packages
0
affected_by_severity
high 2, moderate 1, low 1
direct_affected_packages
0
Excluded from scoring (no data or not applicable): Indirect dependencies free of known advisories, No advisories left outstanding. Remaining weights renormalized. Matched 237 resolved dependencies against OSV. This repository publishes no package the index resolves, so the repository dependency graph was assessed instead. That graph mixes development and test pins with shipped dependencies, so only the declared runtime dependencies are scored; transitive findings are reported as context and excluded from the score. Reachability is not analyzed.
How well is the repo equipped to be developed and maintained with AI coding agents? An independent, experimental badge — weight 0.0, so it is surfaced on its own and does not affect the overall health score.
Star history unavailable: GitHub GraphQL error: Resource not accessible by personal access token
More detail
Star and fork history 0 ★ / 29 ⇿
0Stars
29Forks
13Releases
When each star and fork was added, collected from GitHub and bucketed by day. Cumulative growth sits directly above the daily additions it is made of, so the two read against each other: steady organic accretion looks nothing like an abrupt, short-lived burst. Where that difference is measurable, it is reported as growth authenticity.
Major 0Minor 0Patch 13
Each point covers 2 days.
OpenSSF Scorecard 4.7 / 10
4.7aggregate
Independent, tool-agnostic security assessment from the open-source OpenSSF Scorecard. Each check rewards a security practice, not a specific vendor's tool. Checks Scorecard could not determine are marked n/a and excluded from the security score (never counted as zero).Scorecard v5.5.0 · 2026-07-25 23:59 UTC
Full resolved dependency set from the GitHub dependency graph: 0 direct and 237 indirect (transitive) packages. The transitive closure is complete when the repository commits a lockfile.
Registry
Package
Version
Relation
npm
@js-joda/core
3.2.0
indirect
npm
@jsonjoy.com/base64
1.1.2
indirect
npm
@jsonjoy.com/base64
17.67.0
indirect
npm
@jsonjoy.com/buffers
1.2.1
indirect
npm
@jsonjoy.com/buffers
17.67.0
indirect
npm
@jsonjoy.com/codegen
1.0.0
indirect
npm
@jsonjoy.com/codegen
17.67.0
indirect
npm
@jsonjoy.com/fs-core
4.57.7
indirect
npm
@jsonjoy.com/fs-fsa
4.57.7
indirect
npm
@jsonjoy.com/fs-node
4.57.7
indirect
npm
@jsonjoy.com/fs-node-builtins
4.57.7
indirect
npm
@jsonjoy.com/fs-node-to-fsa
4.57.7
indirect
npm
@jsonjoy.com/fs-node-utils
4.57.7
indirect
npm
@jsonjoy.com/fs-print
4.57.7
indirect
npm
@jsonjoy.com/fs-snapshot
4.57.7
indirect
npm
@jsonjoy.com/json-pack
1.21.0
indirect
npm
@jsonjoy.com/json-pack
17.67.0
indirect
npm
@jsonjoy.com/json-pointer
1.0.2
indirect
npm
@jsonjoy.com/json-pointer
17.67.0
indirect
npm
@jsonjoy.com/util
1.9.0
indirect
npm
@jsonjoy.com/util
17.67.0
indirect
npm
@leichtgewicht/ip-codec
2.0.5
indirect
npm
@noble/hashes
1.4.0
indirect
npm
@peculiar/asn1-cms
2.8.0
indirect
npm
@peculiar/asn1-csr
2.8.0
indirect
npm
@peculiar/asn1-ecc
2.8.0
indirect
npm
@peculiar/asn1-pfx
2.8.0
indirect
npm
@peculiar/asn1-pkcs8
2.8.0
indirect
npm
@peculiar/asn1-pkcs9
2.8.0
indirect
npm
@peculiar/asn1-rsa
2.8.0
indirect
npm
@peculiar/asn1-schema
2.8.0
indirect
npm
@peculiar/asn1-x509
2.8.0
indirect
npm
@peculiar/asn1-x509-attr
2.8.0
indirect
npm
@peculiar/utils
2.0.3
indirect
npm
@peculiar/x509
1.14.3
indirect
npm
@types/body-parser
1.19.6
indirect
npm
@types/bonjour
3.5.13
indirect
npm
@types/connect
3.4.38
indirect
npm
@types/connect-history-api-fallback
1.5.4
indirect
npm
@types/express
4.17.25
indirect
npm
@types/express
5.0.6
indirect
npm
@types/express-serve-static-core
4.19.8
indirect
npm
@types/express-serve-static-core
5.1.1
indirect
npm
@types/http-errors
2.0.5
indirect
npm
@types/http-proxy
1.17.17
indirect
npm
@types/json-schema
7.0.15
indirect
npm
@types/mime
1.3.5
indirect
npm
@types/node
25.9.3
indirect
npm
@types/qs
6.15.1
indirect
npm
@types/range-parser
1.2.7
indirect
npm
@types/retry
0.12.2
indirect
npm
@types/send
0.17.6
indirect
npm
@types/send
1.2.1
indirect
npm
@types/serve-index
1.9.4
indirect
npm
@types/serve-static
1.15.10
indirect
npm
@types/serve-static
2.2.0
indirect
npm
@types/sockjs
0.3.36
indirect
npm
@types/ws
8.18.1
indirect
npm
accepts
1.3.8
indirect
npm
ajv
8.20.0
indirect
npm
ajv-formats
2.1.1
indirect
npm
ajv-keywords
5.1.0
indirect
npm
ansi-html-community
0.0.8
indirect
npm
anymatch
3.1.3
indirect
npm
array-flatten
1.1.1
indirect
npm
asn1js
3.0.10
indirect
npm
batch
0.6.1
indirect
npm
binary-extensions
2.3.0
indirect
npm
body-parser
1.20.5
indirect
npm
bonjour-service
1.4.1
indirect
npm
braces
3.0.3
indirect
npm
bundle-name
4.1.0
indirect
npm
bytes
3.1.2
indirect
npm
bytestreamjs
2.0.1
indirect
npm
call-bind-apply-helpers
1.0.2
indirect
npm
call-bound
1.0.4
indirect
npm
chokidar
3.6.0
indirect
npm
colorette
2.0.20
indirect
npm
compressible
2.0.18
indirect
npm
compression
1.8.1
indirect
npm
connect-history-api-fallback
2.0.0
indirect
npm
content-disposition
0.5.4
indirect
npm
content-type
1.0.5
indirect
npm
cookie
0.7.2
indirect
npm
cookie-signature
1.0.7
indirect
npm
core-util-is
1.0.3
indirect
npm
debug
2.6.9
indirect
npm
debug
4.4.3
indirect
npm
default-browser
5.5.0
indirect
npm
default-browser-id
5.0.1
indirect
npm
define-lazy-prop
3.0.0
indirect
npm
depd
1.1.2
indirect
npm
depd
2.0.0
indirect
npm
destroy
1.2.0
indirect
npm
detect-node
2.1.0
indirect
npm
dns-packet
5.6.1
indirect
npm
dunder-proto
1.0.1
indirect
npm
ee-first
1.1.1
indirect
npm
encodeurl
2.0.0
indirect
npm
es-define-property
1.0.1
indirect
npm
es-errors
1.3.0
indirect
npm
es-object-atoms
1.1.2
indirect
npm
escape-html
1.0.3
indirect
npm
etag
1.8.1
indirect
npm
eventemitter3
4.0.7
indirect
npm
express
4.22.2
indirect
npm
fast-deep-equal
3.1.3
indirect
npm
fast-uri
3.1.2
indirect
npm
faye-websocket
0.11.4
indirect
npm
fill-range
7.1.1
indirect
npm
finalhandler
1.3.2
indirect
npm
follow-redirects
1.16.0
indirect
npm
forwarded
0.2.0
indirect
npm
fresh
0.5.2
indirect
npm
fsevents
2.3.3
indirect
npm
function-bind
1.1.2
indirect
npm
get-intrinsic
1.3.0
indirect
npm
get-proto
1.0.1
indirect
npm
glob-parent
5.1.2
indirect
npm
glob-to-regex.js
1.2.0
indirect
npm
gopd
1.2.0
indirect
npm
graceful-fs
4.2.11
indirect
npm
handle-thing
2.0.1
indirect
npm
has-symbols
1.1.0
indirect
npm
hasown
2.0.4
indirect
npm
hpack.js
2.1.6
indirect
npm
http-deceiver
1.2.7
indirect
npm
http-errors
1.8.1
indirect
npm
http-errors
2.0.1
indirect
npm
http-parser-js
0.5.10
indirect
npm
http-proxy
1.18.1
indirect
npm
http-proxy-middleware
2.0.10
indirect
npm
hyperdyperid
1.2.0
indirect
npm
iconv-lite
0.4.24
indirect
npm
inherits
2.0.4
indirect
npm
ipaddr.js
1.9.1
indirect
npm
ipaddr.js
2.4.0
indirect
npm
is-binary-path
2.1.0
indirect
npm
is-docker
3.0.0
indirect
npm
is-extglob
2.1.1
indirect
npm
is-glob
4.0.3
indirect
npm
is-inside-container
1.0.0
indirect
npm
is-network-error
1.3.2
indirect
npm
is-number
7.0.0
indirect
npm
is-plain-obj
3.0.0
indirect
npm
is-wsl
3.1.1
indirect
npm
isarray
1.0.0
indirect
npm
json-schema-traverse
1.0.0
indirect
npm
launch-editor
2.14.1
indirect
npm
math-intrinsics
1.1.0
indirect
npm
media-typer
0.3.0
indirect
npm
memfs
4.57.7
indirect
npm
merge-descriptors
1.0.3
indirect
npm
methods
1.1.2
indirect
npm
micromatch
4.0.8
indirect
npm
mime
1.6.0
indirect
npm
mime-db
1.52.0
indirect
npm
mime-db
1.54.0
indirect
npm
mime-types
2.1.35
indirect
npm
mime-types
3.0.2
indirect
npm
minimalistic-assert
1.0.1
indirect
npm
ms
2.0.0
indirect
npm
ms
2.1.3
indirect
npm
multicast-dns
7.2.5
indirect
npm
negotiator
0.6.3
indirect
npm
negotiator
0.6.4
indirect
npm
normalize-path
3.0.0
indirect
npm
object-inspect
1.13.4
indirect
npm
obuf
1.1.2
indirect
npm
on-finished
2.4.1
indirect
npm
on-headers
1.1.0
indirect
npm
open
10.2.0
indirect
npm
p-retry
6.2.1
indirect
npm
parseurl
1.3.3
indirect
npm
path-to-regexp
0.1.13
indirect
npm
picocolors
1.1.1
indirect
npm
picomatch
2.3.2
indirect
npm
pkijs
3.4.0
indirect
npm
process-nextick-args
2.0.1
indirect
npm
proxy-addr
2.0.7
indirect
npm
pvtsutils
1.3.6
indirect
npm
pvutils
1.1.5
indirect
npm
qs
6.15.2
indirect
npm
range-parser
1.2.1
indirect
npm
raw-body
2.5.3
indirect
npm
readable-stream
2.3.8
indirect
npm
readable-stream
3.6.2
indirect
npm
readdirp
3.6.0
indirect
npm
reflect-metadata
0.2.2
indirect
npm
require-from-string
2.0.2
indirect
npm
requires-port
1.0.0
indirect
npm
retry
0.13.1
indirect
npm
run-applescript
7.1.0
indirect
npm
safe-buffer
5.1.2
indirect
npm
safe-buffer
5.2.1
indirect
npm
safer-buffer
2.1.2
indirect
npm
schema-utils
4.3.3
indirect
npm
select-hose
2.0.0
indirect
npm
selfsigned
5.5.0
indirect
npm
send
0.19.2
indirect
npm
serve-index
1.9.2
indirect
npm
serve-static
1.16.3
indirect
npm
setprototypeof
1.2.0
indirect
npm
shell-quote
1.8.4
indirect
npm
side-channel
1.1.1
indirect
npm
side-channel-list
1.0.1
indirect
npm
side-channel-map
1.0.1
indirect
npm
side-channel-weakmap
1.0.2
indirect
npm
sockjs
0.3.24
indirect
npm
spdy
4.0.2
indirect
npm
spdy-transport
3.0.0
indirect
npm
statuses
1.5.0
indirect
npm
statuses
2.0.2
indirect
npm
string_decoder
1.1.1
indirect
npm
string_decoder
1.3.0
indirect
npm
thingies
2.6.0
indirect
npm
thunky
1.1.0
indirect
npm
to-regex-range
5.0.1
indirect
npm
toidentifier
1.0.1
indirect
npm
tree-dump
1.1.0
indirect
npm
tslib
1.14.1
indirect
npm
tslib
2.8.1
indirect
npm
tsyringe
4.10.0
indirect
npm
type-is
1.6.18
indirect
npm
undici-types
7.24.6
indirect
npm
unpipe
1.0.0
indirect
npm
util-deprecate
1.0.2
indirect
npm
utils-merge
1.0.1
indirect
npm
uuid
11.1.1
indirect
npm
vary
1.1.2
indirect
npm
wbuf
1.7.3
indirect
npm
webpack-dev-middleware
7.4.5
indirect
npm
webpack-dev-server
5.2.5
indirect
npm
websocket-driver
0.7.5
indirect
npm
websocket-extensions
0.1.4
indirect
npm
ws
8.21.0
indirect
npm
wsl-utils
0.1.0
indirect
Dependency advisories 4
This repository publishes no package the index resolves, so its own dependency graph was assessed — 237 packages, which also include development and test pins that never ship: 4 carry known advisories, of which 0 are direct.
Package
Version
Relation
Severity
Advisories
Fixed in
fast-uri
3.1.2
indirect
high
2
4.1.1
shell-quote
1.8.4
indirect
high
1
1.9.0
webpack-dev-server
5.2.5
indirect
moderate
2
5.2.6
body-parser
1.20.5
indirect
low
1
2.3.0
An advisory means the version recorded in the dependency graph falls inside an advisory’s affected range. Reachability is not analysed, and the graph includes development and test pins — a finding may concern tooling rather than shipped software.
