Gathering detailed insights and metrics for testcafe
Gathering detailed insights and metrics for testcafe
Installations
npm install testcafeDeveloper Guide
BETA
Typescript
Yes
Module System
CommonJS
Min. Node Version
>=16.0.0
Node Version
18.20.6
NPM Version
10.8.2
Score
72.7
Supply Chain
85.8
Quality
83.2
Maintenance
100
Vulnerability
94.3
License
Releases
429
Languages
8
JavaScript
TypeScript
HTML
Less
Mustache
CoffeeScript
Dockerfile
Shell
JavaScript (73.77%)
TypeScript (19.5%)
HTML (5.98%)
Less (0.46%)
Mustache (0.2%)
CoffeeScript (0.06%)
Dockerfile (0.02%)
Shell (0.01%)
Developer
Download Statistics
Total Downloads
72,315,005
Last Day
36,914
Last Week
243,763
Last Month
1,032,701
Last Year
11,741,348
GitHub Statistics
MIT License
9,859 Stars
3,501 Commits
675 Forks
164 Watchers
24 Branches
121 Contributors
Updated on May 22, 2025
Bundle Size
6.77 MB
Minified
1.68 MB
Minified + Gzipped
Maintainers
6
Package Meta Information
Latest Version
3.7.2
Package Id
testcafe@3.7.2
Unpacked Size
6.02 MB
Size
1.43 MB
File Count
463
NPM Version
10.8.2
Node Version
18.20.6
Published on
Feb 18, 2025
Total Downloads
Cumulative downloads
Total Downloads
72,315,005
Last Day
-11.7%
36,914
Compared to previous day
Last Week
-3%
243,763
Compared to previous week
Last Month
1.9%
1,032,701
Compared to previous month
Last Year
-5.1%
11,741,348
Compared to previous year
Weekly Downloads
Monthly Downloads
Yearly Downloads
Dependencies
97
@babel/core@babel/plugin-proposal-decorators@babel/plugin-syntax-dynamic-import@babel/plugin-syntax-import-meta@babel/plugin-transform-async-generator-functions@babel/plugin-transform-async-to-generator@babel/plugin-transform-class-properties@babel/plugin-transform-class-static-block@babel/plugin-transform-exponentiation-operator@babel/plugin-transform-for-of@babel/plugin-transform-object-rest-spread@babel/plugin-transform-private-methods@babel/plugin-transform-runtime@babel/preset-env@babel/preset-flow@babel/preset-react@babel/runtime@devexpress/bin-v8-flags-filter@devexpress/callsite-record@types/nodeaddressasync-exit-hookbabel-plugin-module-resolverbabel-plugin-syntax-trailing-function-commasbowsercallsitechaichalkchrome-remote-interfacecoffeescriptcommanderdebugdedentdeldevice-specsdevtools-protocoldiffelegant-spinneremail-validatoremitteryerror-stack-parserexecaget-os-infoglobbygraceful-fsgraphlibhttp-status-codeshumanize-durationimport-lazyindent-stringis-ciis-dockeris-globis-podmanis-streamjson5lodashlog-update-async-hookmake-dirmime-dbmomentmoment-duration-format-commonjsmustachenanoidos-familyparse5pifypinkiepngjspretty-hrtimepromisify-eventpromptsqrcode-terminalread-file-relativereplicatorresolve-cwdresolve-fromsanitize-filenamesemverset-cookie-parsersource-map-supportstrip-bomtestcafe-browser-toolstestcafe-hammerheadtestcafe-legacy-apitestcafe-reporter-jsontestcafe-reporter-listtestcafe-reporter-minimaltestcafe-reporter-spectestcafe-reporter-xunittestcafe-selector-generatortime-limit-promisetmptree-killtypescriptunquoteurl-to-options
Dev Dependencies
73
@ffmpeg-installer/ffmpeg@ffprobe-installer/ffprobe@rollup/plugin-alias@rollup/plugin-commonjs@rollup/plugin-inject@rollup/plugin-node-resolve@testcafe/publish-please@types/callsite@types/chai@types/debug@types/dedent@types/diff@types/json5@types/mime-db@types/mustache@types/prompts@types/semver@types/set-cookie-parser@types/source-map-support@types/useragent@typescript-eslint/eslint-plugin@typescript-eslint/parserbabel-plugin-add-module-exportsbasic-authbody-parserbrowserstack-connectorcallerchai-as-promisedchai-stringchrome-launcherconnectcorscross-envdom-walkescape-string-regexpeslinteslint-plugin-hammerheadeslint-plugin-no-only-testsexpressexpress-ntlmgulpgulp-babelgulp-clonegulp-datagulp-eslintgulp-lessgulp-ll-nextgulp-mocha-simplegulp-mustachegulp-qunit-harnessgulp-renamegulp-stepgulp-uglifyjs-yamllicense-checkermarkdownlintmerge-streamminimistmocha-reporter-spec-with-retriesmulteropenssl-self-signed-certificateproxyquirereactrecursive-copyrolluprollup-plugin-typescript2serve-staticsinonstack-chainstrip-ansitestcafe-browser-provider-browserstacktslibuglify-js
Automate end-to-end web testing with TestCafe, a Node.js-based testing framework.
