Gathering detailed insights and metrics for @openzeppelin/contracts-upgradeable
Gathering detailed insights and metrics for @openzeppelin/contracts-upgradeable
Upgradeable variant of OpenZeppelin Contracts, meant for use in upgradeable contracts.
Installations
npm install @openzeppelin/contracts-upgradeableDeveloper
Developer Guide
BETA
Module System
Unable to determine the module system for this package.
Min. Node Version
Typescript Support
No
Node Version
20.11.1
NPM Version
10.2.4
Statistics
999 Stars
853 Commits
435 Forks
42 Watching
48 Branches
242 Contributors
Updated on 27 Nov 2024
Languages
JavaScript (53.24%)
Solidity (34.64%)
Python (7.48%)
Ruby (4.16%)
Shell (0.4%)
Makefile (0.08%)
Total Downloads
Cumulative downloads
Total Downloads
15,405,520
Last day
17.2%
43,505
Compared to previous day
Last week
14.4%
190,849
Compared to previous week
Last month
10.5%
813,243
Compared to previous month
Last year
40.9%
7,650,318
Compared to previous year
Daily Downloads
Weekly Downloads
Monthly Downloads
Yearly Downloads
Peer Dependencies
1
Versions
A library for secure smart contract development. Build on a solid foundation of community-vetted code.
- Implementations of standards like ERC20 and ERC721.
- Flexible role-based permissioning scheme.
- Reusable Solidity components to build custom contracts and complex decentralized systems.
:mage: Not sure how to get started? Check out Contracts Wizard — an interactive smart contract generator.
:building_construction: Want to scale your decentralized application? Check out OpenZeppelin Defender — a mission-critical developer security platform to code, audit, deploy, monitor, and operate with confidence.
[!IMPORTANT] OpenZeppelin Contracts uses semantic versioning to communicate backwards compatibility of its API and storage layout. For upgradeable contracts, the storage layout of different major versions should be assumed incompatible, for example, it is unsafe to upgrade from 4.9.3 to 5.0.0. Learn more at Backwards Compatibility.
+> [!NOTE] +> You are looking at the upgradeable variant of OpenZeppelin Contracts. Be sure to review the documentation on Using OpenZeppelin Contracts with Upgrades. +
Overview
Installation
Hardhat (npm)
$ npm install @openzeppelin/contracts-upgradeable
Foundry (git)
[!WARNING] When installing via git, it is a common error to use the
masterbranch. This is a development branch that should be avoided in favor of tagged releases. The release process involves security measures that themasterbranch does not guarantee.
[!WARNING] Foundry installs the latest version initially, but subsequent
forge updatecommands will use themasterbranch.
$ forge install OpenZeppelin/openzeppelin-contracts-upgradeable
Add @openzeppelin/contracts-upgradeable/=lib/openzeppelin-contracts-upgradeable/contracts/ in remappings.txt.
Usage
Once installed, you can use the contracts in the library by importing them:
1pragma solidity ^0.8.20; 2 3import {ERC721Upgradeable} from "@openzeppelin/contracts-upgradeable/token/ERC721/ERC721Upgradeable.sol"; 4 5contract MyCollectible is ERC721Upgradeable { 6 function initialize() initializer public { 7 __ERC721_init("MyCollectible", "MCO"); 8 } 9}
If you're new to smart contract development, head to Developing Smart Contracts to learn about creating a new project and compiling your contracts.
To keep your system secure, you should always use the installed code as-is, and neither copy-paste it from online sources nor modify it yourself. The library is designed so that only the contracts and functions you use are deployed, so you don't need to worry about it needlessly increasing gas costs.
Learn More
The guides in the documentation site will teach about different concepts, and how to use the related contracts that OpenZeppelin Contracts provides:
- Access Control: decide who can perform each of the actions on your system.
- Tokens: create tradeable assets or collectives, and distribute them via Crowdsales.
- Utilities: generic useful tools including non-overflowing math, signature verification, and trustless paying systems.
The full API is also thoroughly documented, and serves as a great reference when developing your smart contract application. You can also ask for help or follow Contracts's development in the community forum.
Finally, you may want to take a look at the guides on our blog, which cover several common use cases and good practices. The following articles provide great background reading, though please note that some of the referenced tools have changed, as the tooling in the ecosystem continues to rapidly evolve.
- The Hitchhiker’s Guide to Smart Contracts in Ethereum will help you get an overview of the various tools available for smart contract development, and help you set up your environment.