Raw JSON report machine-readable
{
"data": {
"repo": {
"topics": [
"compose-multiplatform",
"compose-ui",
"kotlin",
"kotlin-multiplatform",
"unidirectional-data-flow"
],
"is_fork": false,
"size_kb": 9893,
"has_wiki": false,
"homepage": "https://vrallev.github.io/app-platform/",
"languages": {
"CSS": 204,
"HTML": 679,
"Java": 16588,
"Shell": 13661,
"Swift": 15810,
"Kotlin": 1087572
},
"pushed_at": "2026-07-25T03:54:58Z",
"created_at": "2025-04-11T19:20:08Z",
"owner_type": "User",
"updated_at": "2026-07-25T03:55:06Z",
"description": "A lightweight application framework for state and memory management suitable for Kotlin Multiplatform projects.",
"is_archived": false,
"is_disabled": false,
"license_spdx": "Apache-2.0",
"default_branch": "main",
"license_spdx_raw": "Apache-2.0",
"primary_language": "Kotlin",
"significant_languages": [
"Kotlin"
]
},
"owner": {
"blog": "https://ralf-wondratschek.com",
"name": "Ralf Wondratschek",
"type": "User",
"login": "vRallev",
"company": "OpenAI",
"location": "Bay Area",
"followers": 268,
"avatar_url": "https://avatars.githubusercontent.com/u/1558045?v=4",
"created_at": "2012-03-20T20:03:45Z",
"is_verified": null,
"public_repos": 41,
"account_age_days": 5240
},
"license": {
"state": "standard",
"spdx_id": "Apache-2.0",
"raw_spdx": "Apache-2.0",
"file_present": true,
"scorecard_found": true,
"profile_has_license": true
},
"activity": {
"releases": [
{
"tag": "0.1.0",
"kind": "minor",
"published_at": "2026-07-17T11:11:29Z"
},
{
"tag": "0.0.17",
"kind": "patch",
"published_at": "2026-07-15T15:50:25Z"
},
{
"tag": "0.0.16",
"kind": "patch",
"published_at": "2026-07-02T15:34:45Z"
},
{
"tag": "0.0.15",
"kind": "patch",
"published_at": "2026-06-16T00:28:06Z"
},
{
"tag": "0.0.14",
"kind": "patch",
"published_at": "2026-05-21T05:11:21Z"
},
{
"tag": "0.0.13",
"kind": "patch",
"published_at": "2026-05-14T19:15:46Z"
},
{
"tag": "0.0.12",
"kind": "patch",
"published_at": "2026-05-13T02:37:06Z"
},
{
"tag": "0.0.11",
"kind": "patch",
"published_at": "2026-05-04T02:47:09Z"
},
{
"tag": "0.0.10",
"kind": "patch",
"published_at": "2026-04-20T20:41:04Z"
},
{
"tag": "0.0.9",
"kind": "patch",
"published_at": "2026-04-13T18:46:11Z"
},
{
"tag": "0.0.8",
"kind": "patch",
"published_at": "2026-01-27T21:42:23Z"
},
{
"tag": "0.0.7",
"kind": "patch",
"published_at": "2025-09-26T17:03:46Z"
},
{
"tag": "0.0.6",
"kind": "patch",
"published_at": "2025-09-05T17:34:21Z"
},
{
"tag": "0.0.5",
"kind": "patch",
"published_at": "2025-08-15T23:35:40Z"
},
{
"tag": "0.0.4",
"kind": "patch",
"published_at": "2025-07-25T17:27:31Z"
},
{
"tag": "0.0.3",
"kind": "patch",
"published_at": "2025-05-28T22:25:17Z"
},
{
"tag": "0.0.2",
"kind": "patch",
"published_at": "2025-05-03T03:43:07Z"
},
{
"tag": "0.0.1",
"kind": "patch",
"published_at": "2025-04-17T19:16:25Z"
}
],
"recent_commits": [
{
"oid": "a99d6d36c43217e14a6cc7eea197aa9092643416",
"body": "Set `org.gradle.tooling.parallel` explicitly so Android Studio and other Tooling API clients can build project models concurrently, reducing sync time for this large multi-module project on Gradle 9.4 and newer.",
"is_bot": false,
"headline": "Enable parallel IDE sync",
"author_name": "Ralf Wondratschek",
"author_login": "vRallev",
"committed_at": "2026-07-25T03:54:56Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "130f5c3e8dd82cd84d94489905d8f70efed7ba41",
"body": "Use a square, transparent asset for `cards_layout_options.logo` so MkDocs Material can fit the complete App Platform mark into its fixed social-card logo box instead of cropping the portrait source in link previews.",
"is_bot": false,
"headline": "Fix social card logo cropping",
"author_name": "Ralf Wondratschek",
"author_login": "vRallev",
"committed_at": "2026-07-23T22:48:26Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "aefef463f6cee8239783aa745c9181fa41bd07bb",
"body": "Allow numeric literals to follow the project coding guidelines without forcing single-use constants or scattered suppressions by disabling `MagicNumber` in the shared Detekt configuration.",
"is_bot": false,
"headline": "Disable Detekt's MagicNumber rule",
"author_name": "Ralf Wondratschek",
"author_login": "vRallev",
"committed_at": "2026-07-17T13:19:57Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "d14269a26fe99aa97c9cad830d9d5fde165a6873",
"body": "Keep the sample template lightweight by preserving its 30/70 list-detail layout with platform views and eliminating the otherwise single-use `androidx.constraintlayout:constraintlayout` artifact.",
"is_bot": false,
"headline": "Remove ConstraintLayout from the sample template",
"author_name": "Ralf Wondratschek",
"author_login": "vRallev",
"committed_at": "2026-07-17T13:19:57Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "9d96613afa7bee37667dfc5decc323671f10348e",
"body": null,
"is_bot": false,
"headline": "Highlight which dependencies should not be upgraded",
"author_name": "Ralf Wondratschek",
"author_login": "vRallev",
"committed_at": "2026-07-17T12:47:44Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "b6bc45d99b69c2a0485069e5bf20951f1fc4fce7",
"body": "The standalone starter must use the renamed `software.ralf.app.platform` coordinates and current shared toolchain to remain a buildable reference for new projects. Migrate its identity and renderer API usage while synchronizing shared catalog versions with the root build.",
"is_bot": false,
"headline": "Update starter blueprint to App Platform 0.1.0",
"author_name": "Ralf Wondratschek",
"author_login": "vRallev",
"committed_at": "2026-07-17T12:32:29Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "b1a7ff97472eacf52db555a936e21720d61e1354",
"body": null,
"is_bot": false,
"headline": "Prepare next development version.",
"author_name": "Ralf Wondratschek",
"author_login": "vRallev",
"committed_at": "2026-07-17T11:03:26Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "d6fede0f64685ce5f55ced0f5c98d427a4f7f05f",
"body": null,
"is_bot": false,
"headline": "Releasing 0.1.0.",
"author_name": "Ralf Wondratschek",
"author_login": "vRallev",
"committed_at": "2026-07-17T11:03:26Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "563d2a93ccd03d197fd198fb414e9819bd58d566",
"body": "Give reviewers a downloadable, production-equivalent wiki without publishing PR content. Build `site/` once for every run, limit Pages permissions and deployment to non-PR runs, and preserve serialized production deployments.",
"is_bot": false,
"headline": "Build wiki artifacts for pull requests",
"author_name": "Ralf Wondratschek",
"author_login": "vRallev",
"committed_at": "2026-07-17T11:01:14Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "116d449df4e51990ef5440b89f4ebde3cce02650",
"body": "Keep architecture, presenter, template, and testing visuals reproducible and readable in both MkDocs color schemes. Replace Mermaid and raster diagrams with committed `.d2` sources, light and dark SVG outputs, shared Fira Code styling, and pinned rendering scripts so future edits preserve the exact layout.",
"is_bot": false,
"headline": "Render documentation diagrams with D2",
"author_name": "Ralf Wondratschek",
"author_login": "vRallev",
"committed_at": "2026-07-17T10:23:54Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "acbc6f13a7d9fb2c68c9162db3a7426ba17861f9",
"body": "These are the updated secrets for `software.ralf`.",
"is_bot": false,
"headline": "Update publishing secrets",
"author_name": "Ralf Wondratschek",
"author_login": "vRallev",
"committed_at": "2026-07-17T10:21:13Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "5890f36dce953fdd71e850a5096a15f714ec3f89",
"body": "Clarify when contributors should update `CHANGELOG.md` so release notes stay concise, consistently formatted, and limited to changes project consumers can observe.",
"is_bot": false,
"headline": "Document consumer-facing changelog expectations",
"author_name": "Ralf Wondratschek",
"author_login": "vRallev",
"committed_at": "2026-07-16T07:54:53Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "754dfe6814e9f9727f1f93a53a723c7edca6fbdc",
"body": "Keep the framework samples and standalone starter aligned with current Android platform requirements by setting both `compileSdk` and `targetSdk` to API 37 in their version catalogs.",
"is_bot": false,
"headline": "Upgrade to Android SDK 37",
"author_name": "Ralf Wondratschek",
"author_login": "vRallev",
"committed_at": "2026-07-16T07:54:26Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "a2e3b5fb4d12b54b5c17f5b65ed72935eb871f8c",
"body": "Reflect independent ownership by moving packages, Maven coordinates, Gradle plugin IDs, and sample application identities from `software.amazon.app.platform` to `software.ralf.app.platform`. This gives future artifacts and consumers an ownership-appropriate namespace while keeping the standalone starter migration separate.",
"is_bot": false,
"headline": "Move App Platform to the software.ralf namespace",
"author_name": "Ralf Wondratschek",
"author_login": "vRallev",
"committed_at": "2026-07-16T07:54:01Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "0af58fcf42dc27143093dc6d0c475334382a52a6",
"body": null,
"is_bot": false,
"headline": "Prepare next development version.",
"author_name": "Ralf Wondratschek",
"author_login": "vRallev",
"committed_at": "2026-07-15T15:42:38Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "93339c2fb8b016712c23d6013515a0b01412ea9a",
"body": null,
"is_bot": false,
"headline": "Releasing 0.0.17.",
"author_name": "Ralf Wondratschek",
"author_login": "vRallev",
"committed_at": "2026-07-15T15:42:38Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "b3e461b1fb28022f3250b86ba45cfd8f4961b10a",
"body": "Adopt the latest Compose Multiplatform and AndroidX Compose patch releases so supported Android, iOS, and Wasm apps receive their runtime, text-layout, performance, keyboard-access, and accessibility fixes.\n\nAdd an `androidx.concurrent:concurrent-futures` constraint for app modules to keep Android test lint dependency resolution working until the underlying AGP issue is removed by an upgrade.",
"is_bot": false,
"headline": "Upgrade Compose dependencies",
"author_name": "Ralf Wondratschek",
"author_login": "vRallev",
"committed_at": "2026-07-15T15:37:21Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "78c298a4b1ca5a2c188e7dd5e63ce1ff1fe05560",
"body": "Keep the build aligned with the latest compatible Kotlin ecosystem releases by updating `Kotlin` to 2.4.10, `KSP` to 2.3.10, and `Metro` to 1.3.2.",
"is_bot": false,
"headline": "Upgrade Kotlin toolchain",
"author_name": "Ralf Wondratschek",
"author_login": "vRallev",
"committed_at": "2026-07-15T15:10:41Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "6e45acef4e4dbe739cc2d09ab5192a116e4216be",
"body": "New pushes to the same PR should stop older in-progress CI runs to reduce runner time and status noise. The workflows now group PR runs by PR number while keeping non-PR runs on unique `github.run_id` groups, so `main` push builds continue independently.",
"is_bot": false,
"headline": "Cancel superseded PR CI runs",
"author_name": "Ralf Wondratschek",
"author_login": "vRallev",
"committed_at": "2026-07-04T23:24:33Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "f8cbefd764e7ab1f94854a0f824ee65a375d10bc",
"body": "Clarify that App Platform is now maintained under `vRallev/app-platform` and remove obsolete Amazon contribution, conduct, and attribution files so contributors see the current governance and Apache-2.0 expectations in the README and docs site.",
"is_bot": false,
"headline": "Remove stale Amazon project docs",
"author_name": "Ralf Wondratschek",
"author_login": "vRallev",
"committed_at": "2026-07-04T23:02:53Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "b9c7b4aea4069a2ed48f355b37a6fc2a1ded364c",
"body": null,
"is_bot": false,
"headline": "Prepare next development version.",
"author_name": "Ralf Wondratschek",
"author_login": "vRallev",
"committed_at": "2026-07-02T15:27:48Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "9b04fb9a2400334961925c64f8c03563b722cb69",
"body": null,
"is_bot": false,
"headline": "Releasing 0.0.16.",
"author_name": "Ralf Wondratschek",
"author_login": "vRallev",
"committed_at": "2026-07-02T15:27:48Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "6738aff6b1bdfb703e965581c988b146b710aa7f",
"body": "KMP app modules that enable Compose UI should not need an Android target or manual test dependency just to use App Platform Compose robots. Add the `robot-compose-multiplatform-public` artifact through KMP app test source sets while keeping the existing Android dependency path, and let the sample desktop test rely on the plugin-provided dependency.",
"is_bot": false,
"headline": "Add Compose robot tests to KMP app modules",
"author_name": "Ralf Wondratschek",
"author_login": "vRallev",
"committed_at": "2026-07-02T15:11:22Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "211981d6da8a5873f1123b7b2c2bcb9a036415d8",
"body": "Make production releases less error-prone by codifying the changelog, version, tag, and next snapshot sequence in `release.sh`. Update `RELEASING.md` so maintainers have a script-first path while retaining the manual fallback.",
"is_bot": false,
"headline": "Add release helper script",
"author_name": "Ralf Wondratschek",
"author_login": "vRallev",
"committed_at": "2026-07-02T06:08:17Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "c670bd7b3c516b0747a9769e7971672a9b851e2e",
"body": "AGP 9 Android modules can rely on built-in Kotlin without applying `org.jetbrains.kotlin.android`, so App Platform dependency wiring must listen to Android app/library plugins directly. This keeps `enableMetro(true)` and `addImplModuleDependencies(true)` working for AGP-only modules while preserving KMP/JVM and legacy Kotlin Android behavior.",
"is_bot": false,
"headline": "Support AGP built-in Kotlin Android modules",
"author_name": "Ralf Wondratschek",
"author_login": "vRallev",
"committed_at": "2026-07-02T06:01:59Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "54201a8ff5903f748b36e930ed299ead6dad668a",
"body": "App modules are the boundary allowed to import `:impl` modules, so path groups such as `:apps:`, `:app-*:`, and `:apps-*:` need to be classified consistently with `:app:`. This keeps module-structure checks from rejecting app-specific modules nested under those Gradle paths.",
"is_bot": false,
"headline": "Recognize app module path groups",
"author_name": "Ralf Wondratschek",
"author_login": "vRallev",
"committed_at": "2026-07-02T05:04:14Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "b3f5ead296081378100fadbbe8dfa4fc8961cee0",
"body": "Run release and snapshot publication on `ubuntu-latest` so these non-Apple publishing jobs no longer depend on macOS runner capacity. The workflow triggers, repository guards, and publishing commands stay unchanged.",
"is_bot": false,
"headline": "Use Ubuntu runners for publish workflows",
"author_name": "Ralf Wondratschek",
"author_login": "vRallev",
"committed_at": "2026-07-02T03:59:10Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "2d91b33489f3956b9a9913fd5d911ffe2ea090fa",
"body": "Point docs, publishing metadata, and workflow guards at `vRallev/app-platform` so badges, source links, Pages links, and release automation follow the transferred repository instead of the former `amzn/app-platform` owner.",
"is_bot": false,
"headline": "Update repository URLs after transfer",
"author_name": "Ralf Wondratschek",
"author_login": "vRallev",
"committed_at": "2026-07-02T03:59:10Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "bf29e3caea6e85ecdab2b103bd98ad47ea2ce20d",