TestCafe is free and as easy to use as 1-2-3:
1. Write your tests in JS or TypeScript.
2. Execute your tests.
3. View test results.
Homepage • Documentation • FAQ • Support
- Works on all popular environments: TestCafe runs on Windows, MacOS, and Linux. It supports desktop, mobile, remote and cloud browsers (UI or headless).
- 1 minute to set up: You do not need WebDriver or any other testing software. Install TestCafe with one command, and you are ready to test:
npm install -g testcafe - Free and open source: TestCafe is free to use under the MIT license. Plugins provide custom reports, integration with other tools, launching tests from IDE, etc. You can use the plugins made by the GitHub community or create your own.
Running a sample test in Safari
Table of contents
- Features
- TestCafe Studio: IDE for End-to-End Web Testing
- Getting Started
- Documentation
- Get Help
- Issue Tracker
- Stay in Touch
- Contributing
- Plugins
- Different Versions of TestCafe
- Badge
- License
- Creators
Features
Stable tests and no manual timeouts
TestCafe automatically waits for page loads and XHRs before the test starts and after each action.
It also features smart test actions and assertions that wait for page elements to appear.
You can change the maximum wait time.
If elements load faster, tests skip the timeout and continue.
Rapid test development tool
When you enable live mode, changes to test code immediately restart the test, and you instantly see the results.
Latest JS and TypeScript support
TestCafe supports the most recent JavaScript-related features, including ES2017 (async/await). You can also use TypeScript if you prefer a strongly typed language instead.
Detects JS errors in your code
TestCafe reports JS errors that it locates on a given webpage. Tests automatically fail if TestCafe encounters such errors.
You can, however, disable this option.
Concurrent test launch
TestCafe can open multiple instances of the same browser and run parallel tests (to help decrease test execution time).
PageObject pattern support
The TestCafe's Test API includes a high-level selector library, assertions, etc.
You can combine them to implement readable tests with the PageObject pattern.
1const macOSInput = Selector('.column').find('label').withText('MacOS').child('input');
Easy to include in a continuous integration system
You can run TestCafe from a console, and its reports can be viewed within CI systems (TeamCity, Jenkins, Travis & etc.)
Love TestCafe Open-source Edition? Want to Record Tests without Writing JavaScript or TypeScript Code?
TestCafe Studio: IDE for End-to-End Web Testing
TestCafe is the perfect choice for JavaScript developers and experienced Q&A teams. If you’d like to delegate testing to QA engineers and are looking for a code-free way to record and maintain tests compatible with your existing infrastructure, check out TestCafe Studio - a testing IDE built atop the open-source version of TestCafe.
Review the following article to learn how TestCafe Studio can fit into any workflow: What's Better than TestCafe? TestCafe Studio.
