Gathering detailed insights and metrics for @ampproject/toolbox-optimizer
Gathering detailed insights and metrics for @ampproject/toolbox-optimizer
A collection of AMP tools making it easier to publish and host AMP pages.
Installations
npm install @ampproject/toolbox-optimizerDeveloper Guide
BETA
Typescript
No
Module System
CommonJS
Node Version
20.12.2
NPM Version
10.8.1
Score
84.9
Supply Chain
97.4
Quality
83.3
Maintenance
50
Vulnerability
100
License
Releases
10
Languages
7
HTML
JavaScript
TypeScript
CSS
Handlebars
Dockerfile
Shell
HTML (78.83%)
JavaScript (15.43%)
TypeScript (3.36%)
CSS (2.36%)
Handlebars (0.01%)
Dockerfile (0.01%)
Developer
ampproject
Download Statistics
Total Downloads
77,498,201
Last Day
3,985
Last Week
50,608
Last Month
214,901
Last Year
2,225,482
GitHub Statistics
Apache-2.0 License
453 Stars
1,312 Commits
248 Forks
41 Watchers
61 Branches
111 Contributors
Updated on Jun 30, 2025
Bundle Size
2.98 MB
Minified
577.71 kB
Minified + Gzipped
Maintainers
16
Package Meta Information
Latest Version
2.10.1
Package Id
@ampproject/toolbox-optimizer@2.10.1
Unpacked Size
244.92 kB
Size
57.71 kB
File Count
50
NPM Version
10.8.1
Node Version
20.12.2
Published on
Jun 14, 2024
Total Downloads
Cumulative downloads
Total Downloads
77,498,201
Dependencies
17
AMP Optimizer
AMP Optimizer is a tool to simplify creating AMP pages and improve AMP rendering performance. AMP Optimizer implements AMP performance best practices and supports AMP server-side-rendering. By default, it will perform the following optimizations:
- Server-side render AMP layouts.
- Automatically import all missing AMP component scripts.
- Automatically add any missing mandatory AMP tags.
- Auto detects and preloads hero images from amp-img, amp-iframe, amp-video, or amp-video-iframe.
- Remove the AMP boilerplate (when possible).
- Remove not needed whitespace.
- Extract and move CSS keyframe animations to the bottom of the page.
- Optimize AMP framework and custom font loading
- Generate CSP for inlined
amp-scriptcode.
The performance optimizations can improve page rendering times by up to 50%. You can read more about the potential performance gains in this blog post. To give it a try, check out the online playground.
Good to know:
- AMP Optimizer will produce valid AMP.
- AMP Optimizer can be used in combination with AMP Packager to create SXGs.
Usage
API
Install via:
npm install @ampproject/toolbox-optimizer
Minimal usage:
1const AmpOptimizer = require('@ampproject/toolbox-optimizer'); 2 3const ampOptimizer = AmpOptimizer.create(); 4 5const originalHtml = ` 6<!doctype html> 7<html ⚡> 8 ... 9</html>`; 10 11ampOptimizer.transformHtml(originalHtml).then((optimizedHtml) => { 12 console.log(optimizedHtml); 13});
You can find a sample implementation here. If you're using express to serve your site, you can use the AMP Optimizer Middleware.
CLI
AMP Optimizer can be used via the AMP Toolbox CLI:
1npm install @ampproject/toolbox-cli -g 2amp optimize myFile.html
or run without installation via npx:
1npx @ampproject/toolbox-cli optimize myFile.html
Options
Options are passed when creating a new AMP Optimizer instance:
1const ampOptimizer = AmpOptimizer.create({ 2 verbose: true 3}); 4...
Available options are:
- autoAddMandatoryTags
- autoExtensionImport
- esmModulesEnabled
- extensionVersions
- fetch
- format
- imageBasePath
- imageOptimizer
- lts
- markdown
- minify
- optimizeAmpBind
- optimizeHeroImages
- preloadHeroImage
- verbose
autoAddMandatoryTags
Automatically inject any missing markup required by AMP.