"body": "Decoupling formatting from the Gradle plugin keeps CI on the current `ktfmt` release instead of relying on lagging generated Gradle tasks. The new root `ktfmt.sh` runner centralizes the pinned formatter invocation, removes plugin wiring from convention builds, and skips compiler-plugin fixtures whose diagnostic marker syntax is not parseable Kotlin source.",
"is_bot": false,
"headline": "Replace ktfmt Gradle plugin with standalone runner",
"author_name": "Ralf Wondratschek",
"author_login": "vRallev",
"committed_at": "2026-07-02T00:49:00Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "56fa12180129d426c2f35b43e4c5211ab21cf3cd",
"body": "Upgrade build tooling and Metro",
"is_bot": false,
"headline": "Merge pull request #202 from vRallev/ralf/updates",
"author_name": "Ralf Wondratschek",
"author_login": "vRallev",
"committed_at": "2026-07-01T23:54:39Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "9ee23bc4e3409f380fc23a08b72204ddb5cbb321",
"body": "Align build JDK with JDK 25",
"is_bot": false,
"headline": "Merge pull request #207 from vRallev/ralf/upgrade-jdk-25",
"author_name": "Ralf Wondratschek",
"author_login": "vRallev",
"committed_at": "2026-07-01T23:50:55Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "02a8b8252b4949c30d6dd8cbc95916efa8ac23e7",
"body": "Update the root `metro` version catalog entry to `1.3.0` and refresh the affected Metro compiler-plugin IR dump goldens. The refreshed dumps track Metro 1.3.0 generated contribution stubs and fully-qualified hint names so the extension tests continue to assert the current compiler output.",
"is_bot": false,
"headline": "Upgrade Metro to 1.3.0",
"author_name": "Ralf Wondratschek",
"author_login": "vRallev",
"committed_at": "2026-07-01T23:37:53Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "8486df8c2c81fd18624c96acfc2d4bf63b045df5",
"body": "Update the selected version catalog entries for `androidx-lint-gradle`, `build-config`, and `maven-publish`, and move the root Gradle wrapper to `9.5.1`. Gradle `9.5.1` is the newest compatible wrapper line for the current AGP `8.13.2`; Gradle `9.6.1` fails during configuration unless AGP is upgraded too.",
"is_bot": false,
"headline": "Upgrade selected build tooling",
"author_name": "Ralf Wondratschek",
"author_login": "vRallev",
"committed_at": "2026-07-01T23:37:53Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "33b86a56bb2ff04030c5507923c8dfef4a7def89",
"body": "Move detekt to the JDK 25-tested 2.x Gradle plugin line and migrate the local task/config APIs so the CI `detekt` job can run on the upgraded Java toolchain.",
"is_bot": false,
"headline": "Update detekt for JDK 25",
"author_name": "Ralf Wondratschek",
"author_login": "vRallev",
"committed_at": "2026-07-01T23:07:11Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "c639d86bf7b4011a34895b8ad71db430dcb2180b",
"body": "Move CI's shared Java setup and the `buildSrc` JVM target to JDK 25 so local and CI builds exercise the same toolchain while published modules keep their existing `jvm-compatibility` target.",
"is_bot": false,
"headline": "Align build JDK with JDK 25",
"author_name": "Ralf Wondratschek",
"author_login": "vRallev",
"committed_at": "2026-07-01T22:46:38Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "884606cec686ec71ee5b3164913c04ce85d32d0a",
"body": "Patch Wasm npm security alerts",
"is_bot": false,
"headline": "Merge pull request #205 from vRallev/ralf/fix-dependabot-wasm-locks",
"author_name": "Ralf Wondratschek",
"author_login": "vRallev",
"committed_at": "2026-07-01T22:41:01Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "9d548c9105f733df3fe0799dc475ac150832fc89",
"body": "Pin vulnerable Wasm npm transitive dependencies to patched versions so Dependabot no longer reports the root and starter Kotlin/Wasm lockfiles for `http-proxy-middleware` and `uuid` advisories.",
"is_bot": false,
"headline": "Patch Wasm npm security alerts",
"author_name": "Ralf Wondratschek",
"author_login": "vRallev",
"committed_at": "2026-07-01T22:25:41Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "6a8de9356940b20ac5121ad6f361d41a8a5a5254",
"body": "Run starter ktfmt check on Linux",
"is_bot": false,
"headline": "Merge pull request #204 from vRallev/ralf/starter-ktfmt-linux",
"author_name": "Ralf Wondratschek",
"author_login": "vRallev",
"committed_at": "2026-07-01T22:24:32Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "9984d41b7a2c20401ac8cc983973b20494a850a8",
"body": "Use an Ubuntu runner for the starter blueprint `ktfmt` check so formatting validation no longer consumes a macOS runner just to install the formatter with Homebrew. Keep the `ktfmt` version in the starter version catalog so CI uses a reviewable, pinned formatter release.",
"is_bot": false,
"headline": "Run starter ktfmt check on Linux",
"author_name": "Ralf Wondratschek",
"author_login": "vRallev",
"committed_at": "2026-07-01T22:06:12Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "f7a943e18816d33b2a2f312e9b28564883b18f4d",
"body": "Update MacOS runners after ownership transfer",
"is_bot": false,
"headline": "Merge pull request #203 from vRallev/ralf/ios-runners",
"author_name": "Ralf Wondratschek",
"author_login": "vRallev",
"committed_at": "2026-07-01T22:03:03Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "bebfdc383fba9d292874be8fb61d04f01476fffa",
"body": "Update the `build-ios-sample-app` workflow to build against `generic/platform=iOS Simulator` instead of resolving an exact iOS 26.0 simulator device. This keeps the Swift sample build working as `macos-latest` images move across iOS 26.x runtime versions.",
"is_bot": false,
"headline": "Use generic iOS simulator destination in CI",
"author_name": "Ralf Wondratschek",
"author_login": "vRallev",
"committed_at": "2026-07-01T21:06:09Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "28b1b88e1c86d99af995133af4cb94abb7f3f260",
"body": null,
"is_bot": false,
"headline": "Update MacOS runners after ownership transfer",
"author_name": "Ralf Wondratschek",
"author_login": "vRallev",
"committed_at": "2026-07-01T20:11:24Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "87b4c3ed64e890da51ff0afb9cf2dcd362062ed9",
"body": null,
"is_bot": false,
"headline": "Address security vulnerabilities",
"author_name": "Jessalyn Wang",
"author_login": "JessalynWang",
"committed_at": "2026-06-16T04:52:20Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "0f86c0d79d746dba21eeede26e18fb9b7af8bed1",
"body": null,
"is_bot": false,
"headline": "Prepare next development version.",
"author_name": "Jessalyn Wang",
"author_login": "JessalynWang",
"committed_at": "2026-06-16T00:21:16Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "9db1d79564469574e02bae9a1b3c1d73f0b9b37a",
"body": null,
"is_bot": false,
"headline": "Releasing 0.0.15.",
"author_name": "Jessalyn Wang",
"author_login": "JessalynWang",
"committed_at": "2026-06-16T00:19:04Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "21b76e13cc101479d2fe59f3a0a641744ff017dc",
"body": "Add nested `enableModuleStructure` options with `allowImplToImplDependencies`, preserving the existing Boolean overload and a false default. This lets sibling implementation variants reuse code without forcing an otherwise-empty `:internal` module.\n\nThread the option through the cacheable dependency\n[…]\nary and external implementation dependencies forbidden and retaining existing internal-module semantics. Update the public API snapshot and consumer documentation for both Groovy and Kotlin DSL usage.",
"is_bot": false,
"headline": "Allow opt-in impl-to-impl dependencies (#200)",
"author_name": "Ralf Wondratschek",
"author_login": "vRallev",
"committed_at": "2026-06-15T23:56:58Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "0809da02fcfd9e092f4559316c3c72ff5bf42665",
"body": "Upgrade Metro to the latest version.",
"is_bot": false,
"headline": "Upgrade Metro (#198)",
"author_name": "Ralf Wondratschek",
"author_login": "vRallev",
"committed_at": "2026-06-12T20:38:41Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "01a8f987988bd41aa42d8708384779d78dd28899",
"body": "Upgrade Kotlin to 2.4.0",
"is_bot": false,
"headline": "Merge pull request #196 from vRallev/ralf/kotlin",
"author_name": "Simanti Olive",
"author_login": "s1mant1",
"committed_at": "2026-06-03T23:20:27Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "695fa614893fd9bab7f187c25e09364cc977729a",
"body": "Update KSP, `kotlin-compile-testing`, and Android Lint so build tooling can read Kotlin 2.4 metadata.",
"is_bot": false,
"headline": "Upgrade Kotlin to 2.4.0",
"author_name": "Ralf Wondratschek",
"author_login": "vRallev",
"committed_at": "2026-06-03T22:21:21Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "683447c03f00132ae63081218544805fc71dfa04",
"body": null,
"is_bot": false,
"headline": "Prepare next development version.",
"author_name": "Jessalyn Wang",
"author_login": "JessalynWang",
"committed_at": "2026-05-21T05:04:39Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "6a8d9166b2da2b4b730d3b60133eea5a924f87c4",
"body": null,
"is_bot": false,
"headline": "Releasing 0.0.14.",
"author_name": "Jessalyn Wang",
"author_login": "JessalynWang",
"committed_at": "2026-05-21T05:03:46Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "b64e5b1e49729a650fade08bc870ba2b74c15191",
"body": "Introduce the `:presenter-backstack-nav3:testing` module with `FakePresenterBackstackScope` and `withPresenterBackstackScope` so presenter tests can provide `LocalBackstackScope` and assert backstack mutations.\n\nWire `enableMoleculePresenterBackstack` to add the testing dependency alongside the public Nav3 backstack dependency, and update the presenter docs for explicit test backstack setup.",
"is_bot": false,
"headline": "Add presenter backstack testing helpers",
"author_name": "Ralf Wondratschek",
"author_login": "vRallev",
"committed_at": "2026-05-21T04:52:28Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "53ff5f7c64d2c66fb7e38450c5623b9cb021d5d8",
"body": "Replace the recipes-local `PresenterBackstackScope` implementation with the shared Navigation 3 presenter backstack API.\n\nUpdate `CrossSlideBackstackPresenter` and `CrossSlideBackstackRenderer` to use `PresenterBackstackModel` and `PresenterBackstackRenderer` while preserving the custom cross-slide \n[…]\nsplay` transition.\n\nUpdate the Recipes Navigation 3 sample so `Navigation3HomePresenter`, `Navigation3ChildPresenter`, and `Navigation3HomeRenderer` use `presenterBackstack` and `LocalBackstackScope`.",
"is_bot": false,
"headline": "Adopt presenter backstack in Recipes",
"author_name": "Ralf Wondratschek",
"author_login": "vRallev",
"committed_at": "2026-05-21T04:52:28Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "66eff0b244c4547d67210ea3cdfe4afab7f6dbe3",
"body": "Add the experimental `:presenter-backstack-nav3:public` module with `PresenterBackstackScope`, `presenterBackstack`, `PresenterBackstackModel`, and `PresenterBackstackRenderer`.\n\nAdd the `enableMoleculePresenterBackstack` Gradle plugin option so consumers can opt into the new module while enabling Molecule presenters and Compose UI together.\n\nDocument setup and presenter usage in `docs/setup.md` and `docs/presenter.md`.",
"is_bot": false,
"headline": "Add `:presenter-backstack-nav3:public`",
"author_name": "Ralf Wondratschek",
"author_login": "vRallev",
"committed_at": "2026-05-21T04:52:28Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "8fd40be560f7a4d156c597b51f58c2b37c26f156",
"body": "Move `ReturningSaveableStateHolder` from the recipes implementation into `:presenter-molecule:public` under `software.amazon.app.platform.presenter.molecule.saveable`, and mark the API with `@ExperimentalAppPlatform`.\n\nAlign the implementation with Compose saveable-state behavior by providing `LocalSavedStateRegistryOwner`, documenting stable saveable key requirements, supporting non-`BaseModel` return values, and preserving state through a parent `LocalSaveableStateRegistry` when available.",
"is_bot": false,
"headline": "Add experimental returning saveable state holder",
"author_name": "Ralf Wondratschek",
"author_login": "vRallev",
"committed_at": "2026-05-20T03:37:27Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "bc87b4c93c9bcb73cbcb8015885fc0ca43554241",
"body": "Add `PresenterTextFieldState` in `:presenter-molecule:public` for Molecule presenters that need to own text input values without depending on Compose Foundation text field APIs.\n\nAdd `rememberPresenterBackedTextFieldState()` in `:renderer-compose-multiplatform:public` to bridge that state to Compose\n[…]\npose-foundation` through `gradle/libs.versions.toml`, update API dumps, document the recipe in `docs/presenter.md`, update `CHANGELOG.md`, and cover the presenter state and renderer bridge with tests.",
"is_bot": false,
"headline": "Add experimental `PresenterTextFieldState`",
"author_name": "Ralf Wondratschek",
"author_login": "vRallev",
"committed_at": "2026-05-20T03:07:59Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "a70e5fb61e8b9884733b8c16be553c1e721145af",
"body": "Add the experimental `presentDetached()` API to `:presenter-molecule:public` so a child `MoleculePresenter` can run in a separate Molecule hierarchy while the parent collects its latest `BaseModel`. Preserve the active `RecompositionMode` with `LocalRecompositionMode` and cancel detached composition\n[…]\nel. Add coverage in `LaunchMoleculePresenterTest.kt` for recomposition isolation, detached input updates, the delayed-input caveat, and recomposition-mode propagation, and update the public API dumps.",
"is_bot": false,
"headline": "Add detached Molecule presenter API",
"author_name": "Ralf Wondratschek",
"author_login": "vRallev",
"committed_at": "2026-05-19T01:18:48Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "3b9eb569a499b5b6eb626fe7bc55219d65bfc951",
"body": "This new annotation can be used to mark APIs as experimental and consumers need to use an explicit opt-in to use these APIs. Neither source nor binary compatibility is guaranteed for these APIs.\n\nThe annotation is placed in a new module, because it should be allowed to reuse it across App Platform modules.",
"is_bot": false,
"headline": "Introduce `@ExperimentalAppPlatform`",
"author_name": "Ralf Wondratschek",
"author_login": "vRallev",
"committed_at": "2026-05-19T01:18:48Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "76fd14e70ac6d774b45023567ae242378c59bf3b",
"body": null,
"is_bot": false,
"headline": "Prepare next development version.",
"author_name": "Jessalyn Wang",
"author_login": "JessalynWang",
"committed_at": "2026-05-14T19:10:25Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "965088876fe652229f3547f6c4f5d056d2d1f2f2",
"body": null,
"is_bot": false,
"headline": "Releasing 0.0.13",
"author_name": "Jessalyn Wang",
"author_login": "JessalynWang",
"committed_at": "2026-05-14T19:09:47Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "fe91b4d06980cac18b12aba424f0c017695763e7",
"body": "Make the App Platform Gradle plugin compatible with AGP 9's Android KMP and built-in Kotlin behavior while staying compatible with AGP 8.",
"is_bot": false,
"headline": "Make the App Platform Gradle plugin compatible with AGP 9",
"author_name": "Ralf Wondratschek",
"author_login": "vRallev",
"committed_at": "2026-05-14T18:53:28Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "3bb5c94d8f74013208eeac23bc0f79649cff5574",
"body": "The plugin was applied no matter if you used kotlin-inject and KSP. That's unnecessary.",
"is_bot": false,
