Open Source Project Tracker: Production web stack dependency risk
Next.js ships critical RCE fix, then four more advisories
Next.js shipped five security advisories in two weeks, FastAPI and Remix lean hardest on one maintainer, and Astro looks healthiest. 'npm:remix' resolved to remix-run/remix (package remix, latest 3.0.0). This is a first run, so star deltas are baselines. Active contributors and bus factor are human commits on the default branch, bots excluded.
The 30-second version
Next.js: critical RCE advisory (patched 16.3.6) on Sep 22, plus four more on Sep 30, three with unresolved patched versions.
FastAPI: one maintainer wrote 76.5% of 90-day human commits; only 2 human authors in 30 days.
Remix: 51% of 30-day commits from one author; astro downloads up 16.6% week on week.
01Next.js · Oct 6
Next.js: five advisories in two weeks — rising
Stars: 143,195 (baseline, first run). Downloads (npm next, Sep 28–Oct 4 vs Sep 21–27): 76.9M vs 67.8M, +13.4%. Active human contributors: 39 over 30 days, 82 over 90 days. Bus factor: top author held 12.5% of 30-day and 7.7% of 90-day human commits. Issues: 1,058 open issues, 2,484 open PRs, 24,442 closed issues; median first human response was 28.5h on only 2 of the 20 newest issues, so treat that as weak. Releases: canary 16.4.0-canary.54 through .61 shipped Sep 30 to Oct 5, roughly daily; the patched stable line is 16.3.x. Status is rising on adoption and activity, with the security record flagged.
Red flag: GHSA-vcvr-r3jv-pc5j, a critical RCE in next/og ImageResponse (CVSS v4 9.5), was published Sep 22 and is patched in 16.3.6. It affects the Node.js ImageResponse only when attacker-controlled values reach SVG content. On Sep 30, four more were published: a high-severity SSRF in Image Optimization, two medium use-cache leaks and a low dev-server MCP disclosure. The API listed patched versions for three of them as '16.3.?' placeholders, and 16.3.8 for the cache-leak one. I did not verify those three against npm.
For dependency risk: confirm you run 16.3.6 or later, check the three advisories whose patched versions are unresolved, and audit next/og usage.
FastAPI: one maintainer, thin human activity — stalling
Stars: 102,828 (baseline). Downloads (PyPI fastapi incl. mirrors, Sep 28–Oct 4 vs Sep 21–27): 102.3M vs 89.6M, +14.2%; but last 4 weeks vs prior 4 is down 20.5% (360.1M vs 453.3M), a step drop starting around Aug 24–25 that I did not diagnose. Active human contributors: 2 over 30 days, 8 over 90 days. Bus factor: tiangolo wrote 66.7% of 30-day and 76.5% of 90-day human commits (6 of 9, and 78 of 102). Issues: 1 open issue (a locked roadmap issue; the project uses Discussions) and 85 open PRs; median first response 2.8h, but 14 of the 20 newest issues had no response, so it is weak. Releases: 0.142.0, 0.142.1 and 0.142.2 landed Sep 29–30, after 0.141.1 on Jul 29. Status is stalling: thin human activity and a long gap between release bursts, despite huge adoption.
No advisories were published in the window; the only entry listed on the repo is from 2021.
For dependency risk: treat FastAPI as a single-maintainer dependency; pin versions, and watch whether the 90-day human author count of 8 recovers.
Remix: 3.0.0 on npm, half the commits from one author — rising
Stars: 33,387 (baseline). Downloads (npm remix, Sep 28–Oct 4 vs Sep 21–27): 30,922 vs 22,064, +40%, on a very small base. Active human contributors: 10 over 30 days, 17 over 90 days. Bus factor: brophdawg11 wrote 51.2% of 30-day and 38.8% of 90-day human commits. Issues: 6 open issues, 29 open PRs, 2,809 closed issues; median first response was 2.0h, but half the newest issues were bot-opened and 15 of 20 had no response, so it is weak. Releases: on Oct 1 the repo published first stable 1.0.0 releases for many @remix-run packages (terminal, tar-parser, spa, static-middleware) and a breaking [email protected]. npm 'remix' latest is 3.0.0, with next at 3.0.0-rc.5. Status is rising on activity and downloads, but the base is small.
Red flag: @remix-run/ui 0.12.0 is a documented breaking change that moved component APIs to @remix-run/component; the notes call ui unstable and versioned independently. No advisories were returned for the repo.
For dependency risk: the 3.0.0 line is days old and its ui package is explicitly unstable; test upgrades before adopting and note the one-author concentration.
Stars: 63,064 (baseline). Downloads (npm astro, Sep 28–Oct 4 vs Sep 21–27): 7.93M vs 6.80M, +16.6%. Active human contributors: 35 over 30 days, 76 over 90 days; the account astrobot-houston is typed User but looks like a bot, so these are likely overstated. Bus factor: matthewp wrote 32.6% of 30-day and 23.2% of 90-day commits. Issues: 15 open issues, 88 open PRs, 6,676 closed issues; median first human response was 23.5h across 11 responded issues, and 9 of the newest 20 had no human response. Releases: astro 7.4.0-beta.0 on Oct 1 and 7.4.0-beta.1 on Oct 2, with @astrojs/cloudflare 15.0.0-beta.1 on Oct 2. Status is rising on downloads and contributor breadth.
Context: the API lists an Aug 27 critical RCE advisory (AVIF image optimization, patched 7.2.8) and several medium ones, outside the 30-day window. No advisories surfaced in the last 30 days. GitHub reports the license as 'Other' (NOASSERTION); I did not inspect the license file.
For dependency risk: stay on a patched 7.2.8 or later line, and check the license file if your policy needs a recognized SPDX identifier.