- A Gentle Introduction to Ethereum Programming, Part 1 provides very useful information on an introductory level, including many basic concepts from the Ethereum platform.
- For a more in-depth dive, you may read the guide Designing the Architecture for Your Ethereum Application, which discusses how to better structure your application and its relationship to the real world.
Security
This project is maintained by OpenZeppelin with the goal of providing a secure and reliable library of smart contract components for the ecosystem. We address security through risk management in various areas such as engineering and open source best practices, scoping and API design, multi-layered review processes, and incident response preparedness.
The OpenZeppelin Contracts Security Center contains more details about the secure development process.
The security policy is detailed in SECURITY.md as well, and specifies how you can report security vulnerabilities, which versions will receive security patches, and how to stay informed about them. We run a bug bounty program on Immunefi to reward the responsible disclosure of vulnerabilities.
The engineering guidelines we follow to promote project quality can be found in GUIDELINES.md.
Past audits can be found in audits/.
Smart contracts are a nascent technology and carry a high level of technical risk and uncertainty. Although OpenZeppelin is well known for its security audits, using OpenZeppelin Contracts is not a substitute for a security audit.
OpenZeppelin Contracts is made available under the MIT License, which disclaims all warranties in relation to the project and which limits the liability of those that contribute and maintain the project, including OpenZeppelin. As set out further in the Terms, you acknowledge that you are solely responsible for any use of OpenZeppelin Contracts and you assume all risks associated with any such use.
Contribute
OpenZeppelin Contracts exists thanks to its contributors. There are many ways you can participate and help build high quality software. Check out the contribution guide!
License
OpenZeppelin Contracts is released under the MIT License.
Legal
Your use of this Project is governed by the terms found at www.openzeppelin.com/tos (the "Terms").
Stable Version
The latest stable version of the package.
Stable Version
5.1.0
CRITICAL
4
CRITICAL
9.8/10
Summary
UUPSUpgradeable vulnerability in @openzeppelin/contracts
Affected Versions
>= 4.1.0, < 4.3.2
Patched Versions
4.3.2
CRITICAL
0/10
Summary
UUPSUpgradeable vulnerability in @openzeppelin/contracts-upgradeable
Affected Versions
>= 4.1.0, < 4.3.2
Patched Versions
4.3.2
CRITICAL
10/10
Summary
TimelockController vulnerability in OpenZeppelin Contracts
Affected Versions
>= 3.3.0, < 3.4.2
Patched Versions
3.4.2
CRITICAL
10/10
Summary
TimelockController vulnerability in OpenZeppelin Contracts
Affected Versions
>= 4.0.0, < 4.3.1
Patched Versions
4.3.1
HIGH
5
HIGH
8.8/10
Summary
GovernorCompatibilityBravo may trim proposal calldata
Affected Versions
>= 4.3.0, < 4.8.3
Patched Versions
4.8.3
HIGH
7.9/10
Summary
OpenZeppelin Contracts vulnerable to ECDSA signature malleability
Affected Versions
>= 4.1.0, < 4.7.3
Patched Versions
4.7.3
HIGH
7.5/10
Summary
OpenZeppelin Contracts's GovernorVotesQuorumFraction updates to quorum may affect past defeated proposals
Affected Versions
>= 4.3.0, < 4.7.2
Patched Versions
4.7.2
HIGH
7.5/10
Summary
OpenZeppelin Contracts's SignatureChecker may revert on invalid EIP-1271 signers
Affected Versions
>= 4.1.0, < 4.7.1
Patched Versions
4.7.1
HIGH
7.5/10
Summary
OpenZeppelin Contracts's ERC165Checker may revert instead of returning false
Affected Versions
>= 4.0.0, < 4.7.1
Patched Versions
4.7.1
MODERATE
10
MODERATE
5.9/10
Summary
OpenZeppelin Contracts and Contracts Upgradeable duplicated execution of subcalls in v4.9.4
Affected Versions
= 4.9.4
Patched Versions
4.9.5
MODERATE
5.3/10
Summary
OpenZeppelin Contracts's governor proposal creation may be blocked by frontrunning
Affected Versions
>= 4.3.0, < 4.9.1
Patched Versions
4.9.1
MODERATE
5.3/10
Summary
OpenZeppelin Contracts TransparentUpgradeableProxy clashing selector calls may not be delegated
Affected Versions
>= 3.2.0, < 4.8.3
Patched Versions
4.8.3
MODERATE
5.3/10
Summary
OpenZeppelin Contracts vulnerable to Improper Escaping of Output
Affected Versions
>= 4.0.0, < 4.9.3
Patched Versions
4.9.3
MODERATE
5.3/10
Summary
OpenZeppelin Contracts using MerkleProof multiproofs may allow proving arbitrary leaves for specific trees