"headline": "Don't apply the KSP plugin automatically anymore",
"author_name": "Ralf Wondratschek",
"author_login": "vRallev",
"committed_at": "2026-05-14T17:21:29Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "4ef09acfa165a20e0c5d2b0e2df863bc8cff153d",
"body": null,
"is_bot": false,
"headline": "Fix CI Xcode 26 selection",
"author_name": "Ralf Wondratschek",
"author_login": "vRallev",
"committed_at": "2026-05-14T07:05:14Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "5cae600c8864c75e8110b007c592f77473d3eb92",
"body": "Including Kotlin, CMP and Metro.",
"is_bot": false,
"headline": "Upgrade several libraries",
"author_name": "Ralf Wondratschek",
"author_login": "vRallev",
"committed_at": "2026-05-14T07:05:14Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "111a8777fcece85163ce151782259b7e82086e5c",
"body": "Use the `Dispatchers.Main` as default main dispatcher instead of the immediate main dispatcher. This fixes issues in the Molecule runtime on iOS.",
"is_bot": false,
"headline": "Use the `Dispatchers.Main` as default (kotlin-inject)",
"author_name": "Ralf Wondratschek",
"author_login": "vRallev",
"committed_at": "2026-05-14T05:31:06Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "a051ea512897460bf62838234c997832455ac912",
"body": "Use the `@BindingContainer` annotation where inheritance is not needed.",
"is_bot": false,
"headline": "Use the `@BindingContainer` annotation",
"author_name": "Ralf Wondratschek",
"author_login": "vRallev",
"committed_at": "2026-05-14T04:56:34Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "496500b07bd646a1bd0969919012d5720b1069c9",
"body": "Use the `Dispatchers.Main` as default main dispatcher instead of the immediate main dispatcher. This fixes issues in the Molecule runtime on iOS.",
"is_bot": false,
"headline": "Use the `Dispatchers.Main` as default",
"author_name": "Ralf Wondratschek",
"author_login": "vRallev",
"committed_at": "2026-05-14T04:56:34Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "80cd3e66a9c3aa2498589540a36554dad0d9359a",
"body": null,
"is_bot": false,
"headline": "Prepare next development version.",
"author_name": "Jessalyn Wang",
"author_login": "JessalynWang",
"committed_at": "2026-05-13T02:31:04Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "4e5237796720b08d7ab710ba5bddbbf23050a7aa",
"body": null,
"is_bot": false,
"headline": "Releasing 0.0.12",
"author_name": "Jessalyn Wang",
"author_login": "JessalynWang",
"committed_at": "2026-05-13T02:30:03Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "8a1f8c92824ace26b4dda84f3df39988d8adbe2d",
"body": "Remove `@Inject` annotations where they're redundant.",
"is_bot": false,
"headline": "Update the wiki",
"author_name": "Ralf Wondratschek",
"author_login": "vRallev",
"committed_at": "2026-05-13T01:45:03Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "c6e58ed214e9aef8dde9249f52ccd334f6d73dfa",
"body": null,
"is_bot": false,
"headline": "Remove redundant `@Inject` annotations in the sample app",
"author_name": "Ralf Wondratschek",
"author_login": "vRallev",
"committed_at": "2026-05-13T01:45:03Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "e6a0a123dde633a80fff95443108084fc5e38fed",
"body": "Generate `@BindingContainer` on contributed scoped, robot, and renderer containers. Keep `@Binds` declarations on the interface while moving generated `@Provides` declarations into companion objects so Metro can consume mixed binding containers.\n\nUpdate FIR/IR handling plus box and dump tests for `@ContributesScoped`, `@ContributesRobot`, and `@ContributesRenderer`.",
"is_bot": false,
"headline": "Annotate generated Metro contributions as binding containers",
"author_name": "Ralf Wondratschek",
"author_login": "vRallev",
"committed_at": "2026-05-13T01:45:03Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "42cacba091f5fae17b2914e8e84ae604b6208e19",
"body": "`@ContributesScoped` now mirrors the robot and renderer behavior by generating a constructor-calling `@Provides` method when no `@Inject` constructor is present. The KSP processor and Metro compiler plugin skip the provider when `@Inject` is available and report an error when multiple constructors m\n[…]\ndd KSP and Metro box/diagnostic coverage for no-`@Inject` constructor parameters, `@Inject` secondary constructors, and ambiguous multi-constructor `@ContributesScoped` classes. Update `CHANGELOG.md`.",
"is_bot": false,
"headline": "Allow scoped contributions without inject constructors",
"author_name": "Ralf Wondratschek",
"author_login": "vRallev",
"committed_at": "2026-05-13T01:45:03Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "02f337b83bc419b3b86fe5636ad6fc3a87bd1633",
"body": "Generate a constructor-calling `@Provides` method for non-`@Inject` `@ContributesRenderer` renderers with constructor parameters, and skip that provider when the renderer class or selected constructor is annotated with `@Inject`.\n\nReport an error when multiple renderer constructors make the generated provider ambiguous, add KSP and Metro compiler plugin coverage, and replace obsolete renderer FIR dump coverage with box tests.",
"is_bot": false,
"headline": "Make `@ContributesRenderer` constructor injection optional",
"author_name": "Ralf Wondratschek",
"author_login": "vRallev",
"committed_at": "2026-05-13T01:45:03Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "09e69d15c51780099520bc20e4f1032cdaa1aaf8",
"body": "Non-injectable robot classes now get a generated `@Provides` constructor provider, while existing `@Inject` robots keep using Metro's normal injection path. This aligns the behavior with Metro, but also implements it for kotlin-inject.",
"is_bot": false,
"headline": "`@ContributesRobot` no longer requires `@Inject`",
"author_name": "Ralf Wondratschek",
"author_login": "vRallev",
"committed_at": "2026-05-13T01:45:03Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "25412f62bb2a9f4c41c99a7658011488989b2c3e",
"body": null,
"is_bot": false,
"headline": "docs: fix occured typo in fatalError message",
"author_name": "Sai Asish Y",
"author_login": "SAY-5",
"committed_at": "2026-05-11T02:42:24Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "d87b583a95eac64c7c1ed04d608a8b392cfc37b5",
"body": null,
"is_bot": false,
"headline": "Prepare next development version.",
"author_name": "Jessalyn Wang",
"author_login": "JessalynWang",
"committed_at": "2026-05-04T02:37:48Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "e401e961b6c58b89505712a390a8facb23d0e545",
"body": null,
"is_bot": false,
"headline": "Releaseing 0.0.11",
"author_name": "Jessalyn Wang",
"author_login": "JessalynWang",
"committed_at": "2026-05-04T02:36:13Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "01b037a82424167691e561171e699804e53524f7",
"body": null,
"is_bot": false,
"headline": "Update Metro to 1.0.0",
"author_name": "Jessalyn Wang",
"author_login": "JessalynWang",
"committed_at": "2026-05-04T02:16:02Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "5ed0dc7fa60adfb2a373af57fbfda8c50e5c4770",
"body": null,
"is_bot": false,
"headline": "Update documentation for `Modifier` parameter",
"author_name": "Ralf Wondratschek",
"author_login": "vRallev",
"committed_at": "2026-05-04T01:02:09Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "3895da7163fe8ee8a1813518acb1475f3737b425",
"body": "Add an optional Modifier parameter to `BaseComposeRenderer.renderCompose()` and forward it through `ComposeRenderer.Compose()`, updating renderer implementations, tests, API dumps, and the changelog for the new signature.\n\nCompose UI-emitting functions conventionally accept a Modifier so callers can\n[…]\n tags, accessibility, and other modifier behavior at the call site. The default Modifier keeps simple `renderCompose()` calls concise while still making the renderer boundary customizable when needed.",
"is_bot": false,
"headline": "Add Modifier support to Compose renderers",
"author_name": "Ralf Wondratschek",
"author_login": "vRallev",
"committed_at": "2026-05-04T01:02:09Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "4f9b6301e4da618194722a16f1d6dfe5f51abc84",
"body": "Move the recipes Navigation3 renderer into commonMain now that Navigation 3 is KMP ready.",
"is_bot": false,
"headline": "Make the Navigation 3 recipe KMP ready",
"author_name": "Ralf Wondratschek",
"author_login": "vRallev",
"committed_at": "2026-04-21T19:17:48Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "bfa586dd3c3cb50bfe5025f1d3d13890a4326554",
"body": "Drop iosX64 from the shared platform setup and starter blueprint modules to match Compose Multiplatform support.\n\nReference: https://kotlinlang.org/docs/multiplatform/whats-new-compose-111.html#dropped-support-for-apple-x86-64-targets",
"is_bot": false,
"headline": "Remove Apple x86_64 targets",
"author_name": "Ralf Wondratschek",
"author_login": "vRallev",
"committed_at": "2026-04-21T18:20:06Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "236c6a76faaacdc89f406a96bd0754b3a4d3b7bb",
"body": null,
"is_bot": false,
"headline": "Prepare next development version.",
"author_name": "Jessalyn Wang",
"author_login": "JessalynWang",
"committed_at": "2026-04-20T20:34:02Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "710458c4c13c7bad2856abdd5d9247cb0b9e529f",
"body": null,
"is_bot": false,
"headline": "Releasing 0.0.10.",
"author_name": "Jessalyn Wang",
"author_login": "JessalynWang",
"committed_at": "2026-04-20T20:33:25Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "32a1704b63281a9e27c8bcb72531e1796ff41015",
"body": "Replace the Metro extension wiring in both the published Gradle plugin and the repo-local buildSrc plugin so Metro uses the App Platform compiler plugin instead of the old KSP code generator by default.\n\nAdd the Gradle property app.platform.metro.ksp to restore the legacy KSP implementation when nee\n[…]\nte-impl-code-generators KSP wiring.\n\nAdd a CI emulator job that runs the sample app with -Papp.platform.metro.ksp=true so the fallback path stays exercised while the compiler plugin rollout continues.",
"is_bot": false,
"headline": "Switch Metro extensions to compiler plugin by default",
"author_name": "Ralf Wondratschek",
"author_login": "vRallev",
"committed_at": "2026-04-16T23:01:19Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "00fd840d15a23fee9adff6bc9bac40de06141e35",
"body": "Port the Metro ContributesScoped processor tests into the compiler plugin module with box, diagnostics, and FIR dump coverage for default, inner, scoped-only, and transitive Scoped bindings.\n\nGenerate nested ScopedContribution interfaces in FIR, register them as Metro contributions, and add diagnost\n[…]\ne on Scoped classes.\n\nUpdate the compiler test harness and generated runners so Scoped is available on the test classpath and the new contributesscoped test data is exercised in the module test suite.",
"is_bot": false,
"headline": "Implement ContributesScoped compiler plugin generation",
"author_name": "Ralf Wondratschek",
"author_login": "vRallev",
"committed_at": "2026-04-16T23:01:19Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "b7856f8153fc4c0b9874bd197b3031b6e2611243",
"body": "Port the Metro ContributesRenderer processor tests into the compiler plugin module and add renderer box, diagnostics, FIR dump, and IR dump coverage.\n\nImplement FIR, checker, Metro contribution, and IR generation for @ContributesRenderer, including explicit modelType handling, inferred model resolut\n[…]\nest harness to resolve source model class literals correctly under wildcard imports, emit Metro-visible renderer key and scope annotations, and refresh the generated runners and compiler test goldens.",
"is_bot": false,
"headline": "Implement ContributesRenderer compiler plugin generation",
"author_name": "Ralf Wondratschek",
"author_login": "vRallev",
"committed_at": "2026-04-16T23:01:19Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "282e8e1e7cc23d67234ab4c3fd154706e7e063b3",
"body": "Add the new :metro-extensions:contribute:impl-compiler-plugin module, wire it into the root build and CI, and mirror the Metro compiler test harness with generated runners, generateTests support, runtime classpaths, and box/FIR/IR/diagnostics coverage.\n\nPort the Metro ContributesRobot tests from the\n[…]\n.\n\nCover default-constructor robots, @Inject constructor robots, indirect Robot supertypes, and validation for unsupported scopes, missing Robot supertypes, missing @Inject, and singleton annotations.",
"is_bot": false,
"headline": "Set up Metro compiler plugin module and implement ContributesRobot",
"author_name": "Ralf Wondratschek",
"author_login": "vRallev",
"committed_at": "2026-04-16T23:01:19Z",
"body_truncated": true,
"is_coding_agent": false
},
{
"oid": "119a7bfc2d7efd641f721856b2561b3600dba2ac",
"body": "Then sub-modules share the same classpath and don't need to apply Metro individually.",
"is_bot": false,
"headline": "Add Metro to the root project",
"author_name": "Ralf Wondratschek",
"author_login": "vRallev",
"committed_at": "2026-04-16T16:19:32Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "e7738e2facdaf5ae112e0de6e1c0af3bbe469fa0",
"body": null,
"is_bot": false,
"headline": "Upgrade Gradle in the blueprint app",
"author_name": "Ralf Wondratschek",
"author_login": "vRallev",
"committed_at": "2026-04-16T16:19:32Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "8e30ecde31d03fc52d08c8c9eed058f98fc9971f",
"body": "Replace the starter's component-based Kotlin Inject setup with Metro graphs across the common, Android, desktop, iOS, and Wasm entrypoints.\n\nSwitch assisted injection and scoped bindings to Metro annotations, add the standalone Metro plugin and Wasm incremental-compilation settings needed by the blueprint build, and update the iOS wrapper and README to match the new graph-based setup.",
"is_bot": false,
"headline": "Migrate blueprints/starter from Kotlin Inject to Metro",
"author_name": "Ralf Wondratschek",
"author_login": "vRallev",
"committed_at": "2026-04-16T02:55:36Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "c86b0c646a3905060cee403412c62ac69d03bc33",
"body": "This brings the Blueprint app up to date.",
"is_bot": false,
"headline": "Upgrade dependencies for the Blueprint app",
"author_name": "Ralf Wondratschek",
"author_login": "vRallev",
"committed_at": "2026-04-16T02:48:05Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "6aae907cc71a6f4bcac5d4ce95415edd3d3b580b",
"body": null,
"is_bot": false,
"headline": "Upgrade Metro to 1.0.0-RC2",
"author_name": "Ralf Wondratschek",
"author_login": "vRallev",
"committed_at": "2026-04-15T21:37:24Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "bd467c110b407d88bf8a5247d608700e2e83f3f6",
"body": null,
"is_bot": false,
"headline": "Prepare next development version.",
"author_name": "Jessalyn Wang",
"author_login": "JessalynWang",
"committed_at": "2026-04-13T18:40:29Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "882a560fbd95ffab2feb2df7fbff18f1d695516d",
"body": null,
"is_bot": false,
"headline": "Releasing 0.0.9.",
"author_name": "Jessalyn Wang",
"author_login": "JessalynWang",
"committed_at": "2026-04-13T18:39:15Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "36ff8bb41d1aff286a09a629d29e9f91f63b32c8",
"body": "Metro is the better framework. It is the recommended by default moving forward. All docs were updated to list Metro first.",
"is_bot": false,
"headline": "Update the DI docs and recommend Metro",
"author_name": "Ralf Wondratschek",
"author_login": "vRallev",
"committed_at": "2026-04-12T02:02:51Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "019a8c59e1b21e78eb5393fcd96a865671cdf969",