Record and Run a Test in TestCafe Studio
Getting Started
Installation
Ensure that you run Node.js version 16 or higher, and run the following command:
1npm install -g testcafe
Creating the Test
For this simple example, we will test the following page: https://devexpress.github.io/testcafe/example
Create a .js or .ts file on your computer. Remember that a .js or .ts file must maintain a specific structure: tests must be organized into fixtures. You can paste the following code to see the test in action:
1import { Selector } from 'testcafe'; // first import testcafe selectors 2 3fixture `Getting Started`// declare the fixture 4 .page `https://devexpress.github.io/testcafe/example`; // specify the start page 5 6 7//then create a test and place your code within it 8test('My first test', async t => { 9 await t 10 .typeText('#developer-name', 'John Smith') 11 .click('#submit-button') 12 13 // Use the assertion to check if actual header text equals expected text 14 .expect(Selector('#article-header').innerText).eql('Thank you, John Smith!'); 15});
Running the Test
Call the following command in a command shell. Specify the target browser and file path.
1testcafe chrome test1.js
TestCafe opens the browser and begins test execution.
Important: Make certain the browser tab that runs tests stays active. Do not minimize the browser window. Inactive tabs and minimized browser windows switch to lower resource consumption mode. In low consumption mode, tests may not execute correctly.
Viewing the Results
TestCafe outputs results into a command shell by default. See Reporters for more information. You can also use plugins to customize reports.
Read the Getting Started page for additional assistance.
Documentation
Visit the following webpage to review our online help system: Documentation.
Get Help
Join the TestCafe community on Stack Overflow. Ask and answer questions using the TestCafe tag.
Issue Tracker
Use our GitHub issues page to report bugs and suggest enhancements.
Stay in Touch
Follow us on Twitter. We post TestCafe news and updates.
Contributing
Read our Contributing Guide to learn how to contribute to the project.
To create your own plugin for TestCafe, you can use these plugin generators:
- Build a browser provider to set up tests on your on-premises server farm, to use a cloud testing platform, or to start your local browsers in a special way. Use this Yeoman generator to write only a few lines of code.
- To build a custom reporter with your formatting and style, check out this generator.
If you want your plugin to be listed below, send us a note in a Github issue.
Thanks to all of our contributors – We appreciate your commitment to the TestCafe community.
 |  |  |  |  |  |
|---|---|---|---|---|---|
| aha-oretama | ai | aleks-pro | Aleksey28 | AlexanderMoiseev | AlexanderMoskovkin |
 |  |  |  |  |  |
|---|---|---|---|---|---|
| alexey-lin | AlexKamaev | alexphilin | AlexSkorkin | alexwybraniec | AnastasiaIvanova8 |
 |  |  |  |  |  |
|---|---|---|---|---|---|
| andrewbranch | AndreyBelym | AndyWendt | AnnaKondratova | anthophobiac | Artem-Babich |
 |  |  |  |  |  |
|---|---|---|---|---|---|
| Arthy000 | augustomezencio-hotmart | bdwain | benmonro | beyondcompute | bill-looby-i |
 |  |  |  |  |  |
|---|---|---|---|---|---|
| bsmithb2 | caseyWebb | cdrini | cgfarmer4 | Chris-Greaves | churkin |
 |  |  |  |  |  |
|---|---|---|---|---|---|
| dej611 | DIRECTcut | Dmitry-Ostashev | eignatyev | ericyd | Farfurix |
 |  |  |  |  |  |
|---|---|---|---|---|---|
| flora8984461 | GeoffreyBooth | helen-dikareva | honsq90 | infctr | inikulin |
 |  |  |  |  |  |
|---|---|---|---|---|---|
| Ivan-Katovich | jamesgeorge007 | jaypea | josephmalam | kanhaiya15 | karolnowinski |
 |  |  |  |  |  |
|---|---|---|---|---|---|
