envoyproxy/envoy
Cloud-native high-performance edge/middle/service proxy
29.1k stars · 5.7k forks · C++
Healthy
Healthy: actively maintained by 80 people, no known risks.
Why
No rule fired.
What would change this
- Partly checked: maintenance (Commit counts are estimated: the commit sample stops before the window start, so GitHub's totals were scaled by the sampled bot share.; Authors in the last 90 days are counted from the sampled commits only.)
- A dormant maintenance status, a deprecated or archived package, a successor link, or a critical advisory would change this.
Maintenance
PartialActive
- Human commits, 30 days
- 459
- Human commits, 90 days
- 1.2k
- Human commits, 365 days
- 3.5k
- Bot share of commits, 365 days
- 7%
- Last commit
- Oct 14, 2026 (10 hours ago)
- Last human commit
- Oct 14, 2026 (12 hours ago)
- Authors, 90 days
- 80
- Last release
- Oct 13, 2026 (1 day ago)
- Median PR merge time
- under an hour
Responsiveness: of 23 recent issues, 22% got a maintainer reply. Median first response: 22 days.
- Commit counts are estimated: the commit sample stops before the window start, so GitHub's totals were scaled by the sampled bot share.
- Authors in the last 90 days are counted from the sampled commits only.
Sources: Commits, Releases, Merged pull requests, Issues
People
Complete- Owner
- Organization
- Commits sampled
- 467 since Oct 14, 2025
- Authors for half of commits
- 4
- Authors for 80% of commits
- 21
- Contributors
- 379
Top committers
- phlax: 22% of commits
- agrawroh: 16% of commits
- wbpcode: 11% of commits
- jwendell: 3% of commits
- yanavlasov: 3% of commits
- Shares come from the newest sampled commits, since the commit sample is capped.
Sources: Commits, Contributors
Stars
CompleteOrganic, confidence high
Bursts
- Sep 14, 2016 to Sep 26, 2016: about 404 more stars than usual, peak 166 in one day, a spike that tapers off. We couldn't check for an outside explanation.
- Apr 25, 2017 to Apr 27, 2017: about 128 more stars than usual, peak 96 in one day, a spike that tapers off. Outside explanation: a jump in forks.
- May 24, 2017 to May 27, 2017: about 116 more stars than usual, peak 56 in one day, a spike that tapers off. Outside explanation: a jump in forks.
- Sep 27, 2017 to Sep 29, 2017: about 179 more stars than usual, peak 103 in one day, a spike that tapers off. Outside explanation: a jump in forks.
- Jun 28, 2018 to Jun 29, 2018: about 78 more stars than usual, peak 72 in one day, a spike that tapers off. Outside explanation: a jump in forks, a jump in issues and pull requests.
- Jul 9, 2018 to Jul 10, 2018: about 56 more stars than usual, peak 51 in one day, a spike that tapers off. Outside explanation: a jump in forks, a jump in issues and pull requests.
- Jul 30, 2020 to Aug 7, 2020: about 394 more stars than usual, peak 113 in one day, a spike that tapers off. Outside explanation: a jump in forks, a jump in issues and pull requests.
- Apr 2, 2021 to Apr 2, 2021: about 88 more stars than usual, peak 98 in one day, a spike that tapers off. Outside explanation: a jump in issues and pull requests.
- Jul 21, 2021 to Jul 22, 2021: about 106 more stars than usual, peak 100 in one day, a spike that tapers off. Outside explanation: a jump in forks.
- Mar 2, 2024 to Mar 3, 2024: about 61 more stars than usual, peak 36 in one day, a spike that tapers off. Outside explanation: a jump in issues and pull requests.
- Sep 4, 2024 to Sep 6, 2024: about 82 more stars than usual, peak 58 in one day, a spike that tapers off. No outside explanation found, so this burst is unexplained.
- Oct 15, 2025 to Oct 17, 2025: about 139 more stars than usual, peak 77 in one day, a spike that tapers off. Outside explanation: a jump in issues and pull requests.
- 2 stars GitHub has since removed (tracked since Oct 14, 2026).
Anyone can buy stars for any repo; bursts alone don't prove the owner did.
- The star history looks organic.
Sources: How star history is analyzed
Risk
CompleteFlags
- Warning: OSV, via deps.dev, lists OSV-2018-117, OSV-2018-224, OSV-2018-335, OSV-2018-95, OSV-2019-1, OSV-2020-473 at MODERATE, LOW or unrated severity on the latest version of github.com/envoyproxy/envoy. Details
License
- Now
- Apache-2.0 (OSI-approved)
- A year ago
- Apache-2.0 (OSI-approved)
Packages
- github.com/envoyproxy/envoy (GO): latest v1.40.0, published Oct 13, 2026
Advisories for the latest version: OSV-2018-117 (unknown), OSV-2018-224 (unknown), OSV-2018-335 (unknown), OSV-2018-95 (unknown), OSV-2019-1 (unknown), OSV-2020-473 (unknown)
Package and advisory data: deps.dev and OSV.
OpenSSF Scorecard: 9.1 out of 10 (via deps.dev).
Sources: GitHub: envoyproxy/envoy, deps.dev: Go github.com/envoyproxy/envoy, OSV: OSV-2018-117, OSV: OSV-2018-224, OSV: OSV-2018-335, OSV: OSV-2018-95, OSV: OSV-2019-1, OSV: OSV-2020-473
Badge
Add this to a README to show the current verdict:
[](https://reporadar.ai/envoyproxy/envoy)Earlier verdicts
- Oct 14, 2026: Healthy
- Oct 14, 2026: Healthy