"body": "Don't run the job that attempts to deploy docs in forked repositories. It always fails. The same check is already in place for publishing snapshots and releases.",
"is_bot": false,
"headline": "Don't attempt to deploy docs in forks",
"author_name": "Ralf Wondratschek",
"author_login": "vRallev",
"committed_at": "2026-04-12T01:55:30Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "8e3ba79a4cf1b424118cfecbdc25dfdfcc397f79",
"body": "Add a repo-local ios-run.sh helper for the sample and recipes iOS wrapper apps.\n\nThe script:\n- prompts for which app to run\n- reuses the only booted simulator when possible\n- prompts for a simulator when none or multiple are booted\n- boots the selected simulator if needed\n- builds the selected Xcode wrapper app\n- installs the built .app into the chosen simulator\n- launches the installed app by bundle identifier",
"is_bot": false,
"headline": "Add interactive iOS app runner script",
"author_name": "Ralf Wondratschek",
"author_login": "vRallev",
"committed_at": "2026-04-12T01:27:16Z",
"body_truncated": false,
"is_coding_agent": false
},
{
"oid": "889bb2bccba4e864716731d5a82d2c6ae4fa383c",
"body": "Migrate the `:sample` app from kotlin-inject to Metro. This change also renames \"component\" interfaces to \"graph\" interfaces.\n\nFixes #127",
"is_bot": false,
"headline": "Convert the `:sample` app to Metro",
"author_name": "Ralf Wondratschek",
"author_login": "vRallev",
"committed_at": "2026-04-12T01:26:42Z",
"body_truncated": false,
"is_coding_agent": false
}
],
"releases_count": 18,
"commits_last_year": 186,
"latest_release_at": "2026-07-17T11:11:29Z",
"latest_release_tag": "0.1.0",
"releases_from_tags": false,
"days_since_last_push": 0,
"active_weeks_last_year": 29,
"days_since_latest_release": 8,
"mean_days_between_releases": 10.5
},
"community": {
"has_readme": true,
"has_license": true,
"has_description": true,
"has_contributing": false,
"health_percentage": 42,
"has_issue_template": false,
"has_code_of_conduct": false,
"has_pull_request_template": false
},
"ecosystem": {
"packages": []
},
"popularity": {
"forks": 29,
"stars": 316,
"watchers": 9,
"fork_history": {
"days": [
{
"date": "2025-04-18",
"count": 4
},
{
"date": "2025-04-19",
"count": 1
},
{
"date": "2025-04-25",
"count": 2
},
{
"date": "2025-04-26",
"count": 1
},
{
"date": "2025-05-19",
"count": 1
},
{
"date": "2025-06-18",
"count": 1
},
{
"date": "2025-06-29",
"count": 1
},
{
"date": "2025-07-16",
"count": 1
},
{
"date": "2025-07-17",
"count": 1
},
{
"date": "2025-08-03",
"count": 1
},
{
"date": "2025-08-07",
"count": 1
},
{
"date": "2025-09-10",
"count": 1
},
{
"date": "2025-09-17",
"count": 2
},
{
"date": "2025-09-24",
"count": 1
},
{
"date": "2025-10-21",
"count": 1
},
{
"date": "2026-01-15",
"count": 1
},
{
"date": "2026-03-06",
"count": 1
},
{
"date": "2026-03-09",
"count": 1
},
{
"date": "2026-03-13",
"count": 1
},
{
"date": "2026-03-20",
"count": 1
},
{
"date": "2026-04-22",
"count": 1
},
{
"date": "2026-05-11",
"count": 1
},
{
"date": "2026-05-15",
"count": 1
},
{
"date": "2026-06-15",
"count": 1
}
],
"complete": true,
"collected": 29,
"total_forks": 29
},
"star_history": null,
"open_issues_and_prs": 5
},
"ai_readiness": {
"has_nix": false,
"example_dirs": [
"recipes",
"sample"
],
"has_llms_txt": false,
"has_dockerfile": false,
"has_mcp_signal": false,
"bootstrap_files": [],
"api_schema_files": [],
"has_devcontainer": false,
"typecheck_configs": [],
"toolchain_manifests": [
"blueprints/starter/app/build.gradle.kts",
"blueprints/starter/build.gradle.kts",
"blueprints/starter/navigation/impl/build.gradle.kts",
"blueprints/starter/navigation/public/build.gradle.kts",
"blueprints/starter/navigation/testing/build.gradle.kts",
"blueprints/starter/templates/impl/build.gradle.kts",
"blueprints/starter/templates/public/build.gradle.kts",
"build.gradle",
"buildSrc/build.gradle",
"common/public/build.gradle",
"di-common/public/build.gradle",
"gradle-plugin/build.gradle",
"internal/testing/build.gradle",
"kotlin-inject-extensions/contribute/impl-code-generators/build.gradle",
"kotlin-inject-extensions/contribute/public/build.gradle",
"kotlin-inject/impl/build.gradle",
"kotlin-inject/public/build.gradle",
"ksp-common/public/build.gradle",
"ksp-common/testing/build.gradle",
"metro-extensions/contribute/impl-code-generators/build.gradle",
"metro-extensions/contribute/impl-compiler-plugin/build.gradle",
"metro/impl/build.gradle",
"metro/public/build.gradle",
"presenter-backstack-nav3/public/build.gradle",
"presenter-backstack-nav3/testing/build.gradle",
"presenter-molecule/impl/build.gradle",
"presenter-molecule/public/build.gradle",
"presenter-molecule/testing/build.gradle",
"presenter/public/build.gradle",
"recipes/app/build.gradle",
"recipes/common/impl/build.gradle",
"renderer-android-view/public/build.gradle",
"renderer-compose-multiplatform/public/build.gradle",
"renderer/public/build.gradle",
"robot-compose-multiplatform/public/build.gradle",
"robot-internal/public/build.gradle",
"robot/public/build.gradle",
"sample/app/build.gradle",
"sample/login/impl-robots/build.gradle",
"sample/login/impl/build.gradle",
"sample/login/public/build.gradle",
"sample/navigation/impl/build.gradle",
"sample/navigation/public/build.gradle",
"sample/templates/impl/build.gradle",
"sample/templates/public/build.gradle",
"sample/user/impl-robots/build.gradle",
"sample/user/impl/build.gradle",
"sample/user/public/build.gradle",
"sample/user/testing/build.gradle",
"scope/public/build.gradle",
"scope/testing/build.gradle"
],
"largest_source_bytes": 27986,
"source_files_sampled": 457,
"oversized_source_files": 0,
"agent_instruction_files": [
"AGENTS.md"
],
"agent_instruction_max_bytes": 11612
},
"dependencies": {
"manifests": [
"build.gradle",
"buildSrc/build.gradle",
"gradle-plugin/build.gradle"
],
"advisories": {
"error": null,
"scope": "repository_graph",
"source": "osv",
"findings": [
{
"name": "fast-uri",
"direct": false,
"version": "3.1.2",
"severity": "high",
"ecosystem": "npm",
"cvss_score": 7.5,
"advisory_ids": [
"GHSA-4c8g-83qw-93j6",
"GHSA-v2hh-gcrm-f6hx"
],
"fixed_version": "4.1.1",
"advisory_count": 2,
"oldest_advisory_days": 4
},
{
"name": "shell-quote",
"direct": false,
"version": "1.8.4",
"severity": "high",
"ecosystem": "npm",
"cvss_score": 7.5,
"advisory_ids": [
"GHSA-395f-4hp3-45gv"
],
"fixed_version": "1.9.0",
"advisory_count": 1,
"oldest_advisory_days": 5
},
{
"name": "webpack-dev-server",
"direct": false,
"version": "5.2.5",
"severity": "moderate",
"ecosystem": "npm",
"cvss_score": 5.3,
"advisory_ids": [
"GHSA-f5vj-f2hx-8m93",
"GHSA-m28w-2pqf-7qgj"
],
"fixed_version": "5.2.6",
"advisory_count": 2,
"oldest_advisory_days": 5
},
{
"name": "body-parser",
"direct": false,
"version": "1.20.5",
"severity": "low",
"ecosystem": "npm",
"cvss_score": 3.7,
"advisory_ids": [
"GHSA-v422-hmwv-36x6"
],
"fixed_version": "2.3.0",
"advisory_count": 1,
"oldest_advisory_days": 5
}
],
"collected": true,
"malicious": [],
"truncated": false,
"by_severity": {
"low": 1,
"high": 2,
"moderate": 1
},
"advisory_count": 6,
"affected_count": 4,
"assessed_count": 237,
"malicious_count": 0,
"assessed_package": null,
"unassessed_count": 0,
"direct_affected_count": 0
},
"ecosystems": [
"maven"
],
"dependencies": [],
"all_dependencies": {
"error": null,
"source": "github-sbom",
"packages": [
{
"name": "@js-joda/core",
"direct": false,
"version": "3.2.0",
"ecosystem": "npm"
},
{
"name": "@jsonjoy.com/base64",
"direct": false,
"version": "1.1.2",
"ecosystem": "npm"
},
{
"name": "@jsonjoy.com/base64",
"direct": false,
"version": "17.67.0",
"ecosystem": "npm"
},
{
"name": "@jsonjoy.com/buffers",
"direct": false,
"version": "1.2.1",
"ecosystem": "npm"
},
{
"name": "@jsonjoy.com/buffers",
"direct": false,
"version": "17.67.0",
"ecosystem": "npm"
},
{
"name": "@jsonjoy.com/codegen",
"direct": false,
"version": "1.0.0",
"ecosystem": "npm"
},
{
"name": "@jsonjoy.com/codegen",
"direct": false,
"version": "17.67.0",
"ecosystem": "npm"
},
{
"name": "@jsonjoy.com/fs-core",
"direct": false,
"version": "4.57.7",
"ecosystem": "npm"
},
{
"name": "@jsonjoy.com/fs-fsa",
"direct": false,
"version": "4.57.7",
"ecosystem": "npm"
},
{
"name": "@jsonjoy.com/fs-node",
"direct": false,
"version": "4.57.7",
"ecosystem": "npm"
},
{
"name": "@jsonjoy.com/fs-node-builtins",
"direct": false,
"version": "4.57.7",
"ecosystem": "npm"
},
{
"name": "@jsonjoy.com/fs-node-to-fsa",
"direct": false,
"version": "4.57.7",
"ecosystem": "npm"
},
{
"name": "@jsonjoy.com/fs-node-utils",
"direct": false,
"version": "4.57.7",
"ecosystem": "npm"
},
{
"name": "@jsonjoy.com/fs-print",
"direct": false,
"version": "4.57.7",
"ecosystem": "npm"
},
{
"name": "@jsonjoy.com/fs-snapshot",
"direct": false,
"version": "4.57.7",
"ecosystem": "npm"
},
{
"name": "@jsonjoy.com/json-pack",
"direct": false,
"version": "1.21.0",
"ecosystem": "npm"
},
{
"name": "@jsonjoy.com/json-pack",
"direct": false,
"version": "17.67.0",
"ecosystem": "npm"
},
{
"name": "@jsonjoy.com/json-pointer",
"direct": false,
"version": "1.0.2",
"ecosystem": "npm"
},
{
"name": "@jsonjoy.com/json-pointer",
"direct": false,
"version": "17.67.0",
"ecosystem": "npm"
},
{
"name": "@jsonjoy.com/util",
"direct": false,
"version": "1.9.0",
"ecosystem": "npm"
},
{
"name": "@jsonjoy.com/util",
"direct": false,
"version": "17.67.0",
"ecosystem": "npm"
},
{
"name": "@leichtgewicht/ip-codec",
"direct": false,
"version": "2.0.5",
"ecosystem": "npm"
},
{
"name": "@noble/hashes",
"direct": false,
"version": "1.4.0",
"ecosystem": "npm"
},
{
"name": "@peculiar/asn1-cms",
"direct": false,
"version": "2.8.0",
"ecosystem": "npm"
},
{
"name": "@peculiar/asn1-csr",
"direct": false,
"version": "2.8.0",
"ecosystem": "npm"
},
{
"name": "@peculiar/asn1-ecc",
"direct": false,
"version": "2.8.0",
"ecosystem": "npm"
},
{
"name": "@peculiar/asn1-pfx",
"direct": false,
"version": "2.8.0",
"ecosystem": "npm"
},
{
"name": "@peculiar/asn1-pkcs8",
"direct": false,
"version": "2.8.0",
"ecosystem": "npm"
},
{
"name": "@peculiar/asn1-pkcs9",
"direct": false,
"version": "2.8.0",
"ecosystem": "npm"
},
{
"name": "@peculiar/asn1-rsa",
"direct": false,
"version": "2.8.0",
"ecosystem": "npm"
},
{
"name": "@peculiar/asn1-schema",
"direct": false,
"version": "2.8.0",
"ecosystem": "npm"
},
{
"name": "@peculiar/asn1-x509",
"direct": false,
"version": "2.8.0",
"ecosystem": "npm"
},
{
"name": "@peculiar/asn1-x509-attr",
"direct": false,
"version": "2.8.0",
"ecosystem": "npm"
},
{
"name": "@peculiar/utils",
"direct": false,
"version": "2.0.3",
"ecosystem": "npm"
},
{
"name": "@peculiar/x509",
"direct": false,
"version": "1.14.3",
"ecosystem": "npm"
},
{
"name": "@types/body-parser",
"direct": false,
"version": "1.19.6",
"ecosystem": "npm"
},
{
"name": "@types/bonjour",
"direct": false,
"version": "3.5.13",
"ecosystem": "npm"
},
{
"name": "@types/connect",
"direct": false,
"version": "3.4.38",
"ecosystem": "npm"
},
{
"name": "@types/connect-history-api-fallback",
"direct": false,
"version": "1.5.4",
"ecosystem": "npm"
},
{
"name": "@types/express",
"direct": false,
"version": "4.17.25",
"ecosystem": "npm"
},
{
"name": "@types/express",
"direct": false,
"version": "5.0.6",
"ecosystem": "npm"
},
{
"name": "@types/express-serve-static-core",
"direct": false,
"version": "4.19.8",
"ecosystem": "npm"
},
{
"name": "@types/express-serve-static-core",
"direct": false,
"version": "5.1.1",
"ecosystem": "npm"
},
{
"name": "@types/http-errors",
"direct": false,
"version": "2.0.5",
"ecosystem": "npm"
},
{
"name": "@types/http-proxy",
"direct": false,
"version": "1.17.17",
"ecosystem": "npm"
},
{
"name": "@types/json-schema",
"direct": false,
"version": "7.0.15",
"ecosystem": "npm"
},
{
"name": "@types/mime",
"direct": false,
"version": "1.3.5",
"ecosystem": "npm"
},
{
"name": "@types/node",
"direct": false,
"version": "25.9.3",
"ecosystem": "npm"
},
{
"name": "@types/qs",
"direct": false,
"version": "6.15.1",
"ecosystem": "npm"
},
{
"name": "@types/range-parser",
"direct": false,
"version": "1.2.7",
"ecosystem": "npm"
},
{
"name": "@types/retry",
"direct": false,
"version": "0.12.2",
"ecosystem": "npm"
},
{
"name": "@types/send",
"direct": false,
"version": "0.17.6",
"ecosystem": "npm"
},
{
"name": "@types/send",
"direct": false,
"version": "1.2.1",
"ecosystem": "npm"
},
{
"name": "@types/serve-index",
"direct": false,
"version": "1.9.4",
"ecosystem": "npm"
},
{
"name": "@types/serve-static",
"direct": false,
"version": "1.15.10",
"ecosystem": "npm"
},
{
"name": "@types/serve-static",
"direct": false,
"version": "2.2.0",
"ecosystem": "npm"
},
{
"name": "@types/sockjs",
"direct": false,
"version": "0.3.36",
"ecosystem": "npm"
},
{
"name": "@types/ws",
"direct": false,
"version": "8.18.1",
"ecosystem": "npm"
},
{
"name": "accepts",
"direct": false,
"version": "1.3.8",
"ecosystem": "npm"
},
{
"name": "ajv",
"direct": false,
"version": "8.20.0",
"ecosystem": "npm"
},
{
"name": "ajv-formats",
"direct": false,
"version": "2.1.1",
"ecosystem": "npm"
},
{
"name": "ajv-keywords",
"direct": false,
"version": "5.1.0",
"ecosystem": "npm"
},
{
"name": "ansi-html-community",
"direct": false,
"version": "0.0.8",
"ecosystem": "npm"
},
{
"name": "anymatch",
"direct": false,
"version": "3.1.3",
"ecosystem": "npm"
},
{
"name": "array-flatten",
"direct": false,
"version": "1.1.1",
"ecosystem": "npm"
},
{
"name": "asn1js",
"direct": false,
"version": "3.0.10",
"ecosystem": "npm"
},
{
"name": "batch",
"direct": false,
"version": "0.6.1",
"ecosystem": "npm"
},
{
"name": "binary-extensions",
"direct": false,
"version": "2.3.0",
"ecosystem": "npm"
},
{
"name": "body-parser",
"direct": false,
"version": "1.20.5",
"ecosystem": "npm"
},
{
"name": "bonjour-service",
"direct": false,
"version": "1.4.1",
"ecosystem": "npm"
},
{
"name": "braces",
"direct": false,
"version": "3.0.3",
"ecosystem": "npm"
},
{
"name": "bundle-name",
"direct": false,
"version": "4.1.0",
"ecosystem": "npm"
},
{
"name": "bytes",
"direct": false,
"version": "3.1.2",
"ecosystem": "npm"
},
{
"name": "bytestreamjs",
"direct": false,
"version": "2.0.1",
"ecosystem": "npm"
},
{
"name": "call-bind-apply-helpers",
"direct": false,
"version": "1.0.2",
"ecosystem": "npm"
},
{
"name": "call-bound",
"direct": false,
"version": "1.0.4",
"ecosystem": "npm"
},
{
"name": "chokidar",
"direct": false,
"version": "3.6.0",
"ecosystem": "npm"
},
{
"name": "colorette",
"direct": false,
"version": "2.0.20",
"ecosystem": "npm"
},
{
"name": "compressible",
"direct": false,
"version": "2.0.18",
"ecosystem": "npm"
},
{
"name": "compression",
"direct": false,
"version": "1.8.1",
"ecosystem": "npm"
},
{
"name": "connect-history-api-fallback",
"direct": false,
"version": "2.0.0",
"ecosystem": "npm"
},
{
"name": "content-disposition",
"direct": false,
"version": "0.5.4",
"ecosystem": "npm"
},
{
"name": "content-type",
"direct": false,
"version": "1.0.5",
"ecosystem": "npm"
},
{
"name": "cookie",
"direct": false,
"version": "0.7.2",
"ecosystem": "npm"
},
{
"name": "cookie-signature",
"direct": false,
"version": "1.0.7",
"ecosystem": "npm"
},
{
"name": "core-util-is",
"direct": false,
"version": "1.0.3",
"ecosystem": "npm"
},
{
"name": "debug",
"direct": false,
"version": "2.6.9",
"ecosystem": "npm"
},
{
"name": "debug",
"direct": false,
"version": "4.4.3",
"ecosystem": "npm"
},
{
"name": "default-browser",
"direct": false,
"version": "5.5.0",
"ecosystem": "npm"
},
{
"name": "default-browser-id",
"direct": false,
"version": "5.0.1",
"ecosystem": "npm"
},
{
"name": "define-lazy-prop",
"direct": false,
"version": "3.0.0",
"ecosystem": "npm"
},
{
"name": "depd",
"direct": false,
"version": "1.1.2",