| kirovboris | kisrefod | LavrovArtem | link89 | lzxb | macdonaldr93 |
 |  |  |  |  |  |
|---|---|---|---|---|---|
| MargaritaLoseva | Marketionist | MatthewNielsen27 | mattkubej | mattmanske | mcjim |
 |  |  |  |  |  |
|---|---|---|---|---|---|
| miherlosev | morfey13 | mostlyfabulous | murajun1978 | NickCis | Nuarat |
 |  |  |  |  |  |
|---|---|---|---|---|---|
| Ogurecher | PayBas | pgorny | pietrovich | radarhere | raspo |
 |  |  |  |  |  |
|---|---|---|---|---|---|
| rbardini | renancouto | rob4629 | rueyaa332266 | sgrillon14 | smockle |
 |  |  |  |  |  |
|---|---|---|---|---|---|
| stefanschenk | superroma | sylbru | taiki-fw | testcafe-build-bot | theghostbel |
 |  |  |  |  |  |
|---|---|---|---|---|---|
| titerman | tobiasbueschel | varunkumar | VasilyStrelyaev | vitalics | Vla8islav |
 |  |  |  |  |  |
|---|---|---|---|---|---|
| wentwrong | b12031106 | danielroe | danieltroger | DevSide | intermike |
 |  |  |  |  |
|---|---|---|---|---|
| kirillsalikhov | michaelficarra | rr13k | tomashanacek | TrevorKarjanis |
Plugins
TestCafe developers and community members made these plugins:
-
Browser Providers
Use TestCafe with cloud browser providers and emulators.- SauceLabs provider (by @AndreyBelym)
- BrowserStack provider (by @AndreyBelym)
- CrossBrowserTesting provider (by @sijosyn)
- LambdaTest provider (by @kanhaiya15)
- Nightmare headless provider (by @ryx)
- Testingbot provider (by @testingbot)
- fbsimctl iOS emulator (by @ents24)
- Electron (by @AndreyBelym)
- Puppeteer (by @jdobosz)
- Puppeteer Chromium (by @stefanschenk)
-
Framework-Specific Selectors
Work with page elements in a way that is native to your framework.- React (by @kirovboris)
- Angular (by @miherlosev)
- Vue (by @miherlosev)
- Aurelia (by @miherlosev)
-
Plugins for Task Runners
Integrate TestCafe into your project's workflow. -
Custom Reporters
View test results in different formats.- TeamCity (by @nirsky)
- Slack (by @Shafied)
- NUnit (by @AndreyBelym)
- TimeCafe (by @jimthedev)
- Tesults (by @Tesults)
-
GitHub Action
Run TestCafe tests in GitHub Actions workflows. -
Test Accessibility
Find accessibility issues in your web app. -
IDE Plugins
Run tests and view results from your favorite IDE.- TestCafe Test Runner for Visual Studio Code (by @romanresh)
- TestLatte for Visual Studio Code (by @Selminha)
- TestCafe runner for Webstorm (by @lilbaek)
- Code snippets for TestCafe (by @hdorgeval)
- SublimeText (by @churkin)
-
ESLint
Use ESLint when writing and editing TestCafe tests.- ESLint plugin (by @miherlosev)
-
Cucumber Support
Create and run tests that use the Cucumber syntax.- gherkin-testcafe (by @kiwigrid, now maintained by @Arthy000) - run your Cucumber tests with TestCafe as a backend. Requires CucumberJS.
- testcafe-cucumber-steps (by @Marketionist) - provides predefined Cucumber steps for gherkin-testcafe.
Different Versions of TestCafe
| TestCafe | TestCafe Studio | |
|---|---|---|
| No need for WebDriver, browser plugins or other tools | ✓ | ✓ |
| Cross-platform and cross-browser out of the box | ✓ | ✓ |
| Write tests in the latest JavaScript or TypeScript | ✓ | ✓ |
| Clear and flexible API supports ES6 and PageModel pattern | ✓ | ✓ |
| Stable tests due to the Smart Assertion Query Mechanism | ✓ | ✓ |
| Tests run fast due to intelligent Automatic Waiting Mechanism and Concurrent Test Execution | ✓ | ✓ |
| Custom reporter plugins | ✓ | ✓ |
| Use third-party Node.js modules in test scripts | ✓ | ✓ |
| Integration with popular CI systems | ✓ | ✓* |
| Free and open-source | ✓ | |
| Visual Test Recorder | ✓ | |
| Interactive Test Editor | ✓ | |
| Automatic Selector Generation | ✓ | |
| Run Configuration Manager | ✓ | |
| IDE-like GUI | ✓ |
* You can use open-source TestCafe to run TestCafe Studio tests in CI systems.
