lm-sys/FastChat
An open platform for training, serving, and evaluating large language models. Release repo for Vicuna and Chatbot Arena.
39.5k stars · 4.8k forks · Python
Avoid
Avoid: no human commits in a year, and most questions go unanswered.
Why
- No human commits since June 2025, and only 0 of 30 recent issues got a maintainer reply. (source 1, source 2, source 3, source 4)
- The latest version of PyPI package fschat has 7 high-severity security advisories (GHSA-79rp-v9rm-gxm8, GHSA-g44m-hpf4-vmrp, GHSA-h254-g997-685c). (source 1, source 2, source 3, source 4, source 5, source 6, source 7, source 8, source 9, source 10, source 11, source 12, source 13, source 14)
What would change this
- A release or merged commit from a maintainer, or replies to recent issues.
- The latest version is patched or the advisory is withdrawn.
Maintenance
CompleteDormant
- Human commits, 30 days
- 0
- Human commits, 90 days
- 0
- Human commits, 365 days
- 0
- Bot share of commits, 365 days
- 0%
- Last commit
- Jun 2, 2025 (1 year ago)
- Last human commit
- Jun 2, 2025 (1 year ago)
- Authors, 90 days
- 0
- Last release
- Feb 11, 2024 (2 years ago)
- Median PR merge time
- 24 hours
Responsiveness: of 30 recent issues, 0% got a maintainer reply. Median first response: n/a.
- No human commits in 365 days, and most issues go unanswered.
Sources: Commits, Releases, Merged pull requests, Issues
People
Complete- Owner
- Organization
- Commits sampled
- 100 since Apr 15, 2024
- Authors for half of commits
- 2
- Authors for 80% of commits
- 8
- Contributors
- 240
Top committers
- infwinston: 41% of commits
- CodingWithTim: 11% of commits
- lisadunlap: 11% of commits
- BabyChouSr: 7% of commits
- adityamittal13: 3% of commits
- No human commits in the last 365 days, so shares use the newest 100 commits back to 2024-04-15T00:11:33Z.
Sources: Commits, Contributors
Stars
CompleteOrganic, confidence high
Bursts
- Apr 29, 2024 to May 1, 2024: about 198 more stars than usual, peak 104 in one day, a flat block of stars. Outside explanation: a jump in forks, a jump in issues and pull requests.
- 2 stars GitHub has since removed (tracked since Oct 14, 2026).
Anyone can buy stars for any repo; bursts alone don't prove the owner did.
- The star history looks organic.
Sources: How star history is analyzed
Risk
CompleteFlags
- High: OSV, via deps.dev, lists GHSA-79rp-v9rm-gxm8, GHSA-g44m-hpf4-vmrp, GHSA-h254-g997-685c, GHSA-qg86-f892-m4hj, PYSEC-2026-1395, PYSEC-2026-1396, PYSEC-2026-1397 at HIGH severity on the latest version of fschat. Details
- Warning: OSV, via deps.dev, lists GHSA-77cj-rv5x-v6r2, GHSA-f3q6-69f3-vwch, PYSEC-2026-1394, PYSEC-2026-1398, PYSEC-2026-2485 at MODERATE, LOW or unrated severity on the latest version of fschat. Details
- Info: The OpenSSF Scorecard for this project is 3.7 out of 10 (deps.dev). Details
License
- Now
- Apache-2.0 (OSI-approved)
- A year ago
- Apache-2.0 (OSI-approved)
Packages
- fschat (PYPI): latest 0.2.36, published Feb 11, 2024
Advisories for the latest version: GHSA-77cj-rv5x-v6r2 (moderate), GHSA-79rp-v9rm-gxm8 (high), GHSA-f3q6-69f3-vwch (moderate), GHSA-g44m-hpf4-vmrp (high), GHSA-h254-g997-685c (high), GHSA-qg86-f892-m4hj (high), PYSEC-2026-1394 (moderate), PYSEC-2026-1395 (high), PYSEC-2026-1396 (high), PYSEC-2026-1397 (high), PYSEC-2026-1398 (unknown), PYSEC-2026-2485 (unknown)
Package and advisory data: deps.dev and OSV.
OpenSSF Scorecard: 3.7 out of 10 (via deps.dev).
Sources: GitHub: lm-sys/FastChat, deps.dev: PyPI fschat, OSV: GHSA-77cj-rv5x-v6r2, OSV: GHSA-79rp-v9rm-gxm8, OSV: GHSA-f3q6-69f3-vwch, OSV: GHSA-g44m-hpf4-vmrp, OSV: GHSA-h254-g997-685c, OSV: GHSA-qg86-f892-m4hj, OSV: PYSEC-2026-1394, OSV: PYSEC-2026-1395, OSV: PYSEC-2026-1396, OSV: PYSEC-2026-1397, OSV: PYSEC-2026-1398, OSV: PYSEC-2026-2485
Badge
Add this to a README to show the current verdict:
[](https://reporadar.ai/lm-sys/FastChat)Earlier verdicts
- Oct 14, 2026: Avoid
- Oct 14, 2026: Avoid
- Oct 13, 2026: Avoid