"ecosystem": "npm"
},
{
"name": "depd",
"direct": false,
"version": "2.0.0",
"ecosystem": "npm"
},
{
"name": "destroy",
"direct": false,
"version": "1.2.0",
"ecosystem": "npm"
},
{
"name": "detect-node",
"direct": false,
"version": "2.1.0",
"ecosystem": "npm"
},
{
"name": "dns-packet",
"direct": false,
"version": "5.6.1",
"ecosystem": "npm"
},
{
"name": "dunder-proto",
"direct": false,
"version": "1.0.1",
"ecosystem": "npm"
},
{
"name": "ee-first",
"direct": false,
"version": "1.1.1",
"ecosystem": "npm"
},
{
"name": "encodeurl",
"direct": false,
"version": "2.0.0",
"ecosystem": "npm"
},
{
"name": "es-define-property",
"direct": false,
"version": "1.0.1",
"ecosystem": "npm"
},
{
"name": "es-errors",
"direct": false,
"version": "1.3.0",
"ecosystem": "npm"
},
{
"name": "es-object-atoms",
"direct": false,
"version": "1.1.2",
"ecosystem": "npm"
},
{
"name": "escape-html",
"direct": false,
"version": "1.0.3",
"ecosystem": "npm"
},
{
"name": "etag",
"direct": false,
"version": "1.8.1",
"ecosystem": "npm"
},
{
"name": "eventemitter3",
"direct": false,
"version": "4.0.7",
"ecosystem": "npm"
},
{
"name": "express",
"direct": false,
"version": "4.22.2",
"ecosystem": "npm"
},
{
"name": "fast-deep-equal",
"direct": false,
"version": "3.1.3",
"ecosystem": "npm"
},
{
"name": "fast-uri",
"direct": false,
"version": "3.1.2",
"ecosystem": "npm"
},
{
"name": "faye-websocket",
"direct": false,
"version": "0.11.4",
"ecosystem": "npm"
},
{
"name": "fill-range",
"direct": false,
"version": "7.1.1",
"ecosystem": "npm"
},
{
"name": "finalhandler",
"direct": false,
"version": "1.3.2",
"ecosystem": "npm"
},
{
"name": "follow-redirects",
"direct": false,
"version": "1.16.0",
"ecosystem": "npm"
},
{
"name": "forwarded",
"direct": false,
"version": "0.2.0",
"ecosystem": "npm"
},
{
"name": "fresh",
"direct": false,
"version": "0.5.2",
"ecosystem": "npm"
},
{
"name": "fsevents",
"direct": false,
"version": "2.3.3",
"ecosystem": "npm"
},
{
"name": "function-bind",
"direct": false,
"version": "1.1.2",
"ecosystem": "npm"
},
{
"name": "get-intrinsic",
"direct": false,
"version": "1.3.0",
"ecosystem": "npm"
},
{
"name": "get-proto",
"direct": false,
"version": "1.0.1",
"ecosystem": "npm"
},
{
"name": "glob-parent",
"direct": false,
"version": "5.1.2",
"ecosystem": "npm"
},
{
"name": "glob-to-regex.js",
"direct": false,
"version": "1.2.0",
"ecosystem": "npm"
},
{
"name": "gopd",
"direct": false,
"version": "1.2.0",
"ecosystem": "npm"
},
{
"name": "graceful-fs",
"direct": false,
"version": "4.2.11",
"ecosystem": "npm"
},
{
"name": "handle-thing",
"direct": false,
"version": "2.0.1",
"ecosystem": "npm"
},
{
"name": "has-symbols",
"direct": false,
"version": "1.1.0",
"ecosystem": "npm"
},
{
"name": "hasown",
"direct": false,
"version": "2.0.4",
"ecosystem": "npm"
},
{
"name": "hpack.js",
"direct": false,
"version": "2.1.6",
"ecosystem": "npm"
},
{
"name": "http-deceiver",
"direct": false,
"version": "1.2.7",
"ecosystem": "npm"
},
{
"name": "http-errors",
"direct": false,
"version": "1.8.1",
"ecosystem": "npm"
},
{
"name": "http-errors",
"direct": false,
"version": "2.0.1",
"ecosystem": "npm"
},
{
"name": "http-parser-js",
"direct": false,
"version": "0.5.10",
"ecosystem": "npm"
},
{
"name": "http-proxy",
"direct": false,
"version": "1.18.1",
"ecosystem": "npm"
},
{
"name": "http-proxy-middleware",
"direct": false,
"version": "2.0.10",
"ecosystem": "npm"
},
{
"name": "hyperdyperid",
"direct": false,
"version": "1.2.0",
"ecosystem": "npm"
},
{
"name": "iconv-lite",
"direct": false,
"version": "0.4.24",
"ecosystem": "npm"
},
{
"name": "inherits",
"direct": false,
"version": "2.0.4",
"ecosystem": "npm"
},
{
"name": "ipaddr.js",
"direct": false,
"version": "1.9.1",
"ecosystem": "npm"
},
{
"name": "ipaddr.js",
"direct": false,
"version": "2.4.0",
"ecosystem": "npm"
},
{
"name": "is-binary-path",
"direct": false,
"version": "2.1.0",
"ecosystem": "npm"
},
{
"name": "is-docker",
"direct": false,
"version": "3.0.0",
"ecosystem": "npm"
},
{
"name": "is-extglob",
"direct": false,
"version": "2.1.1",
"ecosystem": "npm"
},
{
"name": "is-glob",
"direct": false,
"version": "4.0.3",
"ecosystem": "npm"
},
{
"name": "is-inside-container",
"direct": false,
"version": "1.0.0",
"ecosystem": "npm"
},
{
"name": "is-network-error",
"direct": false,
"version": "1.3.2",
"ecosystem": "npm"
},
{
"name": "is-number",
"direct": false,
"version": "7.0.0",
"ecosystem": "npm"
},
{
"name": "is-plain-obj",
"direct": false,
"version": "3.0.0",
"ecosystem": "npm"
},
{
"name": "is-wsl",
"direct": false,
"version": "3.1.1",
"ecosystem": "npm"
},
{
"name": "isarray",
"direct": false,
"version": "1.0.0",
"ecosystem": "npm"
},
{
"name": "json-schema-traverse",
"direct": false,
"version": "1.0.0",
"ecosystem": "npm"
},
{
"name": "launch-editor",
"direct": false,
"version": "2.14.1",
"ecosystem": "npm"
},
{
"name": "math-intrinsics",
"direct": false,
"version": "1.1.0",
"ecosystem": "npm"
},
{
"name": "media-typer",
"direct": false,
"version": "0.3.0",
"ecosystem": "npm"
},
{
"name": "memfs",
"direct": false,
"version": "4.57.7",
"ecosystem": "npm"
},
{
"name": "merge-descriptors",
"direct": false,
"version": "1.0.3",
"ecosystem": "npm"
},
{
"name": "methods",
"direct": false,
"version": "1.1.2",
"ecosystem": "npm"
},
{
"name": "micromatch",
"direct": false,
"version": "4.0.8",
"ecosystem": "npm"
},
{
"name": "mime",
"direct": false,
"version": "1.6.0",
"ecosystem": "npm"
},
{
"name": "mime-db",
"direct": false,
"version": "1.52.0",
"ecosystem": "npm"
},
{
"name": "mime-db",
"direct": false,
"version": "1.54.0",
"ecosystem": "npm"
},
{
"name": "mime-types",
"direct": false,
"version": "2.1.35",
"ecosystem": "npm"
},
{
"name": "mime-types",
"direct": false,
"version": "3.0.2",
"ecosystem": "npm"
},
{
"name": "minimalistic-assert",
"direct": false,
"version": "1.0.1",
"ecosystem": "npm"
},
{
"name": "ms",
"direct": false,
"version": "2.0.0",
"ecosystem": "npm"
},
{
"name": "ms",
"direct": false,
"version": "2.1.3",
"ecosystem": "npm"
},
{
"name": "multicast-dns",
"direct": false,
"version": "7.2.5",
"ecosystem": "npm"
},
{
"name": "negotiator",
"direct": false,
"version": "0.6.3",
"ecosystem": "npm"
},
{
"name": "negotiator",
"direct": false,
"version": "0.6.4",
"ecosystem": "npm"
},
{
"name": "normalize-path",
"direct": false,
"version": "3.0.0",
"ecosystem": "npm"
},
{
"name": "object-inspect",
"direct": false,
"version": "1.13.4",
"ecosystem": "npm"
},
{
"name": "obuf",
"direct": false,
"version": "1.1.2",
"ecosystem": "npm"
},
{
"name": "on-finished",
"direct": false,
"version": "2.4.1",
"ecosystem": "npm"
},
{
"name": "on-headers",
"direct": false,
"version": "1.1.0",
"ecosystem": "npm"
},
{
"name": "open",
"direct": false,
"version": "10.2.0",
"ecosystem": "npm"
},
{
"name": "p-retry",
"direct": false,
"version": "6.2.1",
"ecosystem": "npm"
},
{
"name": "parseurl",
"direct": false,
"version": "1.3.3",
"ecosystem": "npm"
},
{
"name": "path-to-regexp",
"direct": false,
"version": "0.1.13",
"ecosystem": "npm"
},
{
"name": "picocolors",
"direct": false,
"version": "1.1.1",
"ecosystem": "npm"
},
{
"name": "picomatch",
"direct": false,
"version": "2.3.2",
"ecosystem": "npm"
},
{
"name": "pkijs",
"direct": false,
"version": "3.4.0",
"ecosystem": "npm"
},
{
"name": "process-nextick-args",
"direct": false,
"version": "2.0.1",
"ecosystem": "npm"
},
{
"name": "proxy-addr",
"direct": false,
"version": "2.0.7",
"ecosystem": "npm"
},
{
"name": "pvtsutils",
"direct": false,
"version": "1.3.6",
"ecosystem": "npm"
},
{
"name": "pvutils",
"direct": false,
"version": "1.1.5",
"ecosystem": "npm"
},
{
"name": "qs",
"direct": false,
"version": "6.15.2",
"ecosystem": "npm"
},
{
"name": "range-parser",
"direct": false,
"version": "1.2.1",
"ecosystem": "npm"
},
{
"name": "raw-body",
"direct": false,
"version": "2.5.3",
"ecosystem": "npm"
},
{
"name": "readable-stream",
"direct": false,
"version": "2.3.8",
"ecosystem": "npm"
},
{
"name": "readable-stream",
"direct": false,
"version": "3.6.2",
"ecosystem": "npm"
},
{
"name": "readdirp",
"direct": false,
"version": "3.6.0",
"ecosystem": "npm"
},
{
"name": "reflect-metadata",
"direct": false,
"version": "0.2.2",
"ecosystem": "npm"
},
{
"name": "require-from-string",
"direct": false,
"version": "2.0.2",
"ecosystem": "npm"
},
{
"name": "requires-port",
"direct": false,
"version": "1.0.0",
"ecosystem": "npm"
},
{
"name": "retry",
"direct": false,
"version": "0.13.1",
"ecosystem": "npm"
},
{
"name": "run-applescript",
"direct": false,
"version": "7.1.0",
"ecosystem": "npm"
},
{
"name": "safe-buffer",
"direct": false,
"version": "5.1.2",
"ecosystem": "npm"
},
{
"name": "safe-buffer",
"direct": false,
"version": "5.2.1",
"ecosystem": "npm"
},
{
"name": "safer-buffer",
"direct": false,
"version": "2.1.2",
"ecosystem": "npm"
},
{
"name": "schema-utils",
"direct": false,
"version": "4.3.3",
"ecosystem": "npm"
},
{
"name": "select-hose",
"direct": false,
"version": "2.0.0",
"ecosystem": "npm"
},
{
"name": "selfsigned",
"direct": false,
"version": "5.5.0",
"ecosystem": "npm"
},
{
"name": "send",
"direct": false,
"version": "0.19.2",
"ecosystem": "npm"
},
{
"name": "serve-index",
"direct": false,
"version": "1.9.2",
"ecosystem": "npm"
},
{
"name": "serve-static",
"direct": false,
"version": "1.16.3",
"ecosystem": "npm"
},
{
"name": "setprototypeof",
"direct": false,
"version": "1.2.0",
"ecosystem": "npm"
},
{
"name": "shell-quote",
"direct": false,
"version": "1.8.4",
"ecosystem": "npm"
},
{
"name": "side-channel",
"direct": false,
"version": "1.1.1",
"ecosystem": "npm"
},
{
"name": "side-channel-list",
"direct": false,
"version": "1.0.1",
"ecosystem": "npm"
},
{
"name": "side-channel-map",
"direct": false,
"version": "1.0.1",
"ecosystem": "npm"
},
{
"name": "side-channel-weakmap",
"direct": false,
"version": "1.0.2",
"ecosystem": "npm"
},
{
"name": "sockjs",
"direct": false,
"version": "0.3.24",
"ecosystem": "npm"
},
{
"name": "spdy",
"direct": false,
"version": "4.0.2",
"ecosystem": "npm"
},
{
"name": "spdy-transport",
"direct": false,
"version": "3.0.0",
"ecosystem": "npm"
},
{
"name": "statuses",
"direct": false,
"version": "1.5.0",
"ecosystem": "npm"
},
{
"name": "statuses",
"direct": false,
"version": "2.0.2",
"ecosystem": "npm"
},
{
"name": "string_decoder",
"direct": false,
"version": "1.1.1",
"ecosystem": "npm"
},
{
"name": "string_decoder",
"direct": false,
"version": "1.3.0",
"ecosystem": "npm"
},
{
"name": "thingies",
"direct": false,
"version": "2.6.0",
"ecosystem": "npm"
},
{
"name": "thunky",
"direct": false,
"version": "1.1.0",
"ecosystem": "npm"
},
{
"name": "to-regex-range",
"direct": false,
"version": "5.0.1",
"ecosystem": "npm"
},
{
"name": "toidentifier",
"direct": false,
"version": "1.0.1",
"ecosystem": "npm"
},
{
"name": "tree-dump",
"direct": false,
"version": "1.1.0",
"ecosystem": "npm"
},
{
"name": "tslib",
"direct": false,
"version": "1.14.1",
"ecosystem": "npm"
},
{
"name": "tslib",
"direct": false,
"version": "2.8.1",
"ecosystem": "npm"
},
{
"name": "tsyringe",
"direct": false,
"version": "4.10.0",
"ecosystem": "npm"
},
{
"name": "type-is",
"direct": false,
"version": "1.6.18",
"ecosystem": "npm"
},
{
"name": "undici-types",
"direct": false,
"version": "7.24.6",
"ecosystem": "npm"
},
{
"name": "unpipe",
"direct": false,
"version": "1.0.0",
"ecosystem": "npm"
},
{
"name": "util-deprecate",
"direct": false,
"version": "1.0.2",
"ecosystem": "npm"
},
{
"name": "utils-merge",
"direct": false,
"version": "1.0.1",
"ecosystem": "npm"
},
{
"name": "uuid",
"direct": false,
"version": "11.1.1",
"ecosystem": "npm"
},
{
"name": "vary",
"direct": false,
"version": "1.1.2",
"ecosystem": "npm"
},
{
"name": "wbuf",
"direct": false,
"version": "1.7.3",
"ecosystem": "npm"
},
{
"name": "webpack-dev-middleware",
"direct": false,
"version": "7.4.5",
"ecosystem": "npm"
},
{
"name": "webpack-dev-server",
"direct": false,
"version": "5.2.5",
"ecosystem": "npm"
},
{
"name": "websocket-driver",
"direct": false,
"version": "0.7.5",
"ecosystem": "npm"
},
{
"name": "websocket-extensions",
"direct": false,
"version": "0.1.4",
"ecosystem": "npm"
},
{
"name": "ws",
"direct": false,
"version": "8.21.0",
"ecosystem": "npm"
},
{
"name": "wsl-utils",
"direct": false,
"version": "0.1.0",
"ecosystem": "npm"
}
],
"collected": true,
"truncated": false,
"total_count": 237,
"direct_count": 0,
"indirect_count": 237
}
},
"maintainership": {
"issues": {
"open_prs": 0,
"merged_prs": 181,
"open_issues": 5,
"closed_ratio": 0.839,
"closed_issues": 26,
"closed_unmerged_prs": 17
},
"bus_factor": 1,
"bot_contributors": 0,
"top_contributors": [
{
"type": "User",
"login": "vRallev",
"commits": 255,
"avatar_url": "https://avatars.githubusercontent.com/u/1558045?v=4"
},
{
"type": "User",
"login": "JessalynWang",
"commits": 39,
"avatar_url": "https://avatars.githubusercontent.com/u/42593027?v=4"
},
{
"type": "User",
"login": "kellarwindland",
"commits": 6,
"avatar_url": "https://avatars.githubusercontent.com/u/42989190?v=4"
},
{
"type": "User",
"login": "liutikas",
"commits": 2,
"avatar_url": "https://avatars.githubusercontent.com/u/1418185?v=4"
},
{
"type": "User",
"login": "phansier",
"commits": 1,
"avatar_url": "https://avatars.githubusercontent.com/u/13121319?v=4"
},
{
"type": "User",
"login": "blakelee",
"commits": 1,
"avatar_url": "https://avatars.githubusercontent.com/u/9651986?v=4"
},
{
"type": "User",
"login": "dawidhyzy",
"commits": 1,
"avatar_url": "https://avatars.githubusercontent.com/u/2484936?v=4"
},
{
"type": "User",
"login": "NirajDN",
"commits": 1,
"avatar_url": "https://avatars.githubusercontent.com/u/149431848?v=4"
},
{
"type": "User",
"login": "SAY-5",
"commits": 1,
"avatar_url": "https://avatars.githubusercontent.com/u/240962040?v=4"
},
{
"type": "User",
"login": "s1mant1",
"commits": 1,
"avatar_url": "https://avatars.githubusercontent.com/u/47991322?v=4"
}
],
"contributors_sampled": 10,
"top_contributor_share": 0.828
},
"quality_signals": {
"has_ci": true,
"has_tests": true,
"ci_workflows": [
"blueprints-starter-ci.yml",
"ci.yml",
"pages.yml",
"publish-release.yml",
"publish-snapshot.yml"
],
"has_docs_dir": true,
"linter_configs": [],
"has_editorconfig": true,
"has_linter_config": false,
"has_precommit_config": false
},
"security_signals": {
"lockfiles": [
"yarn.lock"
],
"scorecard": {
"checks": [
{
"name": "Binary-Artifacts",
"score": 8,
"reason": "binaries present in source code",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#binary-artifacts"
},
{
"name": "Branch-Protection",
"score": 3,
"reason": "branch protection is not maximal on development and all release branches",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#branch-protection"
},
{
"name": "CI-Tests",
"score": 10,
"reason": "21 out of 21 merged PRs checked by a CI test -- score normalized to 10",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#ci-tests"
},
{
"name": "CII-Best-Practices",
"score": 0,
"reason": "no effort to earn an OpenSSF best practices badge detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#cii-best-practices"
},
{
"name": "Code-Review",
"score": 0,
"reason": "Found 0/28 approved changesets -- score normalized to 0",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#code-review"
},
{
"name": "Contributors",
"score": 10,
"reason": "project has 3 contributing companies or organizations -- score normalized to 10",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#contributors"
},
{
"name": "Dangerous-Workflow",
"score": 10,
"reason": "no dangerous workflow patterns detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dangerous-workflow"
},
{
"name": "Dependency-Update-Tool",
"score": 0,
