Gathering detailed insights and metrics for botframework-webchat-core
Gathering detailed insights and metrics for botframework-webchat-core
A highly-customizable web-based client for Azure Bot Services.
Installations
npm install botframework-webchat-coreDeveloper Guide
BETA
Typescript
Yes
Module System
CommonJS, ESM
Min. Node Version
>=12.0.0
Node Version
18.20.3
NPM Version
10.7.0
Releases
66
Languages
7
HTML
TypeScript
JavaScript
CSS
PowerShell
Dockerfile
Pug
HTML (44.71%)
TypeScript (31.02%)
JavaScript (21.76%)
CSS (2.41%)
PowerShell (0.05%)
Dockerfile (0.04%)
Pug (0.01%)
Developer
Download Statistics
Total Downloads
0
Last Day
0
Last Week
0
Last Month
0
Last Year
0
GitHub Statistics
MIT License
1,696 Stars
2,656 Commits
1,585 Forks
122 Watchers
89 Branches
127 Contributors
Updated on Jul 15, 2025
Maintainers
5
Package Meta Information
Latest Version
4.18.0
Package Id
botframework-webchat-core@4.18.0
Unpacked Size
1.23 MB
Size
314.98 kB
File Count
482
NPM Version
10.7.0
Node Version
18.20.3
Published on
Jul 11, 2024
Total Downloads
Cumulative downloads
Total Downloads
NaN
Last Day
0%
NaN
Compared to previous day
Last Week
0%
NaN
Compared to previous week
Last Month
0%
NaN
Compared to previous month
Last Year
0%
NaN
Compared to previous year
Weekly Downloads
Monthly Downloads
Yearly Downloads
Dependencies
11
ERROR: No README data found!
No vulnerabilities found.
Reason
30 commit(s) out of 30 and 7 issue activity out of 30 found in the last 90 days -- score normalized to 10
Reason
all last 30 commits are reviewed through GitHub
Reason
no vulnerabilities detected
Reason
license file detected
Details
- Info: : LICENSE:1
Reason
no dangerous workflow patterns detected
Reason
security policy file detected
Details
- Info: security policy detected in current repo: docs/SECURITY.md:1
Reason
no binaries found in the repo
Reason
publishing workflow detected
Details
- Info: GitHub publishing workflow used in run https://api.github.com/repos/microsoft/BotFramework-WebChat/actions/runs/153176682: .github/workflows/samples.07.a.upload-to-azure-storage.yaml:20
Reason
update tool detected
Details
- Info: Dependabot detected
Reason
branch protection is not maximal on development and all release branches
Details
- Info: 'force pushes' disabled on branch 'main'
- Info: 'allow deletion' disabled on branch 'main'
- Info: status check found to merge onto on branch 'main'
- Warn: number of required reviewers is only 1 on branch 'main'
Reason
dependency not pinned by hash detected -- score normalized to 5
Details
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/daily-release.yaml:16: update your workflow using https://app.stepsecurity.io/secureworkflow/vtardia/varo-flux/daily-release.yaml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/daily-release.yaml:63: update your workflow using https://app.stepsecurity.io/secureworkflow/vtardia/varo-flux/daily-release.yaml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/daily-release.yaml:69: update your workflow using https://app.stepsecurity.io/secureworkflow/vtardia/varo-flux/daily-release.yaml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/daily-release.yaml:79: update your workflow using https://app.stepsecurity.io/secureworkflow/vtardia/varo-flux/daily-release.yaml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/daily-release.yaml:83: update your workflow using https://app.stepsecurity.io/secureworkflow/vtardia/varo-flux/daily-release.yaml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/daily-release.yaml:117: update your workflow using https://app.stepsecurity.io/secureworkflow/vtardia/varo-flux/daily-release.yaml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/playground.yaml:17: update your workflow using https://app.stepsecurity.io/secureworkflow/vtardia/varo-flux/playground.yaml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/playground.yaml:37: update your workflow using https://app.stepsecurity.io/secureworkflow/vtardia/varo-flux/playground.yaml/master?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/playground.yaml:43: update your workflow using https://app.stepsecurity.io/secureworkflow/vtardia/varo-flux/playground.yaml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/preview-branch.yml:17: update your workflow using https://app.stepsecurity.io/secureworkflow/vtardia/varo-flux/preview-branch.