Material UI is a comprehensive library of React components that features our independent implementation of Google's Material Design system.
It's trusted by some of the world's greatest product teams because it's been rigorously battle-tested through more than a decade of development by thousands of open-source contributors.
Material UI's core functionality is extended by MUI X, a suite of complex components for advanced use cases.
Toolpad builds on top of Material UI to provide full-stack components and a low-code internal tool builder.
Note:@next points to pre-releases.
Use @latest for the latest stable release.
Joy UI
This repository also contains Joy UI, an experimental component library that implements our own in-house Joy Design.
Joy UI is in beta and development is currently on hold.
When starting a new project from scratch, we recommend Material UI over Joy UI because we can guarantee ongoing support.
Keep in mind that the maintainers are primarily focused on other projects and may not be able to respond in a timely manner to issues or pull requests related to Joy UI.
Info: Found disclosure, vulnerability, and/or timelines in security policy: SECURITY.md:1
Info: Found text in security policy: SECURITY.md:1
Reason
no dangerous workflow patterns detected
Reason
license file detected
Details
Info: project has a license file: LICENSE:0
Info: FSF or OSI recognized license: MIT License: LICENSE:0
Reason
GitHub workflow tokens follow principle of least privilege
Details
Info: jobLevel 'contents' permission set to 'read': .github/workflows/check-if-pr-has-label.yml:14
Info: jobLevel 'contents' permission set to 'read': .github/workflows/closed-issue-message.yml:17
Info: jobLevel 'actions' permission set to 'read': .github/workflows/codeql.yml:14
Info: jobLevel 'contents' permission set to 'read': .github/workflows/codeql.yml:15
Warn: jobLevel 'contents' permission set to 'write': .github/workflows/create-cherry-pick-pr.yml:17
Info: jobLevel 'contents' permission set to 'read': .github/workflows/maintenance.yml:27
Info: jobLevel 'contents' permission set to 'read': .github/workflows/mark-duplicate.yml:13
Info: jobLevel 'contents' permission set to 'read': .github/workflows/no-response.yml:22
Info: jobLevel 'contents' permission set to 'read': .github/workflows/scorecards.yml:20
Info: jobLevel 'actions' permission set to 'read': .github/workflows/scorecards.yml:21
Info: jobLevel 'contents' permission set to 'read': .github/workflows/support-stackoverflow.yml:14
Info: jobLevel 'contents' permission set to 'read': .github/workflows/vale-action.yml:12
Info: found token with 'none' permissions: .github/workflows/check-if-pr-has-label.yml:1
Info: found token with 'none' permissions: .github/workflows/ci-check.yml:1
Info: found token with 'none' permissions: .github/workflows/ci.yml:1
Info: found token with 'none' permissions: .github/workflows/closed-issue-message.yml:1
Info: found token with 'none' permissions: .github/workflows/codeql.yml:1
Info: found token with 'none' permissions: .github/workflows/create-cherry-pick-pr.yml:1
Info: found token with 'none' permissions: .github/workflows/ensure-triage-label.yml:1
Info: found token with 'none' permissions: .github/workflows/issue-cleanup.yml:1
Info: found token with 'none' permissions: .github/workflows/maintenance.yml:1
Info: found token with 'none' permissions: .github/workflows/mark-duplicate.yml:1
Info: found token with 'none' permissions: .github/workflows/no-response.yml:1
Info: found token with 'none' permissions: .github/workflows/priority-support-validation-prompt.yml:1
Info: found token with 'none' permissions: .github/workflows/publish-canaries.yml:1
Info: found token with 'none' permissions: .github/workflows/scorecards.yml:1
Info: found token with 'none' permissions: .github/workflows/support-stackoverflow.yml:1
Info: found token with 'none' permissions: .github/workflows/vale-action.yml:1
Reason
no binaries found in the repo
Reason
all dependencies are pinned
Details
Info: 12 out of 12 GitHub-owned GitHubAction dependencies pinned
Info: 12 out of 12 third-party GitHubAction dependencies pinned
Reason
Found 13/14 approved changesets -- score normalized to 9
Reason
SAST tool detected but not run on all commits
Details
Info: SAST configuration detected: CodeQL
Warn: 0 commits out of 30 are checked with a SAST tool
Reason
branch protection is not maximal on development and all release branches
Details
Info: 'allow deletion' disabled on branch 'master'
Info: 'force pushes' disabled on branch 'master'
Warn: 'branch protection settings apply to administrators' is disabled on branch 'master'
Warn: 'stale review dismissal' is disabled on branch 'master'
Warn: required approving review count is 1 on branch 'master'
Warn: codeowners review is not required on branch 'master'
Warn: 'last push approval' is disabled on branch 'master'
Warn: 'up-to-date branches' is disabled on branch 'master'
Info: status check found to merge onto on branch 'master'
Info: PRs are required in order to make changes on branch 'master'
Reason
7 existing vulnerabilities detected
Details
Warn: Project is vulnerable to: GHSA-3xgq-45jj-v275
Warn: Project is vulnerable to: GHSA-ghr5-ch3p-vcr6
Warn: Project is vulnerable to: GHSA-fc9h-whq2-v747
Warn: Project is vulnerable to: GHSA-2p57-rm9w-gvfp
Warn: Project is vulnerable to: GHSA-7fh5-64p2-3v2j
Warn: Project is vulnerable to: GHSA-gcx4-mw62-g8wm
Warn: Project is vulnerable to: GHSA-3h5v-q93c-6h6q
Reason
no effort to earn an OpenSSF best practices badge detected
Reason
project is not fuzzed
Details
Warn: no fuzzer integrations found
Score
7.6
/10
Last Scanned on 2024-11-18
The Open Source Security Foundation is a cross-industry collaboration to improve the security of open source software (OSS). The Scorecard provides security health metrics for open source projects.