"reason": "no update tool detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dependency-update-tool"
},
{
"name": "Fuzzing",
"score": 0,
"reason": "project is not fuzzed",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#fuzzing"
},
{
"name": "License",
"score": 10,
"reason": "license file detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#license"
},
{
"name": "Maintained",
"score": 10,
"reason": "30 commit(s) and 5 issue activity found in the last 90 days -- score normalized to 10",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#maintained"
},
{
"name": "Packaging",
"score": null,
"reason": "packaging workflow not detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#packaging"
},
{
"name": "Pinned-Dependencies",
"score": 0,
"reason": "dependency not pinned by hash detected -- score normalized to 0",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#pinned-dependencies"
},
{
"name": "SAST",
"score": 0,
"reason": "SAST tool is not run on all commits -- score normalized to 0",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#sast"
},
{
"name": "Security-Policy",
"score": 0,
"reason": "security policy file not detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#security-policy"
},
{
"name": "Signed-Releases",
"score": null,
"reason": "no releases found",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#signed-releases"
},
{
"name": "Token-Permissions",
"score": 10,
"reason": "GitHub workflow tokens follow principle of least privilege",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#token-permissions"
},
{
"name": "Vulnerabilities",
"score": 4,
"reason": "6 existing vulnerabilities detected",
"documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#vulnerabilities"
}
],
"commit": "a99d6d36c43217e14a6cc7eea197aa9092643416",
"ran_at": "2026-07-25T23:59:24Z",
"aggregate_score": 4.7,
"scorecard_version": "v5.5.0"
},
"has_codeql_workflow": false,
"has_security_policy": false,
"has_dependabot_config": false
},
"contribution_flow": {
"collected": true,
"ci_last_run_at": "2026-07-25T22:38:56Z",
"oldest_open_prs": [],
"last_merged_pr_at": "2026-07-25T03:54:56Z",
"ci_last_conclusion": "FAILURE",
"oldest_open_issues": [
{
"number": 60,
"created_at": "2025-05-29T22:00:15Z",
"last_comment_at": "2025-08-06T23:03:46Z",
"last_comment_author": "vRallev"
},
{
"number": 158,
"created_at": "2025-11-25T16:56:42Z",
"last_comment_at": null,
"last_comment_author": null
},
{
"number": 164,
"created_at": "2026-03-02T21:34:05Z",
"last_comment_at": "2026-06-02T20:14:47Z",
"last_comment_author": "JessalynWang"
},
{
"number": 223,
"created_at": "2026-07-17T09:52:57Z",
"last_comment_at": "2026-07-18T13:20:29Z",
"last_comment_author": "vRallev"
},
{
"number": 224,
"created_at": "2026-07-17T09:56:32Z",
"last_comment_at": null,
"last_comment_author": null
}
]
}
},
"config": {
"disabled_metrics": [],
"disabled_categories": [],
"disabled_components": {}
},
"source": {
"url": "https://github.com/vRallev/app-platform",
"host": "github.com",
"name": "app-platform",
"owner": "vRallev"
},
"metrics": {
"overall": {
"key": "overall",
"band": "moderate",
"name": "Overall health",
"note": null,
"notes": [],
"value": 68,
"inputs": {
"security": 58,
"vitality": 90,
"community": 54,
"governance": 57,
"engineering": 80
},
"components": []
},
"categories": [
{
"key": "vitality",
"band": "excellent",
"name": "Vitality",
"value": 90,
"weight": 0.22,
"metrics": [
{
"key": "development_activity",
"band": "good",
"name": "Development activity",
"note": null,
"notes": [],
"value": 84,
"inputs": {
"commits_last_year": 186,
"human_commit_share": 1,
"days_since_last_push": 0,
"active_weeks_last_year": 29
},
"components": [
{
"key": "push_recency",
"name": "Push recency",
"detail": "last push 0 days ago",
"points": 36,
"status": "met",
"details": [
{
"code": "push_recency",
"params": {
"days": 0
}
}
],
"max_points": 36
},
{
"key": "commit_cadence",
"name": "Commit cadence",
"detail": "29/52 weeks with commits",
"points": 20.1,
"status": "partial",
"details": [
{
"code": "commit_cadence_weeks",
"params": {
"weeks": 29
}
}
],
"max_points": 36
},
{
"key": "commit_volume",
"name": "Commit volume",
"detail": "186 commits in the last year",
"points": 18,
"status": "met",
"details": [
{
"code": "commits_last_year",
"params": {
"count": 186
}
}
],
"max_points": 18
},
{
"key": "openssf_scorecard_maintained",
"name": "OpenSSF Scorecard: Maintained",
"detail": "30 commit(s) and 5 issue activity found in the last 90 days -- score normalized to 10",
"points": 10,
"status": "met",
"details": [],
"max_points": 10
}
]
},
{
"key": "release_discipline",
"band": "excellent",
"name": "Release discipline",
"note": "Excluded from scoring (no data or not applicable): OpenSSF Scorecard: Signed-Releases. Remaining weights renormalized.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"openssf_scorecard_signed_releases"
]
}
},
{
"code": "weights_renormalized",
"params": {}
}
],
"value": 100,
"inputs": {
"releases_count": 18,
"latest_release_tag": "0.1.0",
"releases_from_tags": false,
"days_since_latest_release": 8,
"mean_days_between_releases": 10.5
},
"components": [
{
"key": "ships_releases",
"name": "Ships releases",
"detail": "18 releases published",
"points": 27,
"status": "met",
"details": [
{
"code": "releases_published",
"params": {
"count": 18
}
}
],
"max_points": 27
},
{
"key": "release_recency",
"name": "Release recency",
"detail": "latest release 8 days ago",
"points": 36,
"status": "met",
"details": [
{
"code": "release_recency",
"params": {
"days": 8
}
}
],
"max_points": 36
},
{
"key": "release_cadence",
"name": "Release cadence",
"detail": "a release every ~10.5 days",
"points": 27,
"status": "met",
"details": [
{
"code": "release_cadence",
"params": {
"gap": 10.5
}
}
],
"max_points": 27
},
{
"key": "openssf_scorecard_signed_releases",
"name": "OpenSSF Scorecard: Signed-Releases",
"detail": "no releases found",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_data",
"params": {}
}
],
"max_points": 10
}
]
},
{
"key": "abandonment",
"band": "excellent",
"name": "Abandonment",
"note": null,
"notes": [],
"value": 100,
"inputs": {
"cap": null,
"state": "maintained",
"guards": [],
"signals": [],
"red_flag": false,
"multiplier_pct": 100,
"declared_reason": null,
"unverified_reason": null,
"unanswered_open_prs": null,
"unanswered_open_issues": null,
"days_since_last_merged_pr": null,
"days_since_last_human_commit": 0,
"days_since_last_human_commit_is_floor": false
},
"components": [
{
"key": "project_is_still_maintained",
"name": "Project is still maintained",
"detail": "last human commit 0 days ago",
"points": 100,
"status": "met",
"details": [
{
"code": "abandonment_maintained",
"params": {
"days": 0
}
}
],
"max_points": 100
}
]
}
],
"description": "Is the project alive — is code being written and are releases shipping?"
},
{
"key": "community",
"band": "moderate",
"name": "Community & Adoption",
"value": 54,
"weight": 0.18,
"metrics": [
{
"key": "popularity",
"band": "moderate",
"name": "Popularity & adoption",
"note": null,
"notes": [],
"value": 58,
"inputs": {
"forks": 29,
"stars": 316,
"watchers": 9,
"growth_state": "unverified",
"growth_factor_pct": 100,
"growth_unverified_reason": "no_history"
},
"components": [
{
"key": "stars",
"name": "Stars",
"detail": "316 stars",
"points": 40.5,
"status": "partial",
"details": [
{
"code": "stars",
"params": {
"count": 316
}
}
],
"max_points": 60
},
{
"key": "forks",
"name": "Forks",
"detail": "29 forks",
"points": 12.1,
"status": "partial",
"details": [
{
"code": "forks",
"params": {
"count": 29
}
}
],
"max_points": 25
},
{
"key": "watchers",
"name": "Watchers",
"detail": "9 watchers",
"points": 5,
"status": "partial",
"details": [
{
"code": "watchers",
"params": {
"count": 9
}
}
],
"max_points": 15
}
]
},
{
"key": "community_health",
"band": "moderate",
"name": "Community health",
"note": null,
"notes": [],
"value": 50,
"inputs": {
"has_readme": true,
"has_license": true,
"has_contributing": false,
"has_issue_template": false,
"has_code_of_conduct": false,
"has_pull_request_template": false
},
"components": [
{
"key": "readme",
"name": "README",
"detail": null,
"points": 22.5,
"status": "met",
"details": [],
"max_points": 22.5
},
{
"key": "license",
"name": "License",
"detail": "recognized license (Apache-2.0)",
"points": 22.5,
"status": "met",
"details": [
{
"code": "license_standard",
"params": {}
},
{
"code": "license_spdx",
"params": {
"spdx": "Apache-2.0"
}
}
],
"max_points": 22.5
},
{
"key": "contributing_guide",
"name": "CONTRIBUTING guide",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 18
},
{
"key": "code_of_conduct",
"name": "Code of conduct",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 13.5
},
{
"key": "issue_template",
"name": "Issue template",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.2
},
{
"key": "pr_template",
"name": "PR template",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 6.3
}
]
}
],
"description": "Does the project have users, downloads, attention, and a welcoming setup for contributors?"
},
{
"key": "governance",
"band": "moderate",
"name": "Sustainability & Governance",
"value": 57,
"weight": 0.24,
"metrics": [
{
"key": "maintainer_resilience",
"band": "at_risk",
"name": "Maintainer resilience (bus factor)",
"note": null,
"notes": [],
"value": 36,
"inputs": {
"bus_factor": 1,
"contributors_sampled": 10,
"top_contributor_share": 0.828
},
"components": [
{
"key": "bus_factor",
"name": "Bus factor",
"detail": "1 contributor(s) cover half of all commits",
"points": 9,
"status": "partial",
"details": [
{
"code": "bus_factor",
"params": {
"count": 1
}
}
],
"max_points": 54
},
{
"key": "commit_distribution",
"name": "Commit distribution",
"detail": "top contributor authored 83% of commits",
"points": 3.9,
"status": "partial",
"details": [
{
"code": "top_contributor_share",
"params": {
"share": 83
}
}
],
"max_points": 22.5
},
{
"key": "contributor_breadth",
"name": "Contributor breadth",
"detail": "10 contributors",
"points": 13.5,
"status": "met",
"details": [
{
"code": "contributors_sampled",
"params": {
"count": 10
}
}
],
"max_points": 13.5
},
{
"key": "openssf_scorecard_contributors",
"name": "OpenSSF Scorecard: Contributors",
"detail": "project has 3 contributing companies or organizations -- score normalized to 10",
"points": 10,
"status": "met",
"details": [],
"max_points": 10
}
]
},
{
"key": "responsiveness",
"band": "good",
"name": "Issue & PR responsiveness",
"note": null,
"notes": [],
"value": 74,
"inputs": {
"merged_prs": 181,
"open_issues": 5,
"closed_issues": 26,
"issue_closed_ratio": 0.839,
"closed_unmerged_prs": 17
},
"components": [
{
"key": "issue_resolution",
"name": "Issue resolution",
"detail": "84% of issues closed",
"points": 39.2,
"status": "partial",
"details": [
{
"code": "issues_closed_share",
"params": {
"share": 84
}
}
],
"max_points": 46.75
},
{
"key": "pr_acceptance",
"name": "PR acceptance",
"detail": "181/198 decided PRs merged",
"points": 35,
"status": "partial",
"details": [
{
"code": "decided_prs_merged",
"params": {
"merged": 181,
"decided": 198
}
}
],
"max_points": 38.25
},
{
"key": "openssf_scorecard_code_review",
"name": "OpenSSF Scorecard: Code-Review",
"detail": "Found 0/28 approved changesets -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 15
}
]
},
{
"key": "stewardship",
"band": "moderate",
"name": "Ownership & stewardship",
"note": "Excluded from scoring (no data or not applicable): Verified domain. Remaining weights renormalized.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"verified_domain"
]
}
},
{
"code": "weights_renormalized",
"params": {}
}
],
"value": 64,
"inputs": {
"followers": 268,
"owner_type": "User",
"is_verified": null,
"owner_login": "vRallev",
"public_repos": 41,
"account_age_days": 5240
},
"components": [
{
"key": "ownership_backing",
"name": "Ownership backing",
"detail": "personal (user) account",
"points": 10,
"status": "partial",
"details": [
{
"code": "owner_personal",
"params": {}
}
],
"max_points": 30
},
{
"key": "verified_domain",
"name": "Verified domain",
"detail": "not applicable to user accounts",
"points": 0,
"status": "excluded",
"details": [
{
"code": "not_applicable_to_user_accounts",
"params": {}
}
],
"max_points": 20
},
{
"key": "owner_reach",
"name": "Owner reach",
"detail": "268 followers of vRallev",
"points": 17.5,
"status": "partial",
"details": [
{
"code": "owner_followers",
"params": {
"count": 268,
"login": "vRallev"
}
}
],
"max_points": 25
},
{
"key": "track_record",
"name": "Track record",
"detail": "41 public repos, account ~14 yr old",
"points": 23.8,
"status": "partial",
"details": [
{
"code": "public_repos",
"params": {
"count": 41
}
},
{
"code": "account_age_years",
"params": {
"years": 14
}
}
],
"max_points": 25
}
]
}
],
"description": "Will the project survive its people — bus factor, responsiveness, who backs it, and package upkeep?"
},
{
"key": "engineering",
"band": "good",
"name": "Engineering Quality",
"value": 80,
"weight": 0.2,
"metrics": [
{
"key": "engineering_practices",
"band": "good",
"name": "Engineering practices",
"note": null,
"notes": [],
"value": 74,
"inputs": {
"has_ci": true,
"has_tests": true,
"has_editorconfig": true,
"has_linter_config": false,
"has_precommit_config": false
},
"components": [
{
"key": "ci_workflows",
"name": "CI workflows",
"detail": "5 workflow(s)",
"points": 24,
"status": "met",
"details": [
{
"code": "ci_workflows",
"params": {
"count": 5
}
}
],
"max_points": 24
},
{
"key": "tests_present",
"name": "Tests present",
"detail": null,
"points": 24,
"status": "met",
"details": [],
"max_points": 24
},
{
"key": "linter_config",
"name": "Linter config",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 16
},
{
"key": "pre_commit_hooks",
"name": "Pre-commit hooks",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 9.6
},
{
"key": "editorconfig",
"name": ".editorconfig",
"detail": null,
"points": 6.4,
"status": "met",
"details": [],
"max_points": 6.4
},
{
"key": "openssf_scorecard_ci_tests",
"name": "OpenSSF Scorecard: CI-Tests",
"detail": "21 out of 21 merged PRs checked by a CI test -- score normalized to 10",
"points": 20,
"status": "met",
"details": [],
"max_points": 20
}
]
},
{
"key": "documentation",
"band": "excellent",
"name": "Documentation",
"note": null,
"notes": [],
"value": 90,
"inputs": {
"topics": [
"compose-multiplatform",
"compose-ui",
"kotlin",
"kotlin-multiplatform",
"unidirectional-data-flow"
],
"has_wiki": false,
"homepage": "https://vrallev.github.io/app-platform/",
"has_readme": true,
"has_docs_dir": true,
"has_description": true
},
"components": [
{
"key": "readme",
"name": "README",
"detail": null,
"points": 30,
"status": "met",
"details": [],
"max_points": 30
},
{
"key": "documentation_directory",
"name": "Documentation directory",
"detail": null,
"points": 25,
"status": "met",
"details": [],
"max_points": 25
},
{
"key": "documentation_homepage_site",
"name": "Documentation / homepage site",
"detail": "https://vrallev.github.io/app-platform/",
"points": 15,
"status": "met",
"details": [],
"max_points": 15
},
{
"key": "repository_description",
"name": "Repository description",
"detail": null,
"points": 10,
"status": "met",
"details": [],
"max_points": 10
},
{
"key": "topics",
"name": "Topics",
"detail": "5 topics",
"points": 10,
"status": "met",
"details": [
{
"code": "topics_count",
"params": {
"count": 5
}
}
],
"max_points": 10
},
{
"key": "wiki",
"name": "Wiki",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 10
}
]
}
],
"description": "Are baseline engineering and documentation practices in place?"