- name:
autoAddMandatoryTags - valid options:
[true|false] - default:
true - used by: AddMandatoryTags
autoExtensionImport
Automatically import any missing AMP Extensions (e.g. amp-carousel).
- name:
autoExtensionImport - valid options:
[true|false] - default:
true - used by: AutoExtensionImport
esmModulesEnabled
Enables the smaller ESM module version of AMP runtime and components:
<script async nomodule src="https://cdn.ampproject.org/v0.js"></script>
<script async src="https://cdn.ampproject.org/v0.mjs" type="module" crossorigin="anonymous"></script>
Warning: This is incompatible with AMP Packager unless using a prerelease version containing this commit.
- name:
esmModulesEnabled - valid options:
[true|false] - default:
true - used by: RewriteAmpUrls
extensionVersions
Specify version numbers to use for automatically imported Extensions. If not defined, default to latest.
Example:
1const ampOptimizer = AmpOptimizer.create({ 2 extensionVersions: { 3 'amp-twitter': '0.1', 4 }, 5});
- name:
extensionVersions - valid options:
OBJECT - default:
{} - used by: AutoExtensionImport
format
Specifies the AMP format of the input file. Defaults to AMP.
- name:
format - valid options:
[AMP|AMP4EMAIL|AMP4ADS] - default:
AMP - used by: AutoExtensionImport, AddMandatoryTags
imageBasePath
Specifies a base path used to resolve an image during build,
this can be a file system path or URL prefix. You can also pass a function
(imgSrc, params) => '../img/' + imgSrc for dynamically calculating the image path.
- name:
imageBasePath - valid options:
STRING|FUNCTION - default: undefined
- used by: Markdown
imageOptimizer
Enable automated image srcset generation by providing a function for calculating srcset URLs for a given image src. The function should return a URL pointing to a version of the src image with the given width. If no image is available, it should return a falsy value.
Example:
1const ampOptimizer = AmpOptimizer.create({ 2 imageOptimizer: (src, width) => `${src}?width=${width}`, 3});
- name:
imageOptimizer - valid options:
FUNCTION - default: undefined
- used by: OptimizeImages
lts
Use long-term stable URLs for downloading the AMP runtime and components.
- name:
lts - valid options:
[true|false] - default:
false - used by: RewriteAmpUrls
markdown
This transformer adds out-of-the-box markdown support. This allows using AMP Optimizer to convert HTML documents created from Markdown files into valid AMP. A typical conversion flow would be:
README.md => HTML => AMP Optimizer => valid AMP
The only thing this transformer does is converting <img> tags into
either amp-img or amp-anim tags. All other Markdown features are
already supported by AMP. The transformer will try to resolve image
dimensions from the actual files. Images larger than 320px will automatically
get an intrinsic layout. For image detection to work, an optional dependency
probe-image-size needs to be installed via NPM.
- name:
markdown - valid options:
[true|false] - default:
false - used by: Markdown
minify
Minifies the generated HTML output and inlined CSS.
- name:
minify - valid options:
[true|false] - default:
true - used by: MinifyHtml, SeparateKeyframes
Warning: this setting is not recommended when running AMP Optimizer in your backend on every request as execution time can increase by up to 7x.
optimizeAmpBind
Enables a considerably faster scanning method in amp-bind, by injecting a i-amphtml-binding attribute on all elements with a bound attribute.
- name:
optimizeAmpBind - valid options:
[true|false] - default:
true - used by: OptimizeAmpBind
optimizeHeroImages
Enables hero image optimization. Hero images will either be auto detected or you can explicitly mark these by adding the data-hero attribute:
<amp-img data-hero src="foo.jpg" ...>
The maximum number of hero images that can be marked up using data-hero is 2. This number can be increased using the maxHeroImageCount parameter.
