An HTTP/1.1 client, written from scratch for Node.js
Installations
npm install undici-types
Score
100
Supply Chain
71.6
Quality
92.6
Maintenance
100
Vulnerability
100
License
Releases
Developer
Developer Guide
Module System
Unable to determine the module system for this package.
Min. Node Version
Typescript Support
Yes
Node Version
20.18.0
NPM Version
10.8.2
Statistics
6,274 Stars
3,227 Commits
551 Forks
52 Watching
74 Branches
299 Contributors
Updated on 28 Nov 2024
Languages
JavaScript (96.71%)
TypeScript (3.28%)
Shell (0.01%)
Total Downloads
Cumulative downloads
Total Downloads
1,883,802,475
Last day
2.4%
9,529,350
Compared to previous day
Last week
5.4%
52,258,409
Compared to previous week
Last month
-18.8%
214,358,439
Compared to previous month
Last year
1,338.5%
1,761,357,129
Compared to previous year
Daily Downloads
Weekly Downloads
Monthly Downloads
Yearly Downloads
No dependencies detected.
undici
An HTTP/1.1 client, written from scratch for Node.js.
Undici means eleven in Italian. 1.1 -> 11 -> Eleven -> Undici. It is also a Stranger Things reference.
How to get involved
Have a question about using Undici? Open a Q&A Discussion or join our official OpenJS Slack channel.
Looking to contribute? Start by reading the contributing guide
Install
npm i undici
Benchmarks
The benchmark is a simple getting data example using a 50 TCP connections with a pipelining depth of 10 running on Node 22.11.0.
┌────────────────────────┬─────────┬────────────────────┬────────────┬─────────────────────────┐
│ Tests │ Samples │ Result │ Tolerance │ Difference with slowest │
├────────────────────────┼─────────┼────────────────────┼────────────┼─────────────────────────┤
│ 'axios' │ 15 │ '5708.26 req/sec' │ '± 2.91 %' │ '-' │
│ 'http - no keepalive' │ 10 │ '5809.80 req/sec' │ '± 2.30 %' │ '+ 1.78 %' │
│ 'request' │ 30 │ '5828.80 req/sec' │ '± 2.91 %' │ '+ 2.11 %' │
│ 'undici - fetch' │ 40 │ '5903.78 req/sec' │ '± 2.87 %' │ '+ 3.43 %' │
│ 'node-fetch' │ 10 │ '5945.40 req/sec' │ '± 2.13 %' │ '+ 4.15 %' │
│ 'got' │ 35 │ '6511.45 req/sec' │ '± 2.84 %' │ '+ 14.07 %' │
│ 'http - keepalive' │ 65 │ '9193.24 req/sec' │ '± 2.92 %' │ '+ 61.05 %' │
│ 'superagent' │ 35 │ '9339.43 req/sec' │ '± 2.95 %' │ '+ 63.61 %' │
│ 'undici - pipeline' │ 50 │ '13364.62 req/sec' │ '± 2.93 %' │ '+ 134.13 %' │
│ 'undici - stream' │ 95 │ '18245.36 req/sec' │ '± 2.99 %' │ '+ 219.63 %' │
│ 'undici - request' │ 50 │ '18340.17 req/sec' │ '± 2.84 %' │ '+ 221.29 %' │
│ 'undici - dispatch' │ 40 │ '22234.42 req/sec' │ '± 2.94 %' │ '+ 289.51 %' │
└────────────────────────┴─────────┴────────────────────┴────────────┴─────────────────────────┘
Quick Start
1import { request } from 'undici' 2 3const { 4 statusCode, 5 headers, 6 trailers, 7 body 8} = await request('http://localhost:3000/foo') 9 10console.log('response received', statusCode) 11console.log('headers', headers) 12 13for await (const data of body) { console.log('data', data) } 14 15console.log('trailers', trailers)
Body Mixins
The body
mixins are the most common way to format the request/response body. Mixins include:
[!NOTE] The body returned from
undici.request
does not implement.formData()
.