Badge
Show everyone you are using TestCafe: 
To display this badge, add the following code to your repository readme:
1<a href="https://github.com/DevExpress/testcafe"> 2 <img alt="Tested with TestCafe" src="https://img.shields.io/badge/tested%20with-TestCafe-2fa4cf.svg"> 3</a>
Thanks to BrowserStack
We are grateful to BrowserStack for providing the infrastructure that we use to test code in this repository.
License
Code released under the MIT license.
Creators
Developer Express Inc. (https://devexpress.com)
No vulnerabilities found.
Reason
2 commit(s) and 12 issue activity found in the last 90 days -- score normalized to 10
Reason
all changesets reviewed
Reason
no dangerous workflow patterns detected
Reason
license file detected
Details
- Info: project has a license file: LICENSE:0
- Info: FSF or OSI recognized license: MIT License: LICENSE:0
Reason
no binaries found in the repo
Reason
packaging workflow detected
Details
- Info: Project packages its releases by way of GitHub Actions.: .github/workflows/publish.yml:8
Reason
security policy file detected
Details
- Info: security policy file detected: security.md:1
- Info: Found linked content: security.md:1
- Warn: One or no descriptive hints of disclosure, vulnerability, and/or timelines in security policy
- Info: Found text in security policy: security.md:1
Reason
7 existing vulnerabilities detected
Details
- Warn: Project is vulnerable to: GHSA-968p-4wvh-cqc8
- Warn: Project is vulnerable to: GHSA-jr5f-v2jv-69x6
- Warn: Project is vulnerable to: GHSA-grv7-fg5c-xmjg
- Warn: Project is vulnerable to: GHSA-2p57-rm9w-gvfp
- Warn: Project is vulnerable to: GHSA-952p-6rrq-rcjv
- Warn: Project is vulnerable to: GHSA-mwcw-c2x4-8c55
- Warn: Project is vulnerable to: GHSA-pq67-2wwv-3xjx
Reason
no effort to earn an OpenSSF best practices badge detected
Reason
detected GitHub workflow tokens with excessive permissions
Details
- Warn: jobLevel 'contents' permission set to 'write': .github/workflows/check-security-alerts.yml:31
- Warn: jobLevel 'contents' permission set to 'write': .github/workflows/handle-stale.yml:28
- Warn: no topLevel permission defined: .github/workflows/check-security-alerts.yml:1
- Warn: no topLevel permission defined: .github/workflows/deploy-to-artifacts.yml:1
- Warn: no topLevel permission defined: .github/workflows/handle-labels.yml:1
- Warn: no topLevel permission defined: .github/workflows/handle-stale.yml:1
- Warn: no topLevel permission defined: .github/workflows/helper-rebase.yml:1
- Warn: no topLevel permission defined: .github/workflows/license-check.yml:1
- Warn: no topLevel permission defined: .github/workflows/no-response.yml:1
- Warn: no topLevel permission defined: .github/workflows/publish.yml:1
- Warn: no topLevel permission defined: .github/workflows/release-commenter.yml:1
- Warn: no topLevel permission defined: .github/workflows/release-lock.yml:1
- Warn: no topLevel permission defined: .github/workflows/request-deploy.yml:1
- Warn: no topLevel permission defined: .github/workflows/test-client-desktop.yml:1
- Warn: no topLevel permission defined: .github/workflows/test-client-mobile.yml:1
- Warn: no topLevel permission defined: .github/workflows/test-client.yml:1
- Warn: no topLevel permission defined: .github/workflows/test-dependencies.yml:1
- Warn: no topLevel permission defined: .github/workflows/test-functional-docker.yml:1
- Warn: no topLevel permission defined: .github/workflows/test-functional-local-chrome.yml:1
- Warn: no topLevel permission defined: .github/workflows/test-functional-local-edge.yml:1
- Warn: no topLevel permission defined: .github/workflows/test-functional-local-esm.yml:1
- Warn: no topLevel permission defined: .github/workflows/test-functional-local-firefox.yml:1
- Warn: no topLevel permission defined: .github/workflows/test-functional-local-headed-browsers.yml:1
- Warn: no topLevel permission defined: .github/workflows/test-functional-local-legacy.yml:1
- Warn: no topLevel permission defined: .github/workflows/test-functional-local-multiple-windows-na.yml:1
- Warn: no topLevel permission defined: .github/workflows/test-functional-local-multiple-windows.yml:1
- Warn: no topLevel permission defined: .github/workflows/test-functional-local-native-automation.yml:1
- Warn: no topLevel permission defined: .github/workflows/test-functional-local-safari.yml:1
- Warn: no topLevel permission defined: .github/workflows/test-functional-remote-mobile.yml:1
- Warn: no topLevel permission defined: .github/workflows/test-functional.yml:1
- Warn: no topLevel permission defined: .github/workflows/test-server-docker.yml:1
- Warn: no topLevel permission defined: .github/workflows/test-server-latest.yml:1
- Warn: no topLevel permission defined: .github/workflows/test-server-minimal.yml:1