Hero images are optimized by server-side rendering the img element inside the amp-img element. This can siginificantly improve image rendering performance and reduce the largest contentful paint (LCP) metric from Core Web Vitals.
- name:
optimizeHeroImages - valid options:
[true|false] - default:
true - used by: OptimizeHeroImages
preloadHeroImage
Deprecated, use optimizeHeroImages instead.
verbose
Enable verbose mode with more detailed logging output.
- name:
verbose - valid options:
[true|false] - default:
false
Features
Image optimization
AMP Optimizer helps you serve optimized images. For this to work, you need to provide a function that maps an image src to a resized srcset source value. The image resizing needs to either happen at build time (e.g. for static sites) or via a image hosting service such as thumbor.
Here is an example implementation that appends the image width to the src:
1const ampOptimizer = AmpOptimizer.create({ 2 // parameters are the amp-img `src` and the `width` of the to be generated srcset source value 3 imageOptimizer: (src, width) => { 4 // we cannot rename if the image does not have a file extension 5 const index = src.lastIndexOf('.'); 6 if (index === -1) { 7 // return null means we won't generate a srcset source value for this width 8 return null; 9 } 10 const prefix = src.substring(0, index); 11 const postfix = src.substring(index, src.length); 12 return `${prefix}.${width}w${postfix}`; 13 }; 14})
Using this implementation, AMP Optimizer will transform the following amp-img declarations:
1<!-- Injects srcset for responsive layout --> 2<amp-img src="image1.png" width="400" height="800" layout="responsive"></amp-img> 3<!-- Ignores existing srcset --> 4<amp-img 5 layout="fill" 6 srcset="image-1x.png 1x, 7 image-2x.png 2x" 8></amp-img>
into:
1<!-- Injects srcset for responsive layout --> 2<amp-img 3 src="image1.png" 4 width="400" 5 height="800" 6 layout="responsive" 7 srcset="image1.470w.png 470w, image1.820w.png 820w, image1.1440w.png 1440w" 8></amp-img> 9<!-- Ignores existing srcset --> 10<amp-img 11 layout="fill" 12 srcset="image-1x.png 1x, 13 image-2x.png 2x" 14></amp-img>
Important when using layout=responsive use the width and height attribute to specify the minimum image dimensions. For example, for a full-bleed hero image on mobile, specify the width aswidth=320.
Auto add incomplete markup
It's possible to pass incomplete documents and AMP Optimizer will add any missing tags and extension imports required by a valid AMP document.
1const originalHtml = ` 2 <h1>Hello World!</h1> 3 <amp-twitter width="375" 4 height="472" 5 layout="responsive" 6 data-tweetid="1182321926473162752"> 7 </amp-twitter> 8`; 9 10// you can pass the canonical URL, default is `.` 11const opts = { 12 canonical: '/example.html', 13}; 14ampOptimizer.transformHtml(originalHtml, opts).then((optimizedHtml) => { 15 // optimizedHtml will be a valid AMP document 16 console.log(optimizedHtml); 17});
Automated Markdown conversion
AMP Optimizer supports converting Markdown to AMPHTML. A typical conversion flow would be:
README.md => HTML => AMP Optimizer => valid AMP
The AMP Optimizer converts <img> tags into <amp-img> or <amp-anim> tags when in Markdown mode. Enable Markdown mode via markdown : true. AMP Optimizer will try to resolve image dimensions from the actual files. Images wider than 320px will automatically get an intrinsic layout.
All other Markdown features are already supported by AMP.
You can pass an additional option imageBasePath to specify a base path used to resolve an image during build, this can be a file system path or URL prefix.
Important: for image size detection to work, an optional dependency
probe-image-size needs to be installed via NPM.