Example usage:
1import { request } from 'undici' 2 3const { 4 statusCode, 5 headers, 6 trailers, 7 body 8} = await request('http://localhost:3000/foo') 9 10console.log('response received', statusCode) 11console.log('headers', headers) 12console.log('data', await body.json()) 13console.log('trailers', trailers)
Note: Once a mixin has been called then the body cannot be reused, thus calling additional mixins on .body
, e.g. .body.json(); .body.text()
will result in an error TypeError: unusable
being thrown and returned through the Promise
rejection.
Should you need to access the body
in plain-text after using a mixin, the best practice is to use the .text()
mixin first and then manually parse the text to the desired format.
For more information about their behavior, please reference the body mixin from the Fetch Standard.
Common API Methods
This section documents our most commonly used API methods. Additional APIs are documented in their own files within the docs folder and are accessible via the navigation list on the left side of the docs site.
undici.request([url, options]): Promise
Arguments:
- url
string | URL | UrlObject
- options
RequestOptions
- dispatcher
Dispatcher
- Default: getGlobalDispatcher - method
String
- Default:PUT
ifoptions.body
, otherwiseGET
- dispatcher
Returns a promise with the result of the Dispatcher.request
method.
Calls options.dispatcher.request(options)
.
See Dispatcher.request for more details, and request examples for examples.
undici.stream([url, options, ]factory): Promise
Arguments:
- url
string | URL | UrlObject
- options
StreamOptions
- dispatcher
Dispatcher
- Default: getGlobalDispatcher - method
String
- Default:PUT
ifoptions.body
, otherwiseGET
- dispatcher
- factory
Dispatcher.stream.factory
Returns a promise with the result of the Dispatcher.stream
method.
Calls options.dispatcher.stream(options, factory)
.
See Dispatcher.stream for more details.
undici.pipeline([url, options, ]handler): Duplex
Arguments:
- url
string | URL | UrlObject
- options
PipelineOptions
- dispatcher
Dispatcher
- Default: getGlobalDispatcher - method
String
- Default:PUT
ifoptions.body
, otherwiseGET
- dispatcher
- handler
Dispatcher.pipeline.handler
Returns: stream.Duplex
Calls options.dispatch.pipeline(options, handler)
.
See Dispatcher.pipeline for more details.
undici.connect([url, options]): Promise
Starts two-way communications with the requested resource using HTTP CONNECT.
Arguments:
- url
string | URL | UrlObject
- options
ConnectOptions
- dispatcher
Dispatcher
- Default: getGlobalDispatcher
- dispatcher
- callback
(err: Error | null, data: ConnectData | null) => void
(optional)
Returns a promise with the result of the Dispatcher.connect
method.
Calls options.dispatch.connect(options)
.
See Dispatcher.connect for more details.
undici.fetch(input[, init]): Promise
Implements fetch.
- https://developer.mozilla.org/en-US/docs/Web/API/WindowOrWorkerGlobalScope/fetch
- https://fetch.spec.whatwg.org/#fetch-method
Basic usage example:
1import { fetch } from 'undici' 2 3 4const res = await fetch('https://example.com') 5const json = await res.json() 6console.log(json)
You can pass an optional dispatcher to fetch
as:
1import { fetch, Agent } from 'undici' 2 3const res = await fetch('https://example.com', { 4 // Mocks are also supported 5 dispatcher: new Agent({ 6 keepAliveTimeout: 10, 7 keepAliveMaxTimeout: 10 8 }) 9}) 10const json = await res.json() 11console.log(json)
request.body
A body can be of the following types:
- ArrayBuffer
- ArrayBufferView
- AsyncIterables
- Blob
- Iterables
- String
- URLSearchParams
- FormData
In this implementation of fetch, request.body
now accepts Async Iterables
. It is not present in the Fetch Standard.
1import { fetch } from 'undici' 2 3const data = { 4 async *[Symbol.asyncIterator]() { 5 yield 'hello' 6 yield 'world' 7 }, 8} 9 10await fetch('https://example.com', { body: data, method: 'POST', duplex: 'half' })
FormData besides text data and buffers can also utilize streams via Blob objects:
1import { openAsBlob } from 'node:fs' 2 3const file = await openAsBlob('./big.csv') 4const body = new FormData() 5body.set('file', file, 'big.csv') 6 7await fetch('http://example.com', { method: 'POST', body })
request.duplex
'half'
In this implementation of fetch, request.duplex
must be set if request.body
is ReadableStream
or Async Iterables
, however, even though the value must be set to 'half'
, it is actually a full duplex. For more detail refer to the Fetch Standard.
response.body
Nodejs has two kinds of streams: web streams, which follow the API of the WHATWG web standard found in browsers, and an older Node-specific streams API. response.body
returns a readable web stream. If you would prefer to work with a Node stream you can convert a web stream using .fromWeb()
.