- Warn: no topLevel permission defined: .github/workflows/test-server.yml:1
Reason
dependency not pinned by hash detected -- score normalized to 0
Details
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/check-security-alerts.yml:12: update your workflow using https://app.stepsecurity.io/secureworkflow/DevExpress/testcafe/check-security-alerts.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/check-security-alerts.yml:13: update your workflow using https://app.stepsecurity.io/secureworkflow/DevExpress/testcafe/check-security-alerts.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/check-security-alerts.yml:16: update your workflow using https://app.stepsecurity.io/secureworkflow/DevExpress/testcafe/check-security-alerts.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/check-security-alerts.yml:33: update your workflow using https://app.stepsecurity.io/secureworkflow/DevExpress/testcafe/check-security-alerts.yml/master?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/check-security-alerts.yml:34: update your workflow using https://app.stepsecurity.io/secureworkflow/DevExpress/testcafe/check-security-alerts.yml/master?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/deploy-to-artifacts.yml:21: update your workflow using https://app.stepsecurity.io/secureworkflow/DevExpress/testcafe/deploy-to-artifacts.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/deploy-to-artifacts.yml:31: update your workflow using https://app.stepsecurity.io/secureworkflow/DevExpress/testcafe/deploy-to-artifacts.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/deploy-to-artifacts.yml:36: update your workflow using https://app.stepsecurity.io/secureworkflow/DevExpress/testcafe/deploy-to-artifacts.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/deploy-to-artifacts.yml:44: update your workflow using https://app.stepsecurity.io/secureworkflow/DevExpress/testcafe/deploy-to-artifacts.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/deploy-to-artifacts.yml:52: update your workflow using https://app.stepsecurity.io/secureworkflow/DevExpress/testcafe/deploy-to-artifacts.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/deploy-to-artifacts.yml:60: update your workflow using https://app.stepsecurity.io/secureworkflow/DevExpress/testcafe/deploy-to-artifacts.yml/master?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/deploy-to-artifacts.yml:65: update your workflow using https://app.stepsecurity.io/secureworkflow/DevExpress/testcafe/deploy-to-artifacts.yml/master?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/deploy-to-artifacts.yml:74: update your workflow using https://app.stepsecurity.io/secureworkflow/DevExpress/testcafe/deploy-to-artifacts.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/deploy-to-artifacts.yml:78: update your workflow using https://app.stepsecurity.io/secureworkflow/DevExpress/testcafe/deploy-to-artifacts.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/deploy-to-artifacts.yml:85: update your workflow using https://app.stepsecurity.io/secureworkflow/DevExpress/testcafe/deploy-to-artifacts.yml/master?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/deploy-to-artifacts.yml:90: update your workflow using https://app.stepsecurity.io/secureworkflow/DevExpress/testcafe/deploy-to-artifacts.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/deploy-to-artifacts.yml:100: update your workflow using https://app.stepsecurity.io/secureworkflow/DevExpress/testcafe/deploy-to-artifacts.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/deploy-to-artifacts.yml:103: update your workflow using https://app.stepsecurity.io/secureworkflow/DevExpress/testcafe/deploy-to-artifacts.yml/master?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/deploy-to-artifacts.yml:153: update your workflow using https://app.stepsecurity.io/secureworkflow/DevExpress/testcafe/deploy-to-artifacts.yml/master?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/handle-labels.yml:13: update your workflow using https://app.stepsecurity.io/secureworkflow/DevExpress/testcafe/handle-labels.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/handle-stale.yml:10: update your workflow using https://app.stepsecurity.io/secureworkflow/DevExpress/testcafe/handle-stale.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/handle-stale.yml:30: update your workflow using https://app.stepsecurity.io/secureworkflow/DevExpress/testcafe/handle-stale.yml/master?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/handle-stale.yml:31: update your workflow using https://app.stepsecurity.io/secureworkflow/DevExpress/testcafe/handle-stale.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/helper-rebase.yml:17: update your workflow using https://app.stepsecurity.io/secureworkflow/DevExpress/testcafe/helper-rebase.yml/master?