Affected Versions
>= 4.7.0, < 4.9.2
Patched Versions
4.9.2
MODERATE
6.5/10
Summary
OpenZeppelin Contracts contains Incorrect Calculation
Affected Versions
>= 4.8.0, < 4.8.2
Patched Versions
4.8.2
MODERATE
5.3/10
Summary
OpenZeppelin Contracts's Cross chain utilities for Arbitrum L2 see EOA calls as cross chain calls
Affected Versions
>= 4.6.0, < 4.7.2
Patched Versions
4.7.2
MODERATE
5.3/10
Summary
OpenZeppelin Contracts ERC165Checker unbounded gas consumption
Affected Versions
>= 3.2.0, < 4.7.2
Patched Versions
4.7.2
MODERATE
0/10
Summary
GovernorCompatibilityBravo incorrect ABI encoding may lead to unexpected behavior
Affected Versions
>= 4.3.0, < 4.4.2
Patched Versions
4.4.2
MODERATE
5.6/10
Summary
OpenZeppelin Contracts initializer reentrancy may lead to double initialization
Affected Versions
>= 3.2.0, < 4.4.1
Patched Versions
4.4.1
LOW
4
LOW
0/10
Summary
OpenZeppelin Contracts base64 encoding may read from potentially dirty memory
Affected Versions
>= 4.5.0, < 4.9.6
Patched Versions
4.9.6
LOW
0/10
Summary
OpenZeppelin Contracts base64 encoding may read from potentially dirty memory
Affected Versions
>= 5.0.0-rc.0, < 5.0.2
Patched Versions
5.0.2
LOW
0/10
Summary
Inconsistent storage layout for ERC2771ContextUpgradeable
Affected Versions
>= 4.0.0, < 4.3.0
Patched Versions
4.3.0
LOW
0/10
Summary
ERC1155Supply vulnerability in OpenZeppelin Contracts
Affected Versions
>= 4.2.0, < 4.3.3
Patched Versions
4.3.3
Reason
no dangerous workflow patterns detected
Reason
security policy file detected
Details
- Info: security policy file detected: SECURITY.md:1
- Info: Found linked content: SECURITY.md:1
- Info: Found disclosure, vulnerability, and/or timelines in security policy: SECURITY.md:1
- Info: Found text in security policy: SECURITY.md:1
Reason
30 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10
Reason
no binaries found in the repo
Reason
license file detected
Details
- Info: project has a license file: LICENSE:0
- Info: FSF or OSI recognized license: MIT License: LICENSE:0
Reason
branch protection is not maximal on development and all release branches
Details
- Info: 'allow deletion' disabled on branch 'master'
- Info: 'force pushes' disabled on branch 'master'
- Info: 'branch protection settings apply to administrators' is required to merge on branch 'master'
- Warn: required approving review count is 1 on branch 'master'
- Warn: codeowners review is not required on branch 'master'
- Warn: no status checks found to merge onto branch 'master'
- Info: PRs are required in order to make changes on branch 'master'
Reason
Found 0/30 approved changesets -- score normalized to 0
Reason
detected GitHub workflow tokens with excessive permissions
Details
- Warn: jobLevel 'contents' permission set to 'write': .github/workflows/release-cycle.yml:133
- Warn: jobLevel 'contents' permission set to 'write': .github/workflows/release-cycle.yml:185
- Info: jobLevel 'pull-requests' permission set to 'read': .github/workflows/release-cycle.yml:27
- Warn: jobLevel 'contents' permission set to 'write': .github/workflows/release-cycle.yml:56
- Warn: jobLevel 'actions' permission set to 'write': .github/workflows/release-cycle.yml:57
- Warn: jobLevel 'contents' permission set to 'write': .github/workflows/release-cycle.yml:79
- Warn: jobLevel 'actions' permission set to 'write': .github/workflows/release-cycle.yml:80
- Warn: jobLevel 'contents' permission set to 'write': .github/workflows/release-cycle.yml:100
- Warn: no topLevel permission defined: .github/workflows/actionlint.yml:1
- Warn: no topLevel permission defined: .github/workflows/changeset.yml:1
- Warn: no topLevel permission defined: .github/workflows/checks.yml:1
- Warn: topLevel 'contents' permission set to 'write': .github/workflows/docs.yml:8
- Warn: no topLevel permission defined: .github/workflows/formal-verification.yml:1
- Warn: no topLevel permission defined: .github/workflows/release-cycle.yml:1
- Warn: no topLevel permission defined: .github/workflows/upgradeable.yml:1
Reason
no effort to earn an OpenSSF best practices badge detected
Reason
no SAST tool detected
Details
- Warn: no pull requests merged into dev branch
Reason
dependency not pinned by hash detected -- score normalized to 0
Details