1import { fetch } from 'undici' 2import { Readable } from 'node:stream' 3 4const response = await fetch('https://example.com') 5const readableWebStream = response.body 6const readableNodeStream = Readable.fromWeb(readableWebStream)
Specification Compliance
This section documents parts of the Fetch Standard that Undici does not support or does not fully implement.
Garbage Collection
The Fetch Standard allows users to skip consuming the response body by relying on garbage collection to release connection resources. Undici does not do the same. Therefore, it is important to always either consume or cancel the response body.
Garbage collection in Node is less aggressive and deterministic (due to the lack of clear idle periods that browsers have through the rendering refresh rate) which means that leaving the release of connection resources to the garbage collector can lead to excessive connection usage, reduced performance (due to less connection re-use), and even stalls or deadlocks when running out of connections.
1// Do 2const headers = await fetch(url) 3 .then(async res => { 4 for await (const chunk of res.body) { 5 // force consumption of body 6 } 7 return res.headers 8 }) 9 10// Do not 11const headers = await fetch(url) 12 .then(res => res.headers)
However, if you want to get only headers, it might be better to use HEAD
request method. Usage of this method will obviate the need for consumption or cancelling of the response body. See MDN - HTTP - HTTP request methods - HEAD for more details.
1const headers = await fetch(url, { method: 'HEAD' }) 2 .then(res => res.headers)
Forbidden and Safelisted Header Names
- https://fetch.spec.whatwg.org/#cors-safelisted-response-header-name
- https://fetch.spec.whatwg.org/#forbidden-header-name
- https://fetch.spec.whatwg.org/#forbidden-response-header-name
- https://github.com/wintercg/fetch/issues/6
The Fetch Standard requires implementations to exclude certain headers from requests and responses. In browser environments, some headers are forbidden so the user agent remains in full control over them. In Undici, these constraints are removed to give more control to the user.
undici.upgrade([url, options]): Promise
Upgrade to a different protocol. See MDN - HTTP - Protocol upgrade mechanism for more details.
Arguments:
- url
string | URL | UrlObject
- options
UpgradeOptions
- dispatcher
Dispatcher
- Default: getGlobalDispatcher
- dispatcher
- callback
(error: Error | null, data: UpgradeData) => void
(optional)
Returns a promise with the result of the Dispatcher.upgrade
method.
Calls options.dispatcher.upgrade(options)
.
See Dispatcher.upgrade for more details.
undici.setGlobalDispatcher(dispatcher)
- dispatcher
Dispatcher
Sets the global dispatcher used by Common API Methods.
undici.getGlobalDispatcher()
Gets the global dispatcher used by Common API Methods.
Returns: Dispatcher
undici.setGlobalOrigin(origin)
- origin
string | URL | undefined
Sets the global origin used in fetch
.
If undefined
is passed, the global origin will be reset. This will cause Response.redirect
, new Request()
, and fetch
to throw an error when a relative path is passed.
1setGlobalOrigin('http://localhost:3000') 2 3const response = await fetch('/api/ping') 4 5console.log(response.url) // http://localhost:3000/api/ping
undici.getGlobalOrigin()
Gets the global origin used in fetch
.
Returns: URL
UrlObject
- port
string | number
(optional) - path
string
(optional) - pathname
string
(optional) - hostname
string
(optional) - origin
string
(optional) - protocol
string
(optional) - search
string
(optional)
Specification Compliance
This section documents parts of the HTTP/1.1 specification that Undici does not support or does not fully implement.
Expect
Undici does not support the Expect
request header field. The request
body is always immediately sent and the 100 Continue
response will be
ignored.
Refs: https://tools.ietf.org/html/rfc7231#section-5.1.1
Pipelining
Undici will only use pipelining if configured with a pipelining
factor
greater than 1
. Also it is important to pass blocking: false
to the
request options to properly pipeline requests.