},
{
"key": "security",
"band": "moderate",
"name": "Security",
"value": 58,
"weight": 0.16,
"metrics": [
{
"key": "security_posture",
"band": "at_risk",
"name": "Security posture",
"note": "Excluded from scoring (no data or not applicable): Packaging, Signed-Releases. Remaining weights renormalized.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"packaging",
"signed_releases"
]
}
},
{
"code": "weights_renormalized",
"params": {}
}
],
"value": 47,
"inputs": {
"source": "openssf_scorecard",
"checks_evaluated": 16,
"scorecard_version": "v5.5.0",
"checks_inconclusive": 2,
"scorecard_aggregate": 4.7
},
"components": [
{
"key": "binary_artifacts",
"name": "Binary-Artifacts",
"detail": "binaries present in source code",
"points": 6,
"status": "partial",
"details": [],
"max_points": 7.5
},
{
"key": "branch_protection",
"name": "Branch-Protection",
"detail": "branch protection is not maximal on development and all release branches",
"points": 2.2,
"status": "partial",
"details": [],
"max_points": 7.5
},
{
"key": "ci_tests",
"name": "CI-Tests",
"detail": "21 out of 21 merged PRs checked by a CI test -- score normalized to 10",
"points": 2.5,
"status": "met",
"details": [],
"max_points": 2.5
},
{
"key": "cii_best_practices",
"name": "CII-Best-Practices",
"detail": "no effort to earn an OpenSSF best practices badge detected",
"points": 0,
"status": "missed",
"details": [],
"max_points": 2.5
},
{
"key": "code_review",
"name": "Code-Review",
"detail": "Found 0/28 approved changesets -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.5
},
{
"key": "contributors",
"name": "Contributors",
"detail": "project has 3 contributing companies or organizations -- score normalized to 10",
"points": 2.5,
"status": "met",
"details": [],
"max_points": 2.5
},
{
"key": "dangerous_workflow",
"name": "Dangerous-Workflow",
"detail": "no dangerous workflow patterns detected",
"points": 10,
"status": "met",
"details": [],
"max_points": 10
},
{
"key": "dependency_update_tool",
"name": "Dependency-Update-Tool",
"detail": "no update tool detected",
"points": 0,
"status": "missed",
"details": [],
"max_points": 7.5
},
{
"key": "fuzzing",
"name": "Fuzzing",
"detail": "project is not fuzzed",
"points": 0,
"status": "missed",
"details": [],
"max_points": 5
},
{
"key": "license",
"name": "License",
"detail": "license file detected",
"points": 2.5,
"status": "met",
"details": [],
"max_points": 2.5
},
{
"key": "maintained",
"name": "Maintained",
"detail": "30 commit(s) and 5 issue activity found in the last 90 days -- score normalized to 10",
"points": 7.5,
"status": "met",
"details": [],
"max_points": 7.5
},
{
"key": "packaging",
"name": "Packaging",
"detail": "packaging workflow not detected",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_data",
"params": {}
}
],
"max_points": 5
},
{
"key": "pinned_dependencies",
"name": "Pinned-Dependencies",
"detail": "dependency not pinned by hash detected -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 5
},
{
"key": "sast",
"name": "SAST",
"detail": "SAST tool is not run on all commits -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 5
},
{
"key": "security_policy",
"name": "Security-Policy",
"detail": "security policy file not detected",
"points": 0,
"status": "missed",
"details": [],
"max_points": 5
},
{
"key": "signed_releases",
"name": "Signed-Releases",
"detail": "no releases found",
"points": 0,
"status": "excluded",
"details": [
{
"code": "no_data",
"params": {}
}
],
"max_points": 7.5
},
{
"key": "token_permissions",
"name": "Token-Permissions",
"detail": "GitHub workflow tokens follow principle of least privilege",
"points": 7.5,
"status": "met",
"details": [],
"max_points": 7.5
},
{
"key": "vulnerabilities",
"name": "Vulnerabilities",
"detail": "6 existing vulnerabilities detected",
"points": 3,
"status": "partial",
"details": [],
"max_points": 7.5
}
]
},
{
"key": "dependency_advisories",
"band": "excellent",
"name": "Dependency advisories",
"note": "Excluded from scoring (no data or not applicable): Indirect dependencies free of known advisories, No advisories left outstanding. Remaining weights renormalized. Matched 237 resolved dependencies against OSV. This repository publishes no package the index resolves, so the repository dependency graph was assessed instead. That graph mixes development and test pins with shipped dependencies, so only the declared runtime dependencies are scored; transitive findings are reported as context and excluded from the score. Reachability is not analyzed.",
"notes": [
{
"code": "excluded_no_data",
"params": {
"components": [
"indirect_dependencies_free_of_known_advisories",
"no_advisories_left_outstanding"
]
}
},
{
"code": "weights_renormalized",
"params": {}
},
{
"code": "advisories_scope_repository",
"params": {
"assessed": 237
}
},
{
"code": "advisories_repo_graph_caveat",
"params": {}
},
{
"code": "advisories_reachability",
"params": {}
}
],
"value": 100,
"inputs": {
"source": "osv",
"advisories": 6,
"affected_packages": 4,
"assessed_packages": 237,
"unassessed_packages": 0,
"affected_by_severity": "high 2, moderate 1, low 1",
"direct_affected_packages": 0
},
"components": [
{
"key": "direct_dependencies_free_of_known_advisories",
"name": "Direct dependencies free of known advisories",
"detail": "no direct dependency carries a known advisory",
"points": 35,
"status": "met",
"details": [
{
"code": "no_direct_advisories",
"params": {}
}
],
"max_points": 35
},
{
"key": "indirect_dependencies_free_of_known_advisories",
"name": "Indirect dependencies free of known advisories",
"detail": "transitive set not separable from development and test dependencies in this scope",
"points": 0,
"status": "excluded",
"details": [
{
"code": "advisories_scope_not_separable",
"params": {}
}
],
"max_points": 25
},
{
"key": "no_advisories_left_outstanding",
"name": "No advisories left outstanding",
"detail": "no advisory carries a publication date",
"points": 0,
"status": "excluded",
"details": [
{
"code": "advisories_no_publication_date",
"params": {}
}
],
"max_points": 40
}
]
},
{
"key": "malicious_dependencies",
"band": "excellent",
"name": "Malicious dependencies",
"note": null,
"notes": [],
"value": 100,
"inputs": {
"source": "osv",
"meaning": "reported as a malicious package by the OpenSSF corpus; the remedy is removal or moving off the compromised name, never an upgrade of the same artifact. Versions the registry has since pulled are listed but not scored",
"packages": [],
"red_flag": false,
"assessed_packages": 237,
"malicious_packages": 0,
"direct_malicious_packages": 0,
"withdrawn_malicious_packages": 0,
"installable_malicious_packages": 0
},
"components": [
{
"key": "no_dependency_reported_as_a_malicious_package",
"name": "No dependency reported as a malicious package",
"detail": "no dependency is reported as a malicious package",
"points": 100,
"status": "met",
"details": [
{
"code": "no_malicious_dependencies",
"params": {}
}
],
"max_points": 100
}
]
},
{
"key": "high_risk_jurisdiction_exposure",
"band": "excellent",
"name": "High-Risk Jurisdiction Exposure",
"note": "Only high-confidence self-published location evidence affects this multiplier. Ambiguous matches are review-only; country evidence is not proof of nationality, citizenship, legal registration, malicious intent, or sanctions status.",
"notes": [
{
"code": "jurisdiction_evidence_limits",
"params": {}
}
],
"value": 100,
"inputs": {
"meaning": "self-published location evidence; not nationality or citizenship",
"red_flag": false,
"exposures": [],
"policy_countries": [
"Russia",
"Iran",
"North Korea"
],
"review_only_matches": 0,
"assessed_self_published_locations": 5
},
"components": [
{
"key": "policy_exposure_multiplier",
"name": "Policy exposure multiplier",
"detail": "no confirmed policy-scope location match",
"points": 100,
"status": "met",
"details": [
{
"code": "jurisdiction_no_match",
"params": {}
}
],
"max_points": 100
}
]
}
],
"description": "Are visible security and supply-chain practices strong, with no malicious dependency and no unresolved high-risk jurisdiction exposure?"
},
{
"key": "ai_readiness",
"band": "moderate",
"name": "AI Readiness",
"value": 67,
"weight": 0,
"metrics": [
{
"key": "ai_agent_context",
"band": "good",
"name": "Agent context & guidance",
"note": null,
"notes": [],
"value": 80,
"inputs": {
"has_llms_txt": false,
"legible_history_share": 0.66,
"agent_instruction_files": [
"AGENTS.md"
],
"agent_instruction_max_bytes": 11612
},
"components": [
{
"key": "agent_instructions",
"name": "Agent instructions",
"detail": "AGENTS.md",
"points": 45,
"status": "met",
"details": [
{
"code": "file_list",
"params": {
"files": "AGENTS.md"
}
}
],
"max_points": 45
},
{
"key": "machine_readable_docs_llms_txt",
"name": "Machine-readable docs (llms.txt)",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 15
},
{
"key": "legible_commit_history",
"name": "Legible commit history",
"detail": "66 of 100 human commits state their intent (structured subject or explanatory body)",
"points": 35.2,
"status": "partial",
"details": [
{
"code": "legible_history",
"params": {
"legible": 66,
"sampled": 100
}
}
],
"max_points": 40
}
]
},
{
"key": "ai_verify_loop",
"band": "moderate",
"name": "Verify loop (build / test / typecheck)",
"note": null,
"notes": [],
"value": 56,
"inputs": {
"has_nix": false,
"has_tests": true,
"lockfiles": [
"yarn.lock"
],
"has_dockerfile": false,
"typed_language": true,
"bootstrap_files": [],
"has_devcontainer": false,
"has_linter_config": false,
"typecheck_configs": [],
"agent_commit_share": 0,
"toolchain_manifests": [
"blueprints/starter/app/build.gradle.kts",
"blueprints/starter/build.gradle.kts",
"blueprints/starter/navigation/impl/build.gradle.kts",
"blueprints/starter/navigation/public/build.gradle.kts",
"blueprints/starter/navigation/testing/build.gradle.kts",
"blueprints/starter/templates/impl/build.gradle.kts",
"blueprints/starter/templates/public/build.gradle.kts",
"build.gradle",
"buildSrc/build.gradle",
"common/public/build.gradle",
"di-common/public/build.gradle",
"gradle-plugin/build.gradle",
"internal/testing/build.gradle",
"kotlin-inject-extensions/contribute/impl-code-generators/build.gradle",
"kotlin-inject-extensions/contribute/public/build.gradle",
"kotlin-inject/impl/build.gradle",
"kotlin-inject/public/build.gradle",
"ksp-common/public/build.gradle",
"ksp-common/testing/build.gradle",
"metro-extensions/contribute/impl-code-generators/build.gradle",
"metro-extensions/contribute/impl-compiler-plugin/build.gradle",
"metro/impl/build.gradle",
"metro/public/build.gradle",
"presenter-backstack-nav3/public/build.gradle",
"presenter-backstack-nav3/testing/build.gradle",
"presenter-molecule/impl/build.gradle",
"presenter-molecule/public/build.gradle",
"presenter-molecule/testing/build.gradle",
"presenter/public/build.gradle",
"recipes/app/build.gradle",
"recipes/common/impl/build.gradle",
"renderer-android-view/public/build.gradle",
"renderer-compose-multiplatform/public/build.gradle",
"renderer/public/build.gradle",
"robot-compose-multiplatform/public/build.gradle",
"robot-internal/public/build.gradle",
"robot/public/build.gradle",
"sample/app/build.gradle",
"sample/login/impl-robots/build.gradle",
"sample/login/impl/build.gradle",
"sample/login/public/build.gradle",
"sample/navigation/impl/build.gradle",
"sample/navigation/public/build.gradle",
"sample/templates/impl/build.gradle",
"sample/templates/public/build.gradle",
"sample/user/impl-robots/build.gradle",
"sample/user/impl/build.gradle",
"sample/user/public/build.gradle",
"sample/user/testing/build.gradle",
"scope/public/build.gradle",
"scope/testing/build.gradle"
],
"dependency_bot_commit_share": 0
},
"components": [
{
"key": "one_command_bootstrap",
"name": "One-command bootstrap",
"detail": "blueprints/starter/app/build.gradle.kts, blueprints/starter/build.gradle.kts, blueprints/starter/navigation/impl/build.gradle.kts (toolchain convention, no task runner)",
"points": 12.6,
"status": "partial",
"details": [
{
"code": "toolchain_convention",
"params": {
"files": "blueprints/starter/app/build.gradle.kts, blueprints/starter/build.gradle.kts, blueprints/starter/navigation/impl/build.gradle.kts"
}
}
],
"max_points": 18
},
{
"key": "automated_tests",
"name": "Automated tests",
"detail": null,
"points": 22,
"status": "met",
"details": [],
"max_points": 22
},
{
"key": "lint_format_config",
"name": "Lint / format config",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 11
},
{
"key": "static_type_checking",
"name": "Static type checking",
"detail": "Kotlin (statically typed)",
"points": 11,
"status": "met",
"details": [
{
"code": "statically_typed_language",
"params": {
"language": "Kotlin"
}
}
],
"max_points": 11
},
{
"key": "reproducible_environment",
"name": "Reproducible environment",
"detail": "lockfile",
"points": 10,
"status": "met",
"details": [
{
"code": "file_list",
"params": {
"files": "lockfile"
}
}
],
"max_points": 10
},
{
"key": "demonstrated_agent_practice",
"name": "Demonstrated agent practice",
"detail": "no agent-authored commits among the last 100",
"points": 0,
"status": "missed",
"details": [
{
"code": "no_agent_authored_commits",
"params": {
"sampled": 100
}
}
],
"max_points": 10
},
{
"key": "automated_maintenance",
"name": "Automated maintenance",
"detail": "no automated dependency updates observed",
"points": 0,
"status": "missed",
"details": [
{
"code": "no_dependency_automation",
"params": {}
}
],
"max_points": 8
},
{
"key": "openssf_scorecard_pinned_dependencies",
"name": "OpenSSF Scorecard: Pinned-Dependencies",
"detail": "dependency not pinned by hash detected -- score normalized to 0",
"points": 0,
"status": "missed",
"details": [],
"max_points": 10
}
]
},
{
"key": "ai_code_legibility",
"band": "excellent",
"name": "Code legibility for models",
"note": null,
"notes": [],
"value": 100,
"inputs": {
"primary_language": "Kotlin",
"largest_source_bytes": 27986,
"source_files_sampled": 457,
"oversized_source_files": 0
},
"components": [
{
"key": "type_checkable_code",
"name": "Type-checkable code",
"detail": "Kotlin (statically typed)",
"points": 45,
"status": "met",
"details": [
{
"code": "statically_typed_language",
"params": {
"language": "Kotlin"
}
}
],
"max_points": 45
},
{
"key": "manageable_file_sizes",
"name": "Manageable file sizes",
"detail": "0/457 source files over 60KB",
"points": 55,
"status": "met",
"details": [
{
"code": "oversized_source_files",
"params": {
"kb": 60,
"sampled": 457,
"oversized": 0
}
}
],
"max_points": 55
}
]
},
{
"key": "ai_interfaces",
"band": "at_risk",
"name": "Machine-readable interfaces",
"note": null,
"notes": [],
"value": 40,
"inputs": {
"example_dirs": [
"recipes",
"sample"
],
"has_mcp_signal": false,
"api_schema_files": []
},
"components": [
{
"key": "api_schema_openapi_graphql_proto",
"name": "API schema (OpenAPI/GraphQL/proto)",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 40
},
{
"key": "mcp_server",
"name": "MCP server",
"detail": null,
"points": 0,
"status": "missed",
"details": [],
"max_points": 20
},
{
"key": "runnable_examples",
"name": "Runnable examples",
"detail": "recipes, sample",
"points": 40,
"status": "met",
"details": [
{
"code": "file_list",
"params": {
"files": "recipes, sample"
}
}
],
"max_points": 40
}
]
}
],
"description": "How well is the repo equipped to be developed and maintained with AI coding agents? An independent, experimental badge — weight 0.0, so it is surfaced on its own and does not affect the overall health score."
}
],
"metrics_version": "1.13.0"
},
"warnings": [
"Star history unavailable: GitHub GraphQL error: Resource not accessible by personal access token"
],
"report_type": "repository",
"generated_at": "2026-07-25T23:59:40.912298Z",
"schema_version": "0.27.0",
"badge_url": "https://raw.githubusercontent.com/inspect-software/badges/main/v1/v/vRallev/app-platform.svg",
"full_name": "vRallev/app-platform",
"license_state": "standard",
"license_spdx": "Apache-2.0"
}
Related records
Inspected repositories sharing catalogue tags or ecosystems with vRallev/app-platform. Read them side by side →
Scores are signals, not warranties. They reflect publicly visible practices on GitHub — not a code audit, and not a security guarantee.
Missing data is excluded and weights renormalized, never scored as zero. Methodology is versioned and open: metrics v1.13.0, schema v0.27.0 — full methodology · metrics wiki.