1npm install probe-image-size --save-dev
Example:
1const AmpOptimizer = require('@ampproject/toolbox-optimizer'); 2const md = require('markdown-it')({ 3 // don't sanitize html if you want to support AMP components in Markdown 4 html: true, 5}); 6 7// enable markdown mode 8const ampOptimizer = AmpOptimizer.create({ 9 markdown: true, 10}); 11 12const markdown = ` 13# Markdown 🤯 14 15Here is an image declared in Markdown syntax: 16 17. 18 19You can directly declare AMP components: 20 21<amp-twitter width="375" 22 height="472" 23 layout="responsive" 24 data-tweetid="1182321926473162752"> 25</amp-twitter> 26 27Any missing extensions will be automatically imported. 28`; 29 30const html = md.render(markdown); 31 32const amphtml = await ampOptimizer.transformHtml(html, { 33 canonical: filePath, 34});
You can find a working sample here.
Extending AMP Optimizer with custom transformations
AMP Optimizer supports custom HTML transformations:
1const AmpOptimizer = require('@ampproject/toolbox-optimizer'); 2const {createElement, firstChildByTag, appendChild} = AmpOptimizer.NodeUtils; 3 4class CustomTransformer { 5 constructor(config) { 6 this.log_ = config.log.tag('CUSTOM'); 7 } 8 transform(tree, params) { 9 this.log_.info('Running custom transformation for ', params.filePath); 10 const html = firstChildByTag(tree, 'html'); 11 if (!html) return; 12 const head = firstChildByTag(html, 'head'); 13 if (!head) return; 14 const desc = createElement('meta', { 15 name: 'description', 16 content: 'this is just a demo', 17 }); 18 appendChild(head, desc); 19 } 20} 21 22// it's best to run custom transformers first 23const customTransformations = [CustomTransformer, ...AmpOptimizer.TRANSFORMATIONS_AMP_FIRST]; 24 25// pass custom transformers when creating the optimizer 26const optimizer = AmpOptimizer.create({ 27 transformations: customTransformations, 28}); 29// you can add custom parameters on a per document basis 30const transformedHtml = await optimizer.transformHtml(html, { 31 filePath, 32});
Checkout the samples to learn how to customize AMP Optimizer.
Best Practices
Make sure to enable AMP Boilerplate removal
The biggest performance gain results from removing the AMP boilerplate code. However, under some circumstances it's not possible to remove the boilerplate code:
- if the
amp-experiment,amp-storyoramp-dynamic-css-classescomponents are used (code).
To find out, why the AMP boilerplate could not be removed, enable verbose mode:
1// globally 2const optimizer = ampOptimizer.create({ 3 verbose: true, 4});
... or for individual pages:
1// per transformation
2ampOptimizer.transformHtml(originalHtml, {
3 verbose: true,
4});Transform AMP pages at build time if possible
Applying the transformations to an AMP file consumes additional server resources. Also, since the entire file is needed to apply the transformations, it also becomes impossible to stream the response while applying it. In order to avoid server overhead, if the set of AMP files to be transformed is known in advance, transformations should be run at build time.
Cache transformed AMPs at runtime
Most websites have a more dynamic nature though and are not able to apply the transformations statically. For such cases it is possible to run the transformations after AMP pages are rendered, e.g. in an Express middleware. In that case, to achieve best performance, it's best to cache transformed pages for subsequent requests. Caching can take place on the CDN level, on the site's internal infrastructure (eg: Memcached), or even on the server itself, if the set of pages is small enough to fit in memory.
Regenerate pages at least once a week
AMP Optimizer inlines CSS styles required by AMP. To make sure, that the inlined CSS stays in sync with the latest AMP release, we recommend to re-generate pages at least once a weekOut-of-sync CSS will not break your page, but it could theoretically cause AMP components to briefly appear with the "wrong" styles, such as being visible when they should be hidden. The good news is that these glitches will only be temporary, because as soon as the AMP JS starts, it will check the inlined CSS and update it if required.
Experimental Features
Warning: these features are experimental and might result in invalid AMP pages.