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/preview-branch.yml:20: update your workflow using https://app.stepsecurity.io/secureworkflow/vtardia/varo-flux/preview-branch.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/preview-branch.yml:64: update your workflow using https://app.stepsecurity.io/secureworkflow/vtardia/varo-flux/preview-branch.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/preview-branch.yml:70: update your workflow using https://app.stepsecurity.io/secureworkflow/vtardia/varo-flux/preview-branch.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/preview-branch.yml:81: update your workflow using https://app.stepsecurity.io/secureworkflow/vtardia/varo-flux/preview-branch.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/preview-branch.yml:86: update your workflow using https://app.stepsecurity.io/secureworkflow/vtardia/varo-flux/preview-branch.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/preview-branch.yml:92: update your workflow using https://app.stepsecurity.io/secureworkflow/vtardia/varo-flux/preview-branch.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/preview-branch.yml:130: update your workflow using https://app.stepsecurity.io/secureworkflow/vtardia/varo-flux/preview-branch.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/preview-branch.yml:192: update your workflow using https://app.stepsecurity.io/secureworkflow/vtardia/varo-flux/preview-branch.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/preview-branch.yml:202: update your workflow using https://app.stepsecurity.io/secureworkflow/vtardia/varo-flux/preview-branch.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/preview-branch.yml:212: update your workflow using https://app.stepsecurity.io/secureworkflow/vtardia/varo-flux/preview-branch.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/preview-branch.yml:222: update your workflow using https://app.stepsecurity.io/secureworkflow/vtardia/varo-flux/preview-branch.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/publish-github-pages.yaml:17: update your workflow using https://app.stepsecurity.io/secureworkflow/vtardia/varo-flux/publish-github-pages.yaml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/publish-github-pages.yaml:104: update your workflow using https://app.stepsecurity.io/secureworkflow/vtardia/varo-flux/publish-github-pages.yaml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/publish-github-pages.yaml:114: update your workflow using https://app.stepsecurity.io/secureworkflow/vtardia/varo-flux/publish-github-pages.yaml/master?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/publish-github-pages.yaml:120: update your workflow using https://app.stepsecurity.io/secureworkflow/vtardia/varo-flux/publish-github-pages.yaml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/samples.07.a.upload-to-azure-storage.yaml:25: update your workflow using https://app.stepsecurity.io/secureworkflow/vtardia/varo-flux/samples.07.a.upload-to-azure-storage.yaml/master?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/samples.07.a.upload-to-azure-storage.yaml:32: update your workflow using https://app.stepsecurity.io/secureworkflow/vtardia/varo-flux/samples.07.a.upload-to-azure-storage.yaml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/samples.07.a.upload-to-azure-storage.yaml:49: update your workflow using https://app.stepsecurity.io/secureworkflow/vtardia/varo-flux/samples.07.a.upload-to-azure-storage.yaml/master?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/samples.07.a.upload-to-azure-storage.yaml:55: update your workflow using https://app.stepsecurity.io/secureworkflow/vtardia/varo-flux/samples.07.a.upload-to-azure-storage.yaml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/samples.07.b.sso-for-enterprise.yaml:25: update your workflow using https://app.stepsecurity.io/secureworkflow/vtardia/varo-flux/samples.07.b.sso-for-enterprise.yaml/master?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/samples.07.b.sso-for-enterprise.yaml:32: update your workflow using https://app.stepsecurity.io/secureworkflow/vtardia/varo-flux/samples.07.b.sso-for-enterprise.yaml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/samples.07.b.sso-for-enterprise.yaml:49: update your workflow using https://app.stepsecurity.io/secureworkflow/vtardia/varo-flux/samples.07.b.sso-for-enterprise.yaml/master?