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/actionlint.yml:12: update your workflow using https://app.stepsecurity.io/secureworkflow/OpenZeppelin/openzeppelin-contracts-upgradeable/actionlint.yml/master?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/actionlint.yml:18: update your workflow using https://app.stepsecurity.io/secureworkflow/OpenZeppelin/openzeppelin-contracts-upgradeable/actionlint.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/changeset.yml:22: update your workflow using https://app.stepsecurity.io/secureworkflow/OpenZeppelin/openzeppelin-contracts-upgradeable/changeset.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/checks.yml:37: update your workflow using https://app.stepsecurity.io/secureworkflow/OpenZeppelin/openzeppelin-contracts-upgradeable/checks.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/checks.yml:58: update your workflow using https://app.stepsecurity.io/secureworkflow/OpenZeppelin/openzeppelin-contracts-upgradeable/checks.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/checks.yml:84: update your workflow using https://app.stepsecurity.io/secureworkflow/OpenZeppelin/openzeppelin-contracts-upgradeable/checks.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/checks.yml:95: update your workflow using https://app.stepsecurity.io/secureworkflow/OpenZeppelin/openzeppelin-contracts-upgradeable/checks.yml/master?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/checks.yml:100: update your workflow using https://app.stepsecurity.io/secureworkflow/OpenZeppelin/openzeppelin-contracts-upgradeable/checks.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/checks.yml:107: update your workflow using https://app.stepsecurity.io/secureworkflow/OpenZeppelin/openzeppelin-contracts-upgradeable/checks.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/checks.yml:118: update your workflow using https://app.stepsecurity.io/secureworkflow/OpenZeppelin/openzeppelin-contracts-upgradeable/checks.yml/master?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/checks.yml:122: update your workflow using https://app.stepsecurity.io/secureworkflow/OpenZeppelin/openzeppelin-contracts-upgradeable/checks.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/checks.yml:130: update your workflow using https://app.stepsecurity.io/secureworkflow/OpenZeppelin/openzeppelin-contracts-upgradeable/checks.yml/master?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/checks.yml:132: update your workflow using https://app.stepsecurity.io/secureworkflow/OpenZeppelin/openzeppelin-contracts-upgradeable/checks.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/checks.yml:23: update your workflow using https://app.stepsecurity.io/secureworkflow/OpenZeppelin/openzeppelin-contracts-upgradeable/checks.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/docs.yml:14: update your workflow using https://app.stepsecurity.io/secureworkflow/OpenZeppelin/openzeppelin-contracts-upgradeable/docs.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/formal-verification.yml:23: update your workflow using https://app.stepsecurity.io/secureworkflow/OpenZeppelin/openzeppelin-contracts-upgradeable/formal-verification.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/formal-verification.yml:31: update your workflow using https://app.stepsecurity.io/secureworkflow/OpenZeppelin/openzeppelin-contracts-upgradeable/formal-verification.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/formal-verification.yml:47: update your workflow using https://app.stepsecurity.io/secureworkflow/OpenZeppelin/openzeppelin-contracts-upgradeable/formal-verification.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/formal-verification.yml:55: update your workflow using https://app.stepsecurity.io/secureworkflow/OpenZeppelin/openzeppelin-contracts-upgradeable/formal-verification.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/formal-verification.yml:74: update your workflow using https://app.stepsecurity.io/secureworkflow/OpenZeppelin/openzeppelin-contracts-upgradeable/formal-verification.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/formal-verification.yml:78: update your workflow using https://app.stepsecurity.io/secureworkflow/OpenZeppelin/openzeppelin-contracts-upgradeable/formal-verification.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/release-cycle.yml:137: update your workflow using https://app.stepsecurity.io/secureworkflow/OpenZeppelin/openzeppelin-contracts-upgradeable/release-cycle.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/release-cycle.yml:146: update your workflow using https://app.stepsecurity.io/secureworkflow/OpenZeppelin/openzeppelin-contracts-upgradeable/release-cycle.