Paired AMP
When using experimental features resulting in invalid AMP it's best to setup paired AMP mode. Paired AMP mode will add <link rel=amphtml href=${ampUrl}> to the transformed page, were ampUrl needs to point to the valid version of this page.
Example:
1const optimizer = AmpOptimizer.create({
2 transformations: AmpOptimizer.TRANSFORMATIONS_PAIRED_AMP,
3});
4const ampFilePath = filePath.substring(1, filePath.length).replace('.html', '.amp.html');
5const transformedHtml = await optimizer.transformHtml(html, {
6 // needed to calculate the `<link rel=amphtml href=${ampUrl}>`
7 ampUrl: ampFilePath,
8});Versioned AMP Runtime
The ampRuntimeVersion parameter will rewrite all AMP runtime and extension imports to the specified version. For example:
https://cdn.ampproject.org/v0.js
will be replaced with:
https://cdn.ampproject.org/rtv/001515617716922/v0.js
Versioning the AMP runtime URLs has one main benefit: versioned AMP runtime URLs are served with a longer max-age than the unversioned ones. This means AMP pages served with versioned AMP runtime benefit from better browser caching.
Important: when using versioned AMP runtime URLs make sure to invalidate all caches whenever a new AMP runtime is released. This is to ensure that your AMP pages always use the latest version of the AMP runtime.
You can use @ampproject/toolbox-runtime-version to retrieve the latest version of the AMP runtime. Here is a sample to apply the optimizations including versioning the URLs:
1const ampOptimizer = require('@ampproject/toolbox-optimizer'); 2const ampRuntimeVersion = await runtimeVersion.currentVersion(); 3 4// The input string 5const originalHtml = ` 6<!doctype html> 7<html ⚡> 8... 9`; 10 11// Additional options can be passed as the second argument 12const optimizedHtml = await ampOptimizer.transformHtml(originalHtml, { 13 ampUrl: 'canonical.amp.html', 14 ampRuntimeVersion: ampRuntimeVersion, 15}); 16 17console.log(optimizedHtml);
Blurry image placeholders
Add placeholders for amp-img and amp-video posters. The placeholders are blurry versions of the corresponding original source. The blur will be displayed as the <amp-img> is rendering, and will fade out once the element is loaded. The current requirements of appending a blurry placeholder is for the element is to be a JPEG that is either responsive or a poster for an amp-video.
Important: blurry image placeholder computation is computationally expensive. Make sure to only use it for static or cached pages.
This transformer supports the following options:
blurredPlaceholders: Enables blurry image placeholder generation. Default isfalse.imageBasePath: specifies a base path used to resolve an image during build.maxBlurredPlaceholders: Specifies the max number of blurred images. Defaults to 5.blurredPlaceholdersCacheSize: Specifies the max number of blurred images to be cached to avoid expensive recalculation. Set to 0 if caching should be disabled. Set to -1 if all placeholders should be cached (good for static sites). Defaults to 30.
Usage:
1const optimizer = AmpOptimizer.create({ 2 blurredPlaceholders: true, 3});
Self-hosted AMP components
It's possible to rewrite the AMP framework and component imports to a different domain than cdn.ampproject.org.
Example:
1const ampOptimizer = require('@ampproject/toolbox-optimizer');
2
3// The input string
4const originalHtml = `
5<!doctype html>
6<html ⚡>
7...
8`;
9
10// Additional options can be passed as the second argument
11const optimizedHtml = await ampOptimizer.transformHtml(originalHtml, {
12 ampUrl: 'canonical.amp.html',
13 // this will rewrite https://cdn.ampproject.org/v0.js to /amp/v0.js
14 ampUrlPrefix: '/amp',
15});
16
17console.log(optimizedHtml);Fallback API for amp-geo
Ideally, when self-hosting the AMP framework, amp-geo-0.1.js should be patched at delivery time to replace {{AMP_ISO_COUNTRY_HOTPATCH}} with the ISO 3166-1 alpha-2 country code where the request originated (reference). If your host does not have this capability, you can instead rely on a web API to return the country at runtime. The web API must be secure (HTTPS), adhere to AMP CORS guidelines, and return JSON in the following format:
1{"country": "de"}
where in this example, de is the ISO 3166-1 alpha-2 country code for Germany.