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/samples.07.b.sso-for-enterprise.yaml:55: update your workflow using https://app.stepsecurity.io/secureworkflow/vtardia/varo-flux/samples.07.b.sso-for-enterprise.yaml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/samples.07.c.sso-for-intranet.yaml:25: update your workflow using https://app.stepsecurity.io/secureworkflow/vtardia/varo-flux/samples.07.c.sso-for-intranet.yaml/master?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/samples.07.c.sso-for-intranet.yaml:32: update your workflow using https://app.stepsecurity.io/secureworkflow/vtardia/varo-flux/samples.07.c.sso-for-intranet.yaml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/samples.07.c.sso-for-intranet.yaml:49: update your workflow using https://app.stepsecurity.io/secureworkflow/vtardia/varo-flux/samples.07.c.sso-for-intranet.yaml/master?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/samples.07.c.sso-for-intranet.yaml:55: update your workflow using https://app.stepsecurity.io/secureworkflow/vtardia/varo-flux/samples.07.c.sso-for-intranet.yaml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/samples.07.d.sso-for-teams.yaml:25: update your workflow using https://app.stepsecurity.io/secureworkflow/vtardia/varo-flux/samples.07.d.sso-for-teams.yaml/master?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/samples.07.d.sso-for-teams.yaml:32: update your workflow using https://app.stepsecurity.io/secureworkflow/vtardia/varo-flux/samples.07.d.sso-for-teams.yaml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/samples.07.d.sso-for-teams.yaml:49: update your workflow using https://app.stepsecurity.io/secureworkflow/vtardia/varo-flux/samples.07.d.sso-for-teams.yaml/master?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/samples.07.d.sso-for-teams.yaml:55: update your workflow using https://app.stepsecurity.io/secureworkflow/vtardia/varo-flux/samples.07.d.sso-for-teams.yaml/master?enable=pin
- Warn: containerImage not pinned by hash: chrome.dockerfile:4: pin your Docker image by updating selenium/node-chrome to selenium/node-chrome@sha256:e407fe4afca4af95806f54dca73a331b1b9d4237f160d22617c8a5b22c74a72d
- Warn: containerImage not pinned by hash: packages/test/harness/Dockerfile:5
- Warn: containerImage not pinned by hash: playground.dockerfile:5
- Warn: containerImage not pinned by hash: samples/01.getting-started/l.sharepoint-web-part/Dockerfile:5
- Warn: containerImage not pinned by hash: samples/07.advanced-web-chat-apps/a.upload-to-azure-storage/Dockerfile:8
- Warn: containerImage not pinned by hash: samples/07.advanced-web-chat-apps/a.upload-to-azure-storage/Dockerfile-run:6
- Warn: containerImage not pinned by hash: samples/07.advanced-web-chat-apps/b.sso-for-enterprise/Dockerfile:8
- Warn: containerImage not pinned by hash: samples/07.advanced-web-chat-apps/b.sso-for-enterprise/Dockerfile:22
- Warn: containerImage not pinned by hash: samples/07.advanced-web-chat-apps/b.sso-for-enterprise/Dockerfile-run:6
- Warn: containerImage not pinned by hash: samples/07.advanced-web-chat-apps/c.sso-for-intranet/Dockerfile:6
- Warn: containerImage not pinned by hash: samples/07.advanced-web-chat-apps/c.sso-for-intranet/Dockerfile-run:6
- Warn: containerImage not pinned by hash: samples/07.advanced-web-chat-apps/d.sso-for-teams/Dockerfile:6
- Warn: containerImage not pinned by hash: samples/07.advanced-web-chat-apps/d.sso-for-teams/Dockerfile-run:6
- Warn: containerImage not pinned by hash: samples/07.advanced-web-chat-apps/e.sso-on-behalf-of-authentication/Dockerfile:8
- Warn: containerImage not pinned by hash: samples/07.advanced-web-chat-apps/e.sso-on-behalf-of-authentication/Dockerfile:22
- Warn: containerImage not pinned by hash: samples/07.advanced-web-chat-apps/e.sso-on-behalf-of-authentication/Dockerfile-run:6
- Warn: containerImage not pinned by hash: testharness.dockerfile:5
- Warn: containerImage not pinned by hash: testharness2.dockerfile:5
- Warn: npmCommand not pinned by hash: playground.dockerfile:13
- Warn: npmCommand not pinned by hash: samples/01.getting-started/l.sharepoint-web-part/Dockerfile:9
- Warn: npmCommand not pinned by hash: samples/01.getting-started/l.sharepoint-web-part/Dockerfile:24
- Warn: npmCommand not pinned by hash: samples/01.getting-started/l.sharepoint-web-part/Dockerfile:31
- Warn: npmCommand not pinned by hash: samples/01.getting-started/l.sharepoint-web-part/Dockerfile:33
