Gathering detailed insights and metrics for @angular/material
Gathering detailed insights and metrics for @angular/material
Component infrastructure and Material Design components for Angular
Installations
npm install @angular/materialDeveloper Guide
BETA
Typescript
No
Module System
ESM
Node Version
20.18.0
NPM Version
10.8.2
Score
90.2
Supply Chain
74.8
Quality
96.6
Maintenance
100
Vulnerability
98.2
License
Releases
539
Contributors
814
Languages
7
TypeScript
SCSS
HTML
Starlark
JavaScript
CSS
Shell
TypeScript (75.96%)
SCSS (14.17%)
HTML (5.56%)
Starlark (2.98%)
JavaScript (0.74%)
CSS (0.5%)
Shell (0.09%)
Developer
Download Statistics
Total Downloads
328,377,885
Last Day
319,145
Last Week
1,363,190
Last Month
6,017,790
Last Year
75,759,316
GitHub Statistics
24,510 Stars
13,316 Commits
6,776 Forks
890 Watching
115 Branches
814 Contributors
Bundle Size
250.00 B
Minified
204.00 B
Minified + Gzipped
Maintainers
2
Package Meta Information
Latest Version
19.1.1
Package Id
@angular/material@19.1.1
Unpacked Size
9.39 MB
Size
1.68 MB
File Count
664
NPM Version
10.8.2
Node Version
20.18.0
Publised On
22 Jan 2025
Total Downloads
Cumulative downloads
Total Downloads
328,377,885
Last day
-1.6%
319,145
Compared to previous day
Last week
-16.1%
1,363,190
Compared to previous week
Last month
7.2%
6,017,790
Compared to previous month
Last year
11.6%
75,759,316
Compared to previous year
Daily Downloads
Weekly Downloads
Monthly Downloads
Yearly Downloads
Dependencies
1
Versions
Official components for Angular
The Angular team builds and maintains both common UI components and tools to help you build your own custom components. The team maintains several npm packages.
| Package | Description | Docs |
|---|---|---|
@angular/cdk | Library that helps you author custom UI components with common interaction patterns | Docs |
@angular/material | Material Design UI components for Angular applications | Docs |
@angular/google-maps | Angular components built on top of the Google Maps JavaScript API | Docs |
@angular/youtube-player | Angular component built on top of the YouTube Player API | Docs |
Quick links
Documentation, demos, and guides | Frequently Asked Questions | Community Google group | Contributing | StackBlitz Template
Getting started
See our Getting Started Guide if you're building your first project with Angular Material.
Contributing
If you'd like to contribute, please follow our contributing guidelines. Please see
our help wanted label for a list of issues with good opportunities for
contribution. You can also use the good first issue label to find issues
if you are just starting to contribute to the project.
About the team
The Angular Components team is part of the Angular team at Google. The team includes both Google employees and community contributors from around the globe.
Our team has two primary goals:
- Build high-quality UI components that developers can drop into existing applications
- Provide tools that help developers build their own custom components with common interaction patterns
What do we mean by "high-quality" components?
- Internationalized and accessible so that all users can use them.
- Straightforward APIs that don't confuse developers.
- Behave as expected across a wide variety of use-cases without bugs.
- Behavior is well-tested with both unit and integration tests.
- Customizable within the bounds of the Material Design specification.
- Performance cost is minimized.
- Code is clean and well-documented to serve as an example for Angular developers.
Browser and screen reader support
The Angular Components team supports the most recent two versions of all major browsers: Chrome (including Android), Firefox, Safari (including iOS), and Edge.
We aim for great user experience with the following screen readers:
- Windows: NVDA and JAWS with FF / Chrome.
- macOS: VoiceOver with Safari / Chrome.
- iOS: VoiceOver with Safari
- Android: Android Accessibility Suite (formerly TalkBack) with Chrome.
- Chrome OS: ChromeVox with Chrome.
No vulnerabilities found.