Example:
1const ampOptimizer = require('@ampproject/toolbox-optimizer');
2
3// The input string
4const originalHtml = `
5<!doctype html>
6<html ⚡>
7...
8`;
9
10const optimizedHtml = await ampOptimizer.transformHtml(originalHtml, {
11 // this will instruct amp-geo to fetch the user's country from an API
12 // which returns JSON in format: {"country": "de"}
13 geoApiUrl: 'https://example.com/geo',
14});
15
16console.log(optimizedHtml);Development & Testing
AMP Optimizer uses a snapshot based testing approach. To execute the tests, run in the project root:
1npm run test:node
Transformer tests are located in:
- spec/transformers/valid/TransformerName/test-name/
expected_output.html
input.html
The transformation input is defined in input.html, whereas expected_output.html contains the expected
outcome of the transformation. Don't edit expected_output.html manually, instead, after changing
a transformer implementation, run:
1npm run test:optimizer:snapshot
to store a new snapshot version in expected_output.html.
No vulnerabilities found.
Reason
no dangerous workflow patterns detected
Reason
no binaries found in the repo
Reason
license file detected
Details
- Info: project has a license file: LICENSE:0
- Info: FSF or OSI recognized license: Apache License 2.0: LICENSE:0
Reason
Found 13/19 approved changesets -- score normalized to 6
Reason
0 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 0
Reason
detected GitHub workflow tokens with excessive permissions
Details
- Warn: no topLevel permission defined: .github/workflows/CI.yml:1
- Info: no jobLevel write permissions found
Reason
no effort to earn an OpenSSF best practices badge detected
Reason
security policy file not detected
Details
- Warn: no security policy file detected
- Warn: no security file to analyze
- Warn: no security file to analyze
- Warn: no security file to analyze
Reason
project is not fuzzed
Details
- Warn: no fuzzer integrations found
Reason
dependency not pinned by hash detected -- score normalized to 0
Details
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/CI.yml:18: update your workflow using https://app.stepsecurity.io/secureworkflow/ampproject/amp-toolbox/CI.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/CI.yml:20: update your workflow using https://app.stepsecurity.io/secureworkflow/ampproject/amp-toolbox/CI.yml/main?enable=pin
- Warn: containerImage not pinned by hash: packages/optimizer-docker/Dockerfile:1: pin your Docker image by updating node:lts-alpine3.12 to node:lts-alpine3.12@sha256:c2ed3b2b36b726980474f8bf80025ca3a1aeb90c76286953f9f4b9b1dc3001b0
- Warn: npmCommand not pinned by hash: .github/workflows/CI.yml:26
- Info: 0 out of 2 GitHub-owned GitHubAction dependencies pinned
- Info: 0 out of 1 containerImage dependencies pinned
- Info: 0 out of 1 npmCommand dependencies pinned
Reason