Undici always assumes that connections are persistent and will immediately pipeline requests, without checking whether the connection is persistent. Hence, automatic fallback to HTTP/1.0 or HTTP/1.1 without pipelining is not supported.
Undici will immediately pipeline when retrying requests after a failed connection. However, Undici will not retry the first remaining requests in the prior pipeline and instead error the corresponding callback/promise/stream.
Undici will abort all running requests in the pipeline when any of them are aborted.
- Refs: https://tools.ietf.org/html/rfc2616#section-8.1.2.2
- Refs: https://tools.ietf.org/html/rfc7230#section-6.3.2
Manual Redirect
Since it is not possible to manually follow an HTTP redirect on the server-side,
Undici returns the actual response instead of an opaqueredirect
filtered one
when invoked with a manual
redirect. This aligns fetch()
with the other
implementations in Deno and Cloudflare Workers.
Refs: https://fetch.spec.whatwg.org/#atomic-http-redirect-handling
Workarounds
Network address family autoselection.
If you experience problem when connecting to a remote server that is resolved by your DNS servers to a IPv6 (AAAA record)
first, there are chances that your local router or ISP might have problem connecting to IPv6 networks. In that case
undici will throw an error with code UND_ERR_CONNECT_TIMEOUT
.
If the target server resolves to both a IPv6 and IPv4 (A records) address and you are using a compatible Node version
(18.3.0 and above), you can fix the problem by providing the autoSelectFamily
option (support by both undici.request
and undici.Agent
) which will enable the family autoselection algorithm when establishing the connection.
Collaborators
- Daniele Belardi, https://www.npmjs.com/~dnlup
- Ethan Arrowood, https://www.npmjs.com/~ethan_arrowood
- Matteo Collina, https://www.npmjs.com/~matteo.collina
- Matthew Aitken, https://www.npmjs.com/~khaf
- Robert Nagy, https://www.npmjs.com/~ronag
- Szymon Marczak, https://www.npmjs.com/~szmarczak
- Tomas Della Vedova, https://www.npmjs.com/~delvedor
Releasers
- Ethan Arrowood, https://www.npmjs.com/~ethan_arrowood
- Matteo Collina, https://www.npmjs.com/~matteo.collina
- Robert Nagy, https://www.npmjs.com/~ronag
- Matthew Aitken, https://www.npmjs.com/~khaf
License
MIT
No vulnerabilities found.
Reason
25 out of 25 merged PRs checked by a CI test -- score normalized to 10
Reason
project has 81 contributing companies or organizations
Details
- Info: oauth-wg contributor org/company found, pnpm contributor org/company found, web-platform-tests contributor org/company found, pillarjs contributor org/company found, auth0 contributor org/company found, Somerset-SIDeR-Programme contributor org/company found, wintercg contributor org/company found, zakodium-oss contributor org/company found, upringjs contributor org/company found, danger contributor org/company found, WebAssembly contributor org/company found, nearform contributor org/company found, openid contributor org/company found, ubie-oss contributor org/company found, cheminfo contributor org/company found, insidewarehouse contributor org/company found, EpicGames contributor org/company found, platformatic contributor org/company found, ossf contributor org/company found, awslabs contributor org/company found, sagemath contributor org/company found, mbi health contributor org/company found, busterjs contributor org/company found, lexplano contributor org/company found, serolife contributor org/company found, Pseudo-Corp contributor org/company found, Level contributor org/company found, fastify contributor org/company found, piscinajs contributor org/company found, relevantfruit contributor org/company found, cowtech contributor org/company found, image-js contributor org/company found, expressjs contributor org/company found, nock contributor org/company found, WebKit contributor org/company found, pasokonistan contributor org/company found, cloudflare contributor org/company found, aws contributor org/company found, cheminfo-js contributor org/company found, dymonaz contributor org/company found, mqttjs contributor org/company found, passionfruit-earth contributor org/company found, BoostIO contributor org/company found, prettier contributor org/company found, pinojs contributor org/company found, hackwitus contributor org/company