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/release-cycle.yml:157: update your workflow using https://app.stepsecurity.io/secureworkflow/OpenZeppelin/openzeppelin-contracts-upgradeable/release-cycle.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/release-cycle.yml:170: update your workflow using https://app.stepsecurity.io/secureworkflow/OpenZeppelin/openzeppelin-contracts-upgradeable/release-cycle.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/release-cycle.yml:173: update your workflow using https://app.stepsecurity.io/secureworkflow/OpenZeppelin/openzeppelin-contracts-upgradeable/release-cycle.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/release-cycle.yml:192: update your workflow using https://app.stepsecurity.io/secureworkflow/OpenZeppelin/openzeppelin-contracts-upgradeable/release-cycle.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/release-cycle.yml:203: update your workflow using https://app.stepsecurity.io/secureworkflow/OpenZeppelin/openzeppelin-contracts-upgradeable/release-cycle.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/release-cycle.yml:30: update your workflow using https://app.stepsecurity.io/secureworkflow/OpenZeppelin/openzeppelin-contracts-upgradeable/release-cycle.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/release-cycle.yml:35: update your workflow using https://app.stepsecurity.io/secureworkflow/OpenZeppelin/openzeppelin-contracts-upgradeable/release-cycle.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/release-cycle.yml:61: update your workflow using https://app.stepsecurity.io/secureworkflow/OpenZeppelin/openzeppelin-contracts-upgradeable/release-cycle.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/release-cycle.yml:69: update your workflow using https://app.stepsecurity.io/secureworkflow/OpenZeppelin/openzeppelin-contracts-upgradeable/release-cycle.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/release-cycle.yml:84: update your workflow using https://app.stepsecurity.io/secureworkflow/OpenZeppelin/openzeppelin-contracts-upgradeable/release-cycle.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/release-cycle.yml:92: update your workflow using https://app.stepsecurity.io/secureworkflow/OpenZeppelin/openzeppelin-contracts-upgradeable/release-cycle.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/release-cycle.yml:105: update your workflow using https://app.stepsecurity.io/secureworkflow/OpenZeppelin/openzeppelin-contracts-upgradeable/release-cycle.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/release-cycle.yml:111: update your workflow using https://app.stepsecurity.io/secureworkflow/OpenZeppelin/openzeppelin-contracts-upgradeable/release-cycle.yml/master?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/release-cycle.yml:116: update your workflow using https://app.stepsecurity.io/secureworkflow/OpenZeppelin/openzeppelin-contracts-upgradeable/release-cycle.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/upgradeable.yml:14: update your workflow using https://app.stepsecurity.io/secureworkflow/OpenZeppelin/openzeppelin-contracts-upgradeable/upgradeable.yml/master?enable=pin
- Warn: pipCommand not pinned by hash: .github/workflows/formal-verification.yml:54
- Warn: pipCommand not pinned by hash: .github/workflows/formal-verification.yml:85
- Info: 0 out of 33 GitHub-owned GitHubAction dependencies pinned
- Info: 0 out of 5 third-party GitHubAction dependencies pinned
- Info: 1 out of 1 npmCommand dependencies pinned
- Info: 0 out of 2 pipCommand dependencies pinned
Reason
project is not fuzzed
Details
- Warn: no fuzzer integrations found
Reason
10 existing vulnerabilities detected
Details
- Warn: Project is vulnerable to: GHSA-7q7g-4xm8-89cq
- Warn: Project is vulnerable to: GHSA-pxg6-pf52-xh8x
- Warn: Project is vulnerable to: GHSA-3xgq-45jj-v275
- Warn: Project is vulnerable to: GHSA-434g-2637-qmqr
- Warn: Project is vulnerable to: GHSA-49q7-c7j4-3p7m
- Warn: Project is vulnerable to: GHSA-977x-g7h5-7qgw
- Warn: Project is vulnerable to: GHSA-f7q4-pwc6-w24p
- Warn: Project is vulnerable to: GHSA-fc9h-whq2-v747
- Warn: Project is vulnerable to: GHSA-952p-6rrq-rcjv
- Warn: Project is vulnerable to: GHSA-3h5v-q93c-6h6q
Score
4.6
/10
Last Scanned on 2024-11-25
The Open Source Security Foundation is a cross-industry collaboration to improve the security of open source software (OSS). The Scorecard provides security health metrics for open source projects.
Learn More