OWASP/cve-lite-cli
Fast, developer-friendly JS/TS dependency vulnerability scanner with local lockfile scanning, OSV matching, direct vs transitive visibility, --fix, JSON output, and practical remediation guidance.
In plain words
Outside PRs: 8 in 10 merged. First reply usually within 18 h. Replies slowed down this month.
Outside PRs merged
82%
59 merged, 13 closed, 0 still open
Higher than 47% of 565 other measured repositories
First human reply
18 h
median of 72 outside PRs, 2 unanswered
Time to merge
3.6 days
59 of 72 outside PRs merged
Outside PRs opened 30 to 120 days ago, so each has had time to be answered. A figure needs at least 5 pull requests, otherwise it reads "Not enough data". How this is calculated · A number looks wrong?
Your first steps here
If you have never contributed to this project, do these in order.
- 1
Read the contributing guide
It says how to set the project up and what the maintainers expect in a pull request.
Open the guide - 2
Find something small
No first issue is free right now. Look for a typo, a missing test or an unclear error message, or ask where help is wanted.
Browse open issues - 3
Know where to ask
Questions go to the project's slack, or on the issue itself. Not in private messages.
Open it - 4
Open a small pull request
Link the issue in it. A first reply here usually takes 18 h; until then, silence is normal.
What happens to an outside pull request
Every pull request opened by someone outside the core team, 30 to 120 days ago.
- Opened by outsiders72100%
- Got a human reply7097%
- Merged5982%
Time to first reply
After 2 days, 83% of outside PRs had a reply from a person. After a week, 93%. Bots do not count.
The last 52 weeks
Slowed down. Median first reply was 42 h over the last four weeks (44 PRs) and 16 h over the four before (24 PRs).
Starter issues
Issues labelled for beginners, with their real state. Available means open, unassigned, no linked pull request, nobody has claimed it in the last 14 days, and it was updated in the last 60 days.
- Available
- 0
- Claimed
- 1
- Has a pull request
- 10
- Stale
- 0
- Has a pull requestfeat(json): record cliVersion, scannedAt and the effective options in the --json payload#1296
- Has a pull requestchore: replace the em dashes in shipped source and output strings#1283
- Has a pull requesttest: pin the --fix suppression of the --fail-on gate line#1275
When replies arrive
All maintainers counted together. Shown only when at least 3 people replied in the last 90 days, so it never describes one person.
Replies are most likely between 16:00 and 19:00 (India time).
Show as table
| Hour (India time) | Replies, all weekdays |
|---|---|
| 00:00 | 4 |
| 01:00 | 6 |
| 02:00 | 8 |
| 03:00 | 6 |
| 04:00 | 6 |
| 05:00 | 7 |
| 06:00 | 3 |
| 07:00 | 1 |
| 08:00 | 0 |
| 09:00 | 8 |
| 10:00 | 8 |
| 11:00 | 0 |
| 12:00 | 0 |
| 13:00 | 1 |
| 14:00 | 1 |
| 15:00 | 1 |
| 16:00 | 32 |
| 17:00 | 94 |
| 18:00 | 75 |
| 19:00 | 25 |
| 20:00 | 24 |
| 21:00 | 26 |
| 22:00 | 24 |
| 23:00 | 11 |
How to start
- Contributing guidefound
- Code of conductfound
- Issue templatesfound
- Dev container for one-step setupnot found
- No CLA or sign-off requirement was found.
Where the project talks
Activity
- Commits, 90 days
- 217
- Releases, 12 months
- 30
- Active maintainers
- 4
- Last push
- 10 Oct 2026
Stack
Badge and feed
Two ways to use these figures outside this page.
For maintainers: a README badge
Shows newcomers how quickly this project answers and how often it merges. Paste the line into your README; the badge updates with the index.
[](https://contributable.vercel.app/repo/OWASP/cve-lite-cli)[](https://contributable.vercel.app/repo/OWASP/cve-lite-cli)For contributors: follow new issues
Add the feed to a feed reader (Feedly, Inoreader, Thunderbird) and you hear about new free starter issues here without checking the site.
https://contributable.vercel.app/feed/repo/OWASP/cve-lite-cliFor developers: every figure on this page as JSON at /api/v1/repos/OWASP/cve-lite-cli.
Similar repositories
Same main language (TypeScript), most shared frameworks and topics first, then the faster reply.
Joplin - the privacy-focused note taking app with sync capabilities for Windows, macOS, Linux, Android and iOS.
- First reply