found, pkgjs contributor org/company found, babel contributor org/company found, tech-conferences contributor org/company found, CasparCG contributor org/company found, openjs-foundation contributor org/company found, mochajs contributor org/company found, elastic contributor org/company found, nodejs contributor org/company found, zakodium contributor org/company found, puella care contributor org/company found, freeCodeCamp contributor org/company found, fvgdev contributor org/company found, simdutf contributor org/company found, tu wien contributor org/company found, nodesource contributor org/company found, oauthstuff contributor org/company found, malijs contributor org/company found, minibuf contributor org/company found, ES-Community contributor org/company found, h5o contributor org/company found, jshttp contributor org/company found, nxtedition contributor org/company found, cybozu contributor org/company found, wasm-signatures contributor org/company found, adonisjs contributor org/company found, mljs contributor org/company found, Trendyol contributor org/company found, harperdb contributor org/company found, TrainingPlay contributor org/company found, w3c contributor org/company found, ada-url contributor org/company found, nodejs-private contributor org/company found, GonzagaAccess contributor org/company found, LyraSearch contributor org/company found, trendyol contributor org/company found,
Reason
no dangerous workflow patterns detected
Reason
update tool detected
Details
- Info: detected update tool: Dependabot: .github/dependabot.yml:1
Reason
project is fuzzed
Details
- Info: JavaScriptPropertyBasedTesting integration found: test/fuzzing/fuzzing.test.js:4
Reason
license file detected
Details
- Info: project has a license file: LICENSE:0
- Info: FSF or OSI recognized license: MIT License: LICENSE:0
Reason
30 commit(s) and 26 issue activity found in the last 90 days -- score normalized to 10
Reason
packaging workflow detected
Details
- Info: Project packages its releases by way of GitHub Actions.: .github/workflows/release.yml:40
Reason
SAST tool is run on all commits
Details
- Info: SAST configuration detected: CodeQL
- Info: all commits (25) are checked with a SAST tool
Reason
0 existing vulnerabilities detected
Reason
security policy file detected
Details
- Info: security policy file detected: SECURITY.md:1
- Info: Found linked content: SECURITY.md:1
- Warn: One or no descriptive hints of disclosure, vulnerability, and/or timelines in security policy
- Info: Found text in security policy: SECURITY.md:1
Reason
binaries present in source code
Details
- Warn: binary detected: lib/llhttp/llhttp.wasm:1
- Warn: binary detected: lib/llhttp/llhttp_simd.wasm:1
Reason
Found 23/28 approved changesets -- score normalized to 8
Reason
dependency not pinned by hash detected -- score normalized to 3
Details
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/autobahn.yml:41: update your workflow using https://app.stepsecurity.io/secureworkflow/nodejs/undici/autobahn.yml/main?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/backport.yml:27: update your workflow using https://app.stepsecurity.io/secureworkflow/nodejs/undici/backport.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/release-create-pr.yml:33: update your workflow using https://app.stepsecurity.io/secureworkflow/nodejs/undici/release-create-pr.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/release-create-pr.yml:34: update your workflow using https://app.stepsecurity.io/secureworkflow/nodejs/undici/release-create-pr.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/release-create-pr.yml:52: update your workflow using https://app.stepsecurity.io/secureworkflow/nodejs/undici/release-create-pr.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/release.yml:19: update your workflow using https://app.stepsecurity.io/secureworkflow/nodejs/undici/release.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/release.yml:20: update your workflow using https://app.stepsecurity.io/secureworkflow/nodejs/undici/release.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/release.yml:52: update your workflow using https://app.stepsecurity.io/secureworkflow/nodejs/undici/release.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/release.yml:53: update your workflow using https://app.stepsecurity.io/secureworkflow/nodejs/undici/release.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/release.yml:69: update your workflow using https://app.stepsecurity.io/secureworkflow/nodejs/undici/release.yml/main?enable=pin