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/helper-rebase.yml:22: update your workflow using https://app.stepsecurity.io/secureworkflow/DevExpress/testcafe/helper-rebase.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/license-check.yml:21: update your workflow using https://app.stepsecurity.io/secureworkflow/DevExpress/testcafe/license-check.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/license-check.yml:24: update your workflow using https://app.stepsecurity.io/secureworkflow/DevExpress/testcafe/license-check.yml/master?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/no-response.yml:16: update your workflow using https://app.stepsecurity.io/secureworkflow/DevExpress/testcafe/no-response.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/publish.yml:30: update your workflow using https://app.stepsecurity.io/secureworkflow/DevExpress/testcafe/publish.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/publish.yml:34: update your workflow using https://app.stepsecurity.io/secureworkflow/DevExpress/testcafe/publish.yml/master?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/publish.yml:38: update your workflow using https://app.stepsecurity.io/secureworkflow/DevExpress/testcafe/publish.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/publish.yml:13: update your workflow using https://app.stepsecurity.io/secureworkflow/DevExpress/testcafe/publish.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/publish.yml:17: update your workflow using https://app.stepsecurity.io/secureworkflow/DevExpress/testcafe/publish.yml/master?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/release-commenter.yml:10: update your workflow using https://app.stepsecurity.io/secureworkflow/DevExpress/testcafe/release-commenter.yml/master?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/release-lock.yml:15: update your workflow using https://app.stepsecurity.io/secureworkflow/DevExpress/testcafe/release-lock.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/request-deploy.yml:19: update your workflow using https://app.stepsecurity.io/secureworkflow/DevExpress/testcafe/request-deploy.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/request-deploy.yml:36: update your workflow using https://app.stepsecurity.io/secureworkflow/DevExpress/testcafe/request-deploy.yml/master?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/test-client.yml:67: update your workflow using https://app.stepsecurity.io/secureworkflow/DevExpress/testcafe/test-client.yml/master?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/test-client.yml:70: update your workflow using https://app.stepsecurity.io/secureworkflow/DevExpress/testcafe/test-client.yml/master?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/test-client.yml:26: update your workflow using https://app.stepsecurity.io/secureworkflow/DevExpress/testcafe/test-client.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/test-client.yml:30: update your workflow using https://app.stepsecurity.io/secureworkflow/DevExpress/testcafe/test-client.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/test-client.yml:34: update your workflow using https://app.stepsecurity.io/secureworkflow/DevExpress/testcafe/test-client.yml/master?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/test-client.yml:38: update your workflow using https://app.stepsecurity.io/secureworkflow/DevExpress/testcafe/test-client.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/test-client.yml:46: update your workflow using https://app.stepsecurity.io/secureworkflow/DevExpress/testcafe/test-client.yml/master?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/test-client.yml:57: update your workflow using https://app.stepsecurity.io/secureworkflow/DevExpress/testcafe/test-client.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/test-dependencies.yml:16: update your workflow using https://app.stepsecurity.io/secureworkflow/DevExpress/testcafe/test-dependencies.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/test-dependencies.yml:17: update your workflow using https://app.stepsecurity.io/secureworkflow/DevExpress/testcafe/test-dependencies.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/test-functional.yml:54: update your workflow using https://app.stepsecurity.io/secureworkflow/DevExpress/testcafe/test-functional.yml/master?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/test-functional.yml:80: update your workflow using https://app.stepsecurity.io/secureworkflow/DevExpress/testcafe/test-functional.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/test-functional.yml:94: update your workflow using https://app.stepsecurity.io/secureworkflow/DevExpress/testcafe/test-functional.