Reason
no binaries found in the repo
Reason
27 out of 27 merged PRs checked by a CI test -- score normalized to 10
Reason
23 different organizations found -- score normalized to 10
Details
- Info: contributors work for DevIntent,airpair,angular,angular @google,angular-eslint,angular-hispano,classdojo,devintent,good code,google,googlers,https://1fpga.com,lemonade-hq,nachos,ng-packagr,ngxs,ngxs-labs,obshtestvo,reaviz,sass,storybookjs,swiss federal railways,willowtreeapps
Reason
no dangerous workflow patterns detected
Reason
update tool detected
Details
- Info: tool 'RenovateBot' is used: renovate.json:1
Reason
license file detected
Details
- Info: License file found in expected location: LICENSE:1
- Info: FSF or OSI recognized license: LICENSE:1
Reason
30 commit(s) out of 30 and 2 issue activity out of 30 found in the last 90 days -- score normalized to 10
Reason
all dependencies are pinned
Details
- Info: 13 out of 13 GitHub-owned GitHubAction dependencies pinned
- Info: 89 out of 89 third-party GitHubAction dependencies pinned
Reason
security policy file detected
Details
- Info: security policy file detected: SECURITY.md:1
- Info: Found linked content: SECURITY.md:1
- Info: Found disclosure, vulnerability, and/or timelines in security policy: SECURITY.md:1
- Info: Found text in security policy: SECURITY.md:1
Reason
found 1 unreviewed changesets out of 28 -- score normalized to 9
Reason
detected GitHub workflow tokens with excessive permissions
Details
- Info: topLevel 'contents' permission set to 'read': .github/workflows/assistant-to-the-branch-manager.yml:10
- Info: topLevel permissions set to 'none': .github/workflows/ci.material-aio.yml:1
- Info: topLevel permissions set to 'none': .github/workflows/ci.yml:1
- Warn: topLevel 'deployments' permission set to 'write': .github/workflows/deploy-dev-app-main-push.yml:8: Visit https://app.stepsecurity.io/secureworkflow/angular/components/deploy-dev-app-main-push.yml/main?enable=permissions Tick the 'Restrict permissions for GITHUB_TOKEN' Untick other options NOTE: If you want to resolve multiple issues at once, you can visit https://app.stepsecurity.io/securerepo instead. (Low effort)
- Info: topLevel permissions set to 'read-all': .github/workflows/dev-infra.yml:8
- Warn: topLevel 'statuses' permission set to 'write': .github/workflows/google-internal-tests.yml:9: Visit https://app.stepsecurity.io/secureworkflow/angular/components/google-internal-tests.yml/main?enable=permissions Tick the 'Restrict permissions for GITHUB_TOKEN' Untick other options NOTE: If you want to resolve multiple issues at once, you can visit https://app.stepsecurity.io/securerepo instead. (Low effort)
- Info: topLevel 'pull-requests' permission set to 'read': .github/workflows/google-internal-tests.yml:8
- Info: topLevel permissions set to 'none': .github/workflows/pr.material-aio.yml:1
- Info: topLevel permissions set to 'none': .github/workflows/pr.yml:1
- Info: topLevel permissions set to 'read-all': .github/workflows/preview-build-dev-app.yml:14
- Info: topLevel permissions set to 'none': .github/workflows/scheduled-ci.yml:1
- Info: topLevel 'contents' permission set to 'read': .github/workflows/scorecard.yml:12
- Info: jobLevel 'actions' permission set to 'read': .github/workflows/scorecard.yml:23
- Info: jobLevel 'contents' permission set to 'read': .github/workflows/scorecard.yml:24
- Info: no jobLevel write permissions found
Reason