SAST tool is not run on all commits -- score normalized to 0
Details
- Warn: 0 commits out of 27 are checked with a SAST tool
Reason
98 existing vulnerabilities detected
Details
- Warn: Project is vulnerable to: GHSA-968p-4wvh-cqc8
- Warn: Project is vulnerable to: GHSA-h5c3-5r3r-rr8q
- Warn: Project is vulnerable to: GHSA-rmvr-2pp2-xj38
- Warn: Project is vulnerable to: GHSA-xx4v-prfh-6cgc
- Warn: Project is vulnerable to: GHSA-8hc4-vh64-cxmj
- Warn: Project is vulnerable to: GHSA-jr5f-v2jv-69x6
- Warn: Project is vulnerable to: GHSA-qwcr-r2fm-qrc7
- Warn: Project is vulnerable to: GHSA-v6h2-p8h4-qcjw
- Warn: Project is vulnerable to: GHSA-pxg6-pf52-xh8x
- Warn: Project is vulnerable to: GHSA-3xgq-45jj-v275
- Warn: Project is vulnerable to: GHSA-r7qp-cfhv-p84w
- Warn: Project is vulnerable to: GHSA-q9mw-68c2-j6m5
- Warn: Project is vulnerable to: GHSA-pfq8-rq6v-vf5m
- Warn: Project is vulnerable to: GHSA-xvf7-4v9q-58w6
- Warn: Project is vulnerable to: GHSA-rh63-9qcf-83gf
- Warn: Project is vulnerable to: GHSA-p6mc-m468-83gw
- Warn: Project is vulnerable to: GHSA-952p-6rrq-rcjv
- Warn: Project is vulnerable to: GHSA-qrpm-p2h7-hrv2
- Warn: Project is vulnerable to: GHSA-mwcw-c2x4-8c55
- Warn: Project is vulnerable to: GHSA-9wv6-86v2-598j
- Warn: Project is vulnerable to: GHSA-x565-32qp-m3vf
- Warn: Project is vulnerable to: GHSA-7fh5-64p2-3v2j
- Warn: Project is vulnerable to: GHSA-hwj9-h5mp-3pm3
- Warn: Project is vulnerable to: GHSA-566m-qj78-rww5
- Warn: Project is vulnerable to: GHSA-hrpp-h998-j3pp
- Warn: Project is vulnerable to: GHSA-p8p7-x288-28g6
- Warn: Project is vulnerable to: GHSA-gcx4-mw62-g8wm
- Warn: Project is vulnerable to: GHSA-c2qf-rxjj-qqgw
- Warn: Project is vulnerable to: GHSA-m6fv-jmcg-4jfg
- Warn: Project is vulnerable to: GHSA-25hc-qcg6-38wj
- Warn: Project is vulnerable to: GHSA-qm95-pgcg-qqfq
- Warn: Project is vulnerable to: GHSA-cqmj-92xf-r6r9
- Warn: Project is vulnerable to: GHSA-f5x3-32g6-xq36
- Warn: Project is vulnerable to: GHSA-pq67-2wwv-3xjx
- Warn: Project is vulnerable to: GHSA-8cj5-5rvv-wf4v
- Warn: Project is vulnerable to: GHSA-4wf5-vphf-c2xc
- Warn: Project is vulnerable to: GHSA-29xr-v42j-r956
- Warn: Project is vulnerable to: GHSA-72xf-g2v4-qvf3
- Warn: Project is vulnerable to: GHSA-fhg7-m89q-25r3
- Warn: Project is vulnerable to: GHSA-3h5v-q93c-6h6q
- Warn: Project is vulnerable to: GHSA-776f-qx25-q3cc
- Warn: Project is vulnerable to: GHSA-93q8-gq69-wqmw
- Warn: Project is vulnerable to: GHSA-cph5-m8f7-6c5x
- Warn: Project is vulnerable to: GHSA-wf5p-g6vw-rhxx
- Warn: Project is vulnerable to: GHSA-74fj-2j2h-c42q
- Warn: Project is vulnerable to: GHSA-pw2r-vq6v-hr8c
- Warn: Project is vulnerable to: GHSA-jchw-25xp-jwwc
- Warn: Project is vulnerable to: GHSA-cxjh-pqwp-8mfp
- Warn: Project is vulnerable to: GHSA-pfrx-2q88-qq97
- Warn: Project is vulnerable to: GHSA-rc47-6667-2j5j
