# [projectcalico/calico](https://github.com/projectcalico/calico) Cloud native networking and network security 7.4k stars · 1.6k forks · Go Quick update: star history is from the full report of Oct 25, 2026. Caution The published package has not been released in two years. ## Why - The Go package github.com/projectcalico/calico has had no release since November 2021, while the repository has 4,344 human commits in the last year; the old release has 6 known security advisories (GHSA-5r5h-q934-cccp, GHSA-6362-gv4m-53ww, GHSA-9394-xfq9-6qrp), which do not show whether the current code is affected. ([source 1](https://deps.dev/go/github.com%2Fprojectcalico%2Fcalico), [source 2](https://github.com/projectcalico/calico), [source 3](https://osv.dev/vulnerability/GHSA-5r5h-q934-cccp), [source 4](https://osv.dev/vulnerability/GHSA-6362-gv4m-53ww), [source 5](https://osv.dev/vulnerability/GHSA-9394-xfq9-6qrp), [source 6](https://osv.dev/vulnerability/GHSA-9p7w-w5q6-mxj3), [source 7](https://osv.dev/vulnerability/GHSA-m67g-87rx-v42c), [source 8](https://osv.dev/vulnerability/GO-2024-2801)) ### What would change this - A new package release is published. - Partly checked: maintenance (Commit counts are estimated: the commit sample stops before the window start, so GitHub's totals were scaled by the sampled bot share.; Authors in the last 90 days are counted from the sampled commits only.) ## Maintenance Partial Active **Human commits, 30 days** 359 **Human commits, 90 days** 1.2k **Human commits, 365 days** 4.3k **Bot share of commits, 365 days** 0% **Last commit** Nov 13, 2026 (13 hours ago) **Last human commit** Nov 13, 2026 (13 hours ago) **Authors, 90 days** 18 **Last release** Nov 11, 2026 (1 day ago) **Median PR merge time** 5 hours Responsiveness: of 29 recent issues, 76% got a maintainer reply. Median first response: 6 hours. - Commit counts are estimated: the commit sample stops before the window start, so GitHub's totals were scaled by the sampled bot share. - Authors in the last 90 days are counted from the sampled commits only. Sources: [Commits](https://github.com/projectcalico/calico/commits), [Releases](https://github.com/projectcalico/calico/releases), [Merged pull requests](https://github.com/projectcalico/calico/pulls?q=is%3Apr+is%3Amerged), [Issues](https://github.com/projectcalico/calico/issues?q=is%3Aissue) ## People Complete **Owner** Organization **Commits sampled** 100 since Nov 13, 2025 **Authors for half of commits** 3 **Authors for 80% of commits** 6 **Contributors** 282 ### Top committers - caseydavenport: 27% of commits - nelljerram: 15% of commits - alexh-tigera: 13% of commits - tomastigera: 11% of commits - lwr20: 10% of commits - Shares come from the newest sampled commits, since the commit sample is capped. Sources: [Commits](https://github.com/projectcalico/calico/commits), [Contributors](https://github.com/projectcalico/calico/graphs/contributors) ## Stars Complete Organic, confidence medium Bars show stars gained each week. Red bars overlap a burst. Anyone can buy stars for any repo; bursts alone don't prove the owner did. - The star history looks organic. - Star history from the full report of Oct 25, 2026; this update did not re-read it. Sources: [How star history is analyzed](https://reporadar.ai/methodology#stars) ## Risk Complete ### Flags - **Warning:** The latest release of the Go package github.com/projectcalico/calico was published more than 24 months ago, while the repository has had 4,344 human commits in the last year (deps.dev); the old release has 6 known security advisories (GHSA-5r5h-q934-cccp, GHSA-6362-gv4m-53ww, GHSA-9394-xfq9-6qrp), which do not show whether the current code is affected. [Details](https://deps.dev/go/github.com%2Fprojectcalico%2Fcalico) ### License **Now** Apache-2.0 (OSI-approved) **A year ago** Apache-2.0 (OSI-approved) ### Packages - **github.com/projectcalico/calico** (GO): latest v3.21.1+incompatible, published Nov 24, 2021 Advisories for the latest version: [GHSA-5r5h-q934-cccp](https://osv.dev/vulnerability/GHSA-5r5h-q934-cccp) (high), [GHSA-6362-gv4m-53ww](https://osv.dev/vulnerability/GHSA-6362-gv4m-53ww) (high), [GHSA-9394-xfq9-6qrp](https://osv.dev/vulnerability/GHSA-9394-xfq9-6qrp) (moderate), [GHSA-9p7w-w5q6-mxj3](https://osv.dev/vulnerability/GHSA-9p7w-w5q6-mxj3) (moderate), [GHSA-m67g-87rx-v42c](https://osv.dev/vulnerability/GHSA-m67g-87rx-v42c) (moderate), [GO-2024-2801](https://osv.dev/vulnerability/GO-2024-2801) (unknown) Package and advisory data: deps.dev and OSV. OpenSSF Scorecard: 6.2 out of 10 (via deps.dev). Sources: [GitHub: projectcalico/calico](https://github.com/projectcalico/calico), [deps.dev: Go github.com/projectcalico/calico](https://deps.dev/go/github.com%2Fprojectcalico%2Fcalico), [OSV: GHSA-5r5h-q934-cccp](https://osv.dev/vulnerability/GHSA-5r5h-q934-cccp), [OSV: GHSA-6362-gv4m-53ww](https://osv.dev/vulnerability/GHSA-6362-gv4m-53ww), [OSV: GHSA-9394-xfq9-6qrp](https://osv.dev/vulnerability/GHSA-9394-xfq9-6qrp), [OSV: GHSA-9p7w-w5q6-mxj3](https://osv.dev/vulnerability/GHSA-9p7w-w5q6-mxj3), [OSV: GHSA-m67g-87rx-v42c](https://osv.dev/vulnerability/GHSA-m67g-87rx-v42c), [OSV: GO-2024-2801](https://osv.dev/vulnerability/GO-2024-2801) ## Compare Weighing projectcalico/calico against an alternative? See both side by side. ## Badge ![RepoRadar: Caution](data:image/svg+xml,%3Csvg%20xmlns%3D%22http%3A%2F%2Fwww.w3.org%2F2000%2Fsvg%22%20width%3D%22112%22%20height%3D%2220%22%20role%3D%22img%22%20aria-label%3D%22reporadar%3A%20caution%22%3E%3Ctitle%3Ereporadar%3A%20caution%3C%2Ftitle%3E%3CclipPath%20id%3D%22r%22%3E%3Crect%20width%3D%22112%22%20height%3D%2220%22%20rx%3D%223%22%2F%3E%3C%2FclipPath%3E%3Cg%20clip-path%3D%22url(%23r)%22%3E%3Crect%20width%3D%2263%22%20height%3D%2220%22%20fill%3D%22%23555%22%2F%3E%3Crect%20x%3D%2263%22%20width%3D%2249%22%20height%3D%2220%22%20fill%3D%22%23dfa000%22%2F%3E%3C%2Fg%3E%3Cg%20fill%3D%22%23fff%22%20text-anchor%3D%22middle%22%20font-family%3D%22Verdana%2CGeneva%2CDejaVu%20Sans%2Csans-serif%22%20font-size%3D%2211%22%3E%3Ctext%20x%3D%2232%22%20y%3D%2214%22%3Ereporadar%3C%2Ftext%3E%3Ctext%20x%3D%2288%22%20y%3D%2214%22%3Ecaution%3C%2Ftext%3E%3C%2Fg%3E%3C%2Fsvg%3E) Add this to a README to show the current verdict: ``` [![RepoRadar](https://reporadar.ai/projectcalico/calico/badge.svg)](https://reporadar.ai/projectcalico/calico) ``` ## Follow Get told when this verdict changes. Add the feed to any feed reader: you get one entry per change, not one per refresh. ``` https://reporadar.ai/projectcalico/calico/feed.xml ``` [Open the feed](https://reporadar.ai/projectcalico/calico/feed.xml) ## More repos rated Caution [See all](https://reporadar.ai/-/reports/caution) - [JerryZLiu/Dayflow](https://reporadar.ai/JerryZLiu/Dayflow) 7.4k stars - [irinabuht12-oss/marketing-skills](https://reporadar.ai/irinabuht12-oss/marketing-skills) 7.5k stars - [modelcontextprotocol/registry](https://reporadar.ai/modelcontextprotocol/registry) 7.5k stars - [MrLesk/Backlog.md](https://reporadar.ai/MrLesk/Backlog.md) 7.4k stars - [drumih/turbo-fieldfare](https://reporadar.ai/drumih/turbo-fieldfare) 7.3k stars - [BrowserMCP/mcp](https://reporadar.ai/BrowserMCP/mcp) 7.3k stars ## Earlier verdicts - Nov 13, 2026: Caution - Nov 12, 2026: Caution - Nov 11, 2026: Caution - Nov 10, 2026: Caution - Nov 9, 2026: Caution - Nov 8, 2026: Caution - Nov 7, 2026: Caution - Nov 6, 2026: Caution - Nov 5, 2026: Caution - Nov 4, 2026: Caution Computed 12 hours ago · method 2026.10.2 Source: https://reporadar.ai/projectcalico/calico