branch protection is not maximal on development and all release branches
Details
- Info: 'force pushes' disabled on branch 'main'
- Info: 'allow deletion' disabled on branch 'main'
- Warn: no status checks found to merge onto branch 'main'
- Warn: number of required reviewers is only 1 on branch 'main'
- Warn: codeowner review is not required on branch 'main'
Reason
badge detected: in_progress
Reason
project is not fuzzed
Details
- Warn: no OSSFuzz integration found: Follow the steps in https://github.com/google/oss-fuzz to integrate fuzzing for your project. Over time, try to add fuzzing for more functionalities of your project. (High effort)
- Warn: no OneFuzz integration found: Follow the steps in https://github.com/microsoft/onefuzz to start fuzzing for your project. Over time, try to add fuzzing for more functionalities of your project. (High effort)
- Warn: no GoBuiltInFuzzer integration found: Follow the steps in https://go.dev/doc/fuzz/ to enable fuzzing on your project. Over time, try to add fuzzing for more functionalities of your project. (Medium effort)
- Warn: no PythonAtherisFuzzer integration found: Follow the steps in https://github.com/google/atheris to enable fuzzing on your project. Over time, try to add fuzzing for more functionalities of your project. (Medium effort)
- Warn: no CLibFuzzer integration found: Follow the steps in https://llvm.org/docs/LibFuzzer.html to enable fuzzing on your project. Over time, try to add fuzzing for more functionalities of your project. (Medium effort)
- Warn: no CppLibFuzzer integration found: Follow the steps in https://llvm.org/docs/LibFuzzer.html to enable fuzzing on your project. Over time, try to add fuzzing for more functionalities of your project. (Medium effort)
- Warn: no SwiftLibFuzzer integration found: Follow the steps in https://google.github.io/oss-fuzz/getting-started/new-project-guide/swift-lang/ to enable fuzzing on your project. Over time, try to add fuzzing for more functionalities of your project. (Medium effort)
- Warn: no RustCargoFuzzer integration found: Follow the steps in https://rust-fuzz.github.io/book/cargo-fuzz.html to enable fuzzing on your project. Over time, try to add fuzzing for more functionalities of your project. (Medium effort)
- Warn: no JavaJazzerFuzzer integration found: Follow the steps in https://github.com/CodeIntelligenceTesting/jazzer to enable fuzzing on your project. Over time, try to add fuzzing for more functionalities of your project. (Medium effort)
- Warn: no ClusterFuzzLite integration found: Follow the steps in https://github.com/google/clusterfuzzlite to integrate fuzzing as part of CI. Over time, try to add fuzzing for more functionalities of your project. (High effort)
- Warn: no HaskellPropertyBasedTesting integration found: Use one of the following frameworks to fuzz your project: QuickCheck: https://hackage.haskell.org/package/QuickCheck hedgehog: https://hedgehog.qa/ validity: https://github.com/NorfairKing/validity smallcheck: https://hackage.haskell.org/package/smallcheck hspec: https://hspec.github.io/ tasty: https://hackage.haskell.org/package/tasty (High effort)
- Warn: no TypeScriptPropertyBasedTesting integration found: Use fast-check: https://github.com/dubzzz/fast-check (High effort)
- Warn: no JavaScriptPropertyBasedTesting integration found: Use fast-check: https://github.com/dubzzz/fast-check (High effort)
Reason
SAST tool is not run on all commits -- score normalized to 0