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/test-functional.yml:98: update your workflow using https://app.stepsecurity.io/secureworkflow/DevExpress/testcafe/test-functional.yml/master?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/test-functional.yml:109: update your workflow using https://app.stepsecurity.io/secureworkflow/DevExpress/testcafe/test-functional.yml/master?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/test-functional.yml:113: update your workflow using https://app.stepsecurity.io/secureworkflow/DevExpress/testcafe/test-functional.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/test-functional.yml:124: update your workflow using https://app.stepsecurity.io/secureworkflow/DevExpress/testcafe/test-functional.yml/master?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/test-functional.yml:145: update your workflow using https://app.stepsecurity.io/secureworkflow/DevExpress/testcafe/test-functional.yml/master?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/test-functional.yml:156: update your workflow using https://app.stepsecurity.io/secureworkflow/DevExpress/testcafe/test-functional.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/test-functional.yml:162: update your workflow using https://app.stepsecurity.io/secureworkflow/DevExpress/testcafe/test-functional.yml/master?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/test-functional.yml:167: update your workflow using https://app.stepsecurity.io/secureworkflow/DevExpress/testcafe/test-functional.yml/master?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/test-functional.yml:177: update your workflow using https://app.stepsecurity.io/secureworkflow/DevExpress/testcafe/test-functional.yml/master?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/test-functional.yml:180: update your workflow using https://app.stepsecurity.io/secureworkflow/DevExpress/testcafe/test-functional.yml/master?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/test-server.yml:28: update your workflow using https://app.stepsecurity.io/secureworkflow/DevExpress/testcafe/test-server.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/test-server.yml:32: update your workflow using https://app.stepsecurity.io/secureworkflow/DevExpress/testcafe/test-server.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/test-server.yml:36: update your workflow using https://app.stepsecurity.io/secureworkflow/DevExpress/testcafe/test-server.yml/master?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/test-server.yml:40: update your workflow using https://app.stepsecurity.io/secureworkflow/DevExpress/testcafe/test-server.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/test-server.yml:49: update your workflow using https://app.stepsecurity.io/secureworkflow/DevExpress/testcafe/test-server.yml/master?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/test-server.yml:67: update your workflow using https://app.stepsecurity.io/secureworkflow/DevExpress/testcafe/test-server.yml/master?enable=pin
- Warn: containerImage not pinned by hash: docker/Dockerfile:1: pin your Docker image by updating alpine:edge to alpine:edge@sha256:115729ec5cb049ba6359c3ab005ac742012d92bbaa5b8bc1a878f1e8f62c0cb8
- Warn: containerImage not pinned by hash: test/docker/Dockerfile:2
- Warn: npmCommand not pinned by hash: docker/Dockerfile:19-24
- Warn: npmCommand not pinned by hash: test/docker/Dockerfile:7
- Warn: npmCommand not pinned by hash: .github/workflows/deploy-to-artifacts.yml:40
- Warn: npmCommand not pinned by hash: .github/workflows/license-check.yml:30
- Warn: npmCommand not pinned by hash: .github/workflows/license-check.yml:39
- Warn: npmCommand not pinned by hash: .github/workflows/publish.yml:22
- Warn: npmCommand not pinned by hash: .github/workflows/publish.yml:43
- Warn: npmCommand not pinned by hash: .github/workflows/test-dependencies.yml:19
- Warn: npmCommand not pinned by hash: .github/workflows/test-functional.yml:135
- Warn: npmCommand not pinned by hash: .github/workflows/test-server.yml:60
- Info: 0 out of 37 GitHub-owned GitHubAction dependencies pinned
- Info: 0 out of 29 third-party GitHubAction dependencies pinned
- Info: 0 out of 2 containerImage dependencies pinned
- Info: 3 out of 13 npmCommand dependencies pinned
Reason
project is not fuzzed
Details
- Warn: no fuzzer integrations found
Reason
SAST tool is not run on all commits -- score normalized to 0
Details
- Warn: 2 commits out of 30 are checked with a SAST tool
Score
6
/10
Last Scanned on 2025-05-19
The Open Source Security Foundation is a cross-industry collaboration to improve the security of open source software (OSS). The Scorecard provides security health metrics for open source projects.
Learn More