- Warn: npmCommand not pinned by hash: samples/07.advanced-web-chat-apps/a.upload-to-azure-storage/Dockerfile:31
- Warn: npmCommand not pinned by hash: samples/07.advanced-web-chat-apps/b.sso-for-enterprise/Dockerfile:48
- Warn: npmCommand not pinned by hash: samples/07.advanced-web-chat-apps/c.sso-for-intranet/Dockerfile:29
- Warn: npmCommand not pinned by hash: samples/07.advanced-web-chat-apps/d.sso-for-teams/Dockerfile:29
- Warn: npmCommand not pinned by hash: samples/07.advanced-web-chat-apps/e.sso-on-behalf-of-authentication/Dockerfile:48
- Warn: npmCommand not pinned by hash: testharness.dockerfile:13
- Warn: npmCommand not pinned by hash: testharness2.dockerfile:13
- Info: no insecure (not pinned by hash) dependency downloads found in Dockerfiles
- Info: no insecure (not pinned by hash) dependency downloads found in shell scripts
Reason
no badge detected
Reason
0 out of 5 artifacts are signed or have provenance
Details
- Warn: release artifact v4.15.3 does not have provenance: https://api.github.com/repos/microsoft/BotFramework-WebChat/releases/74152147
- Warn: release artifact v4.15.3 not signed: https://api.github.com/repos/microsoft/BotFramework-WebChat/releases/74152147
- Warn: release artifact v4.15.2 does not have provenance: https://api.github.com/repos/microsoft/BotFramework-WebChat/releases/66416381
- Warn: release artifact v4.15.2 not signed: https://api.github.com/repos/microsoft/BotFramework-WebChat/releases/66416381
- Warn: release artifact v4.15.1 does not have provenance: https://api.github.com/repos/microsoft/BotFramework-WebChat/releases/61025733
- Warn: release artifact v4.15.1 not signed: https://api.github.com/repos/microsoft/BotFramework-WebChat/releases/61025733
- Warn: release artifact v4.15.0 does not have provenance: https://api.github.com/repos/microsoft/BotFramework-WebChat/releases/60934832
- Warn: release artifact v4.15.0 not signed: https://api.github.com/repos/microsoft/BotFramework-WebChat/releases/60934832
- Warn: release artifact v4.14.1 does not have provenance: https://api.github.com/repos/microsoft/BotFramework-WebChat/releases/49227033
- Warn: release artifact v4.14.1 not signed: https://api.github.com/repos/microsoft/BotFramework-WebChat/releases/49227033
Reason
non read-only tokens detected in GitHub workflows
Details
- Warn: no topLevel permission defined: .github/workflows/daily-release.yaml:1: update your workflow using https://app.stepsecurity.io/secureworkflow/vtardia/varo-flux/daily-release.yaml/master?enable=permissions
- Warn: no topLevel permission defined: .github/workflows/playground.yaml:1: update your workflow using https://app.stepsecurity.io/secureworkflow/vtardia/varo-flux/playground.yaml/master?enable=permissions
- Warn: no topLevel permission defined: .github/workflows/preview-branch.yml:1: update your workflow using https://app.stepsecurity.io/secureworkflow/vtardia/varo-flux/preview-branch.yml/master?enable=permissions
- Warn: no topLevel permission defined: .github/workflows/publish-github-pages.yaml:1: update your workflow using https://app.stepsecurity.io/secureworkflow/vtardia/varo-flux/publish-github-pages.yaml/master?enable=permissions
- Warn: no topLevel permission defined: .github/workflows/samples.07.a.upload-to-azure-storage.yaml:1: update your workflow using https://app.stepsecurity.io/secureworkflow/vtardia/varo-flux/samples.07.a.upload-to-azure-storage.yaml/master?enable=permissions
- Warn: no topLevel permission defined: .github/workflows/samples.07.b.sso-for-enterprise.yaml:1: update your workflow using https://app.stepsecurity.io/secureworkflow/vtardia/varo-flux/samples.07.b.sso-for-enterprise.yaml/master?enable=permissions
- Warn: no topLevel permission defined: .github/workflows/samples.07.c.sso-for-intranet.yaml:1: update your workflow using https://app.stepsecurity.io/secureworkflow/vtardia/varo-flux/samples.07.c.sso-for-intranet.yaml/master?enable=permissions
- Warn: no topLevel permission defined: .github/workflows/samples.07.d.sso-for-teams.yaml:1: update your workflow using https://app.stepsecurity.io/secureworkflow/vtardia/varo-flux/samples.07.d.sso-for-teams.yaml/master?enable=permissions
Reason
project is not fuzzed
Score
7.2
/10
Last Scanned on 2022-08-15
The Open Source Security Foundation is a cross-industry collaboration to improve the security of open source software (OSS). The Scorecard provides security health metrics for open source projects.
Learn More