XTLS/Xray-core

Xray, Penetrates Everything. Also the best v2ray-core. Where the magic happens. An open platform for various uses.

42.1k stars · 6k forks · Go

At risk

At risk: a high-severity security advisory affects the latest version.

Why

The latest version of Go package github.com/xtls/xray-core has 1 high-severity security advisory (GHSA-5wf9-h793-w73c). (source 1, source 2, source 3)

What would change this

The latest version is patched or the advisory is withdrawn.
Partly checked: maintenance (Commit counts are estimated: the commit sample stops before the window start, so GitHub's totals were scaled by the sampled bot share.)

Maintenance

Partial

Active

Human commits, 30 days: 62
Human commits, 90 days: 108
Human commits, 365 days: 437
Bot share of commits, 365 days: 15%
Last commit: Oct 14, 2026 (20 hours ago)
Last human commit: Oct 14, 2026 (20 hours ago)
Authors, 90 days: 41
Last release: Oct 10, 2026 (4 days ago)
Median PR merge time: 44 hours

Responsiveness: of 30 recent issues, 100% got a maintainer reply. Median first response: 3 hours.

Commit counts are estimated: the commit sample stops before the window start, so GitHub's totals were scaled by the sampled bot share.

Sources: Commits, Releases, Merged pull requests, Issues

People

Complete

Owner: Organization
Commits sampled: 424 since Oct 14, 2025
Authors for half of commits: 4
Authors for 80% of commits: 28
Contributors: 261

Top committers

Fangliding: 18% of commits
RPRX: 14% of commits
LjhAUMEM: 13% of commits
Meo597: 10% of commits
hossinasaadi: 3% of commits

Shares come from the newest sampled commits, since the commit sample is capped.

Sources: Commits, Contributors

Stars

Complete

Mostly organic, confidence high

Bars show stars gained each week. Orange bars overlap a burst.

Bursts

Mar 21, 2021 to Mar 23, 2021: about 211 more stars than usual, peak 126 in one day, a spike that tapers off. Outside explanation: a jump in forks, a jump in issues and pull requests.
Sep 9, 2021 to Sep 10, 2021: about 87 more stars than usual, peak 83 in one day, a spike that tapers off. Outside explanation: a jump in forks, a jump in issues and pull requests.
Nov 15, 2021 to Nov 16, 2021: about 65 more stars than usual, peak 58 in one day, a spike that tapers off. Outside explanation: a jump in forks.
Jun 5, 2022 to Jun 5, 2022: about 60 more stars than usual, peak 71 in one day, a spike that tapers off. Outside explanation: a jump in forks, a jump in issues and pull requests.
Oct 23, 2022 to Oct 26, 2022: about 118 more stars than usual, peak 60 in one day, a spike that tapers off. Outside explanation: a Hacker News post, a jump in forks, a jump in issues and pull requests.
Aug 8, 2023 to Aug 11, 2023: about 116 more stars than usual, peak 76 in one day, a shape we can't classify. Outside explanation: a jump in forks, a jump in issues and pull requests.
Aug 27, 2023 to Aug 28, 2023: about 62 more stars than usual, peak 63 in one day, a spike that tapers off. Outside explanation: a jump in forks, a jump in issues and pull requests.
Nov 2, 2023 to Nov 24, 2023: about 2.1k more stars than usual, peak 501 in one day, a shape we can't classify. No outside explanation found, so this burst is unexplained.
Jul 23, 2024 to Jul 24, 2024: about 74 more stars than usual, peak 76 in one day, a spike that tapers off. Outside explanation: a jump in issues and pull requests.
Aug 26, 2024 to Aug 26, 2024: about 59 more stars than usual, peak 81 in one day, a spike that tapers off. Outside explanation: a jump in issues and pull requests.
May 19, 2025 to May 20, 2025: about 116 more stars than usual, peak 101 in one day, a spike that tapers off. Outside explanation: a jump in issues and pull requests.
Jun 8, 2025 to Jun 17, 2025: about 463 more stars than usual, peak 135 in one day, a spike that tapers off. Outside explanation: a jump in issues and pull requests.
Aug 3, 2025 to Aug 4, 2025: about 123 more stars than usual, peak 122 in one day, a spike that tapers off. Outside explanation: a jump in issues and pull requests.
Oct 25, 2025 to Oct 25, 2025: about 74 more stars than usual, peak 93 in one day, a spike that tapers off. No outside explanation found, so this burst is unexplained.
Feb 3, 2026 to Feb 4, 2026: about 121 more stars than usual, peak 129 in one day, a spike that tapers off. Outside explanation: a jump in issues and pull requests.
Apr 20, 2026 to Apr 21, 2026: about 331 more stars than usual, peak 296 in one day, a spike that tapers off. Outside explanation: a jump in issues and pull requests.

4 stars GitHub has since removed (tracked since Oct 14, 2026).

Anyone can buy stars for any repo; bursts alone don't prove the owner did.

Some star bursts have no matching forks, issues, releases, or launch coverage.
Anyone can buy stars for any repo, so this describes the star history only.

Sources: How star history is analyzed

Risk

Complete

Flags

High: OSV, via deps.dev, lists GHSA-5wf9-h793-w73c at HIGH severity on the latest version of github.com/xtls/xray-core. Details

License

Now: MPL-2.0 (OSI-approved)
A year ago: MPL-2.0 (OSI-approved)

Packages

github.com/xtls/xray-core (GO): latest v1.260327.0, published Mar 27, 2026
Advisories for the latest version: GHSA-5wf9-h793-w73c (high)

Package and advisory data: deps.dev and OSV.

OpenSSF Scorecard: 4.9 out of 10 (via deps.dev).

Sources: GitHub: XTLS/Xray-core, deps.dev: Go github.com/xtls/xray-core, OSV: GHSA-5wf9-h793-w73c

Badge

Add this to a README to show the current verdict:

[![RepoRadar](https://reporadar.ai/XTLS/Xray-core/badge.svg)](https://reporadar.ai/XTLS/Xray-core)

Earlier verdicts

Oct 14, 2026: At risk
Oct 14, 2026: At risk
Oct 13, 2026: At risk

Computed 15 hours ago · method 2026.10.2