- Warn: Project is vulnerable to: GHSA-896r-f27r-55mw
- Warn: Project is vulnerable to: GHSA-f8q6-p94x-37v3
- Warn: Project is vulnerable to: GHSA-xvch-5gv4-984h
- Warn: Project is vulnerable to: GHSA-r683-j2x4-v87g
- Warn: Project is vulnerable to: GHSA-px4h-xg32-q955
- Warn: Project is vulnerable to: GHSA-6fc8-4gx4-v693
- Warn: Project is vulnerable to: GHSA-rv95-896h-c2vc
- Warn: Project is vulnerable to: GHSA-qw6h-vgh9-j6wx
- Warn: Project is vulnerable to: GHSA-rhx6-c78j-4q9w
- Warn: Project is vulnerable to: GHSA-cm22-4g7w-348p
- Warn: Project is vulnerable to: GHSA-gxpj-cx7g-858c
- Warn: Project is vulnerable to: GHSA-2m96-9w4j-wgv7
- Warn: Project is vulnerable to: GHSA-h726-x36v-rx45
- Warn: Project is vulnerable to: GHSA-42xw-2xvc-qx8m
- Warn: Project is vulnerable to: GHSA-4w2v-q235-vp99
- Warn: Project is vulnerable to: GHSA-p28h-cc7q-c4fg
- Warn: Project is vulnerable to: GHSA-w7q9-p3jq-fmhm
- Warn: Project is vulnerable to: GHSA-jf85-cpcp-j695
- Warn: Project is vulnerable to: GHSA-29mw-wpgm-hmr9
- Warn: Project is vulnerable to: GHSA-35jh-r3h4-6jhm
- Warn: Project is vulnerable to: GHSA-vh95-rmgr-6w4m
- Warn: Project is vulnerable to: GHSA-rp65-9cf3-cjxr
- Warn: Project is vulnerable to: GHSA-w8qv-6jwh-64r5
- Warn: Project is vulnerable to: GHSA-257v-vj4p-3w2h
- Warn: Project is vulnerable to: GHSA-7gc6-qh9x-w6h8
- Warn: Project is vulnerable to: GHSA-62gr-4qp9-h98f
- Warn: Project is vulnerable to: GHSA-f52g-6jhx-586p
- Warn: Project is vulnerable to: GHSA-2cf5-4w76-r9qv
- Warn: Project is vulnerable to: GHSA-3cqr-58rm-57f8
- Warn: Project is vulnerable to: GHSA-g9r4-xpmj-mj65
- Warn: Project is vulnerable to: GHSA-q2c6-c6pm-g3gh
- Warn: Project is vulnerable to: GHSA-765h-qjxv-5f44
- Warn: Project is vulnerable to: GHSA-f2jv-r9rf-7988
- Warn: Project is vulnerable to: GHSA-7f5c-rpf4-86p8
- Warn: Project is vulnerable to: GHSA-7r28-3m3f-r2pr
- Warn: Project is vulnerable to: GHSA-r8j5-h5cx-65gg
- Warn: Project is vulnerable to: GHSA-w7rc-rwvf-8q5r
- Warn: Project is vulnerable to: GHSA-grv7-fg5c-xmjg
- Warn: Project is vulnerable to: GHSA-897m-rjf5-jp39
- Warn: Project is vulnerable to: GHSA-w573-4hg7-7wgq
- Warn: Project is vulnerable to: GHSA-4gmj-3p3h-gm8h
- Warn: Project is vulnerable to: GHSA-43f8-2h32-f4cj
- Warn: Project is vulnerable to: GHSA-qqgx-2p2h-9c37
- Warn: Project is vulnerable to: GHSA-hj48-42vr-x3v9
- Warn: Project is vulnerable to: GHSA-c4w7-xm78-47vh
- Warn: Project is vulnerable to: GHSA-p9pc-299p-vxgp
- Warn: Project is vulnerable to: GHSA-v88g-cgmw-v5xw
- Warn: Project is vulnerable to: GHSA-6vfc-qv3f-vr6c
Score
3.4
/10
Last Scanned on 2025-06-30
The Open Source Security Foundation is a cross-industry collaboration to improve the security of open source software (OSS). The Scorecard provides security health metrics for open source projects.
Learn More