- Warn: containerImage not pinned by hash: test/fixtures/cache-tests/docker/Dockerfile:1: pin your Docker image by updating ubuntu:devel to ubuntu:devel@sha256:76d816faff9ffc55af334ac9a26808b021607fffc1a7c4e6fcb3d488d410fdb6
- Warn: goCommand not pinned by hash: test/fixtures/cache-tests/docker/Dockerfile:67
- Warn: npmCommand not pinned by hash: test/fixtures/wpt/resources/webidl2/build.sh:7
- Warn: npmCommand not pinned by hash: .github/workflows/bench.yml:25
- Warn: npmCommand not pinned by hash: .github/workflows/bench.yml:27
- Warn: npmCommand not pinned by hash: .github/workflows/bench.yml:46
- Warn: npmCommand not pinned by hash: .github/workflows/bench.yml:48
- Warn: npmCommand not pinned by hash: .github/workflows/bench.yml:68
- Warn: npmCommand not pinned by hash: .github/workflows/bench.yml:70
- Warn: npmCommand not pinned by hash: .github/workflows/bench.yml:89
- Warn: npmCommand not pinned by hash: .github/workflows/bench.yml:91
- Warn: npmCommand not pinned by hash: .github/workflows/bench.yml:111
- Warn: npmCommand not pinned by hash: .github/workflows/bench.yml:113
- Warn: npmCommand not pinned by hash: .github/workflows/bench.yml:132
- Warn: npmCommand not pinned by hash: .github/workflows/bench.yml:134
- Warn: npmCommand not pinned by hash: .github/workflows/nodejs-shared.yml:42
- Warn: npmCommand not pinned by hash: .github/workflows/nodejs.yml:49
- Warn: npmCommand not pinned by hash: .github/workflows/nodejs.yml:95
- Warn: npmCommand not pinned by hash: .github/workflows/nodejs.yml:159
- Warn: npmCommand not pinned by hash: .github/workflows/nodejs.yml:180
- Warn: npmCommand not pinned by hash: .github/workflows/nodejs.yml:201
- Warn: npmCommand not pinned by hash: .github/workflows/release.yml:58
- Warn: npmCommand not pinned by hash: .github/workflows/release.yml:59
- Warn: npmCommand not pinned by hash: .github/workflows/test.yml:41
- Info: 41 out of 49 GitHub-owned GitHubAction dependencies pinned
- Info: 8 out of 10 third-party GitHubAction dependencies pinned
- Info: 0 out of 1 containerImage dependencies pinned
- Info: 0 out of 1 goCommand dependencies pinned
- Info: 0 out of 22 npmCommand dependencies pinned
Reason
no effort to earn an OpenSSF best practices badge detected
Reason
detected GitHub workflow tokens with excessive permissions
Details
- Info: jobLevel 'actions' permission set to 'read': .github/workflows/codeql.yml:31
- Info: jobLevel 'contents' permission set to 'read': .github/workflows/codeql.yml:32
- Warn: jobLevel 'contents' permission set to 'write': .github/workflows/nodejs.yml:217
- Warn: jobLevel 'contents' permission set to 'write': .github/workflows/release-create-pr.yml:26
- Warn: jobLevel 'contents' permission set to 'write': .github/workflows/release.yml:46
- Info: topLevel 'contents' permission set to 'read': .github/workflows/autobahn.yml:16
- Warn: topLevel 'contents' permission set to 'write': .github/workflows/backport.yml:10
- Info: topLevel 'contents' permission set to 'read': .github/workflows/bench.yml:7
- Info: topLevel 'contents' permission set to 'read': .github/workflows/codeql.yml:24
- Info: topLevel 'contents' permission set to 'read': .github/workflows/nightly.yml:9
- Info: topLevel 'contents' permission set to 'read': .github/workflows/nodejs-shared.yml:13
- Info: topLevel 'contents' permission set to 'read': .github/workflows/nodejs.yml:13
- Info: topLevel 'contents' permission set to 'read': .github/workflows/release-create-pr.yml:4
- Info: topLevel 'contents' permission set to 'read': .github/workflows/release.yml:11
- Info: topLevel permissions set to 'read-all': .github/workflows/scorecard.yml:18
- Info: topLevel 'contents' permission set to 'read': .github/workflows/test.yml:14
- Info: topLevel 'contents' permission set to 'read': .github/workflows/triggered-autobahn.yml:9
- Warn: topLevel 'contents' permission set to 'write': .github/workflows/update-wpt.yml:9
Score
8.1
/10
Last Scanned on 2024-11-27T14:31:14Z
The Open Source Security Foundation is a cross-industry collaboration to improve the security of open source software (OSS). The Scorecard provides security health metrics for open source projects.
Learn More