Details
- Warn: 0 commits out of 29 are checked with a SAST tool
- Warn: CodeQL tool not detected
Reason
56 existing vulnerabilities detected
Details
- Warn: Project is vulnerable to: GHSA-wf5p-g6vw-rhxx
- Warn: Project is vulnerable to: GHSA-qwcr-r2fm-qrc7
- Warn: Project is vulnerable to: GHSA-pxg6-pf52-xh8x
- Warn: Project is vulnerable to: GHSA-3xgq-45jj-v275
- Warn: Project is vulnerable to: GHSA-c7qv-q95q-8v27
- Warn: Project is vulnerable to: GHSA-952p-6rrq-rcjv
- Warn: Project is vulnerable to: GHSA-mwcw-c2x4-8c55
- Warn: Project is vulnerable to: GHSA-rhx6-c78j-4q9w
- Warn: Project is vulnerable to: GHSA-vg6x-rcgg-rjx6
- Warn: Project is vulnerable to: GHSA-776f-qx25-q3cc
- Warn: Project is vulnerable to: GHSA-7p89-p6hx-q4fw
- Warn: Project is vulnerable to: GHSA-qw6h-vgh9-j6wx
- Warn: Project is vulnerable to: GHSA-rcm2-22f3-pqv3
- Warn: Project is vulnerable to: GHSA-pfrx-2q88-qq97
- Warn: Project is vulnerable to: GHSA-rc47-6667-2j5j
- Warn: Project is vulnerable to: GHSA-2p57-rm9w-gvfp
- Warn: Project is vulnerable to: GHSA-9wv6-86v2-598j
- Warn: Project is vulnerable to: GHSA-h755-8qp9-cq85
- Warn: Project is vulnerable to: GHSA-p8p7-x288-28g6
- Warn: Project is vulnerable to: GHSA-44c6-4v22-4mhx
- Warn: Project is vulnerable to: GHSA-4x5v-gmq8-25ch
- Warn: Project is vulnerable to: GHSA-m6fv-jmcg-4jfg
- Warn: Project is vulnerable to: GHSA-cm22-4g7w-348p
- Warn: Project is vulnerable to: GHSA-72xf-g2v4-qvf3
- Warn: Project is vulnerable to: GHSA-cchq-frgv-rjh5
- Warn: Project is vulnerable to: GHSA-g644-9gfx-q4q4
- Warn: Project is vulnerable to: GHSA-3h5v-q93c-6h6q
- Warn: Project is vulnerable to: GHSA-64vr-g452-qvp3
- Warn: Project is vulnerable to: GHSA-9cwx-2883-4wfx
- Warn: Project is vulnerable to: GHSA-7v5v-9h63-cj86
- Warn: Project is vulnerable to: GHSA-j4f2-536g-r55m
- Warn: Project is vulnerable to: GHSA-r7qp-cfhv-p84w
- Warn: Project is vulnerable to: GHSA-8gwj-8hxc-285w
- Warn: Project is vulnerable to: GHSA-8cf7-32gw-wr33
- Warn: Project is vulnerable to: GHSA-hjrf-2m68-5959
- Warn: Project is vulnerable to: GHSA-qwph-4952-7xr6
- Warn: Project is vulnerable to: GHSA-35jh-r3h4-6jhm
- Warn: Project is vulnerable to: GHSA-5v2h-r2cx-5xgj
- Warn: Project is vulnerable to: GHSA-rrrm-qjm4-v8hf
- Warn: Project is vulnerable to: GHSA-6fx8-h7jm-663j
- Warn: Project is vulnerable to: GHSA-g954-5hwp-pp24
- Warn: Project is vulnerable to: GHSA-hrpp-h998-j3pp
- Warn: Project is vulnerable to: GHSA-x3m3-4wpv-5vgc
- Warn: Project is vulnerable to: GHSA-gcx4-mw62-g8wm
- Warn: Project is vulnerable to: GHSA-c2qf-rxjj-qqgw
- Warn: Project is vulnerable to: GHSA-fxwf-4rqh-v8g3
- Warn: Project is vulnerable to: GHSA-25hc-qcg6-38wj
- Warn: Project is vulnerable to: GHSA-xfhh-g9f5-x4m4
- Warn: Project is vulnerable to: GHSA-qm95-pgcg-qqfq
- Warn: Project is vulnerable to: GHSA-cqmj-92xf-r6r9
- Warn: Project is vulnerable to: GHSA-f5x3-32g6-xq36
- Warn: Project is vulnerable to: GHSA-3g92-w8c5-73pq
- Warn: Project is vulnerable to: GHSA-c76h-2ccp-4975
- Warn: Project is vulnerable to: GHSA-rv73-9c8w-jp4c
- Warn: Project is vulnerable to: GHSA-72mh-269x-7mh5
- Warn: Project is vulnerable to: GHSA-h4j5-c7cj-74xg
Score
7.3
/10
Last Scanned on 2025-02-02T03:10:33Z
The Open Source Security Foundation is a cross-industry collaboration to improve the security of open source software (OSS). The Scorecard provides security health metrics for open source projects.
Learn More