Good First Issues

This is a list of JavaScript repositories with good first issues for newcomers to open source. Contributions are welcome!

This list gets updated every day at midnight.

mithun-srinivas/DoxDock

• Flip PDF (mirror pages horizontally or vertically)
• Grayscale PDF: convert a whole PDF to black and white

MyZubster-Ecosystem/myzubster

• [Free] Add status badges and license
• [Agricoltori] Registro delle colture e rotazione

xmanrui/dsh-im

• [Feature] 为工作区命令增加 /ws、/wsl 和 /workspaces 别名
• [Feature] 支持使用 /workspacelist 序号切换工作区

nextcloud/tables

• Delete table: Button should be red

TryGhost/Ghost

• 🌐 i18n mega-issue
• Share profile image generation is broken for some avatars and cover images

jellyfin/jellyfin-web

• The homepage only displays the backdrops from libraries of the "movie" type

vercel/next.js

• @next/next/no-html-link-for-pages rule does not work with pageExtensions
• Inconsistent Error Messaging / Handling in getStaticPaths

WordPress/gutenberg

• PostCSS/esbuild/Vite token-fallback plugins incorrectly rewrite var()-like text inside strings
• Typescript - introduce new @wordpress/ts-config package for outside usage
• Pasting direct image URL inserts Embed block instead of Image block
• The category set in Default Post Category is not selected in the display when posting a new post.
• Make tooltips dismissable
• Cover block: empty block shows as black box on frontend
• Restore the full search visibility in embed links
• Dependency Extraction Webpack Plugin: Prettify the output of the development asset files
• Custom font upload not working
• Twitter embed block should expose options for how the tweet is displayed
• Audio Block: Autoplay does not happen on first load
• Improve the manual git cherry-pick instructions left when performing an automatic cherry-pick fails
• Documentation: Clarify the behavior of parent when empty during block registration
• Allow the PanelColorSettings to be visible if no colors and but with children
• NumberControl: Disable dragging on touch devices
• ESLint plugin: Relax the rule for @since in JSDoc

meshery/meshery.io

• [Bug] Copy Button Flickering on Hover
• [Bug] Fix Meshery Docs Link Styling
• Website: Consolidate duplicative and unused CSS
• [CI] Enhance appropriate github issue templates with mention of and hyperlink to self-pace contributor training

nextcloud/mail

• Add a CONST for the Oracle Max Chunk size and replace all occurrences

dmarzzz/shade-tree-node

• docs: a benchmarks table at the top of OVERVIEW.md (proof time, verify time, added RTT, req/s)
• docs: consolidate PROTOCOL-API.md / PROTOCOL-VERSIONING.md / design/PROTOCOL.md naming
• install: a curl-installer for the release binary (no git clone, no npm)

SecureBananaLabs/bug-bounty

• Low Handing Fruit Automation
• POST /api/reviews endpoint missing authentication middleware (reissue via #743)
• Automate Bug Detection and Reviews
• Implement a fully functional Admin Panel
• Benchmark APIs with p50, p95, p99 latency, RPS, error rate and TTFB
• Technical Poem Generation and Content Creation
• Pixel Art Creation with high Creative Thinking
• Calculate the exact value of PI #2872
• Calculate the exact value of PI
• Implement Secure Payment Gateway and Payment Service
• Bug: Missing admin role authorization check on admin metrics endpoint
• Bug: Proposal creation accepts records missing estimated duration
• Upload endpoint lacks authentication — unauthenticated file uploads allowed
• Registration token subject can drift from returned user id
• fix: prevent admin role self-assignment during registration
• Bug: Refresh endpoint mints tokens without validating a refresh token
• User creation endpoint has no input validation
• fix(auth): prevent admin role self-assignment during registration
• Bug: Multiple security vulnerabilities in API layer - registerUser() ID mismatch, missing auth, missing validation
• fix: prevent admin role self-assignment
• Admin routes lack role-based access control — any authenticated user can access admin endpoints
• Payment endpoint lacks authentication — unauthenticated payment creation
• Bug: user creation accepts empty payloads and client-controlled ids
• Bug: registerUser signs token with a different generated user id
• Bug: Rate limiter should count malformed JSON before body parsing
• fix: prevent admin role self-assignment
• CORS configured without origin allowlist in app.js (reissue via #743)
• auth refresh endpoint issues tokens without verifying the requester
• POST /api/users endpoint missing authentication middleware (reissue via #743)
• POST /api/proposals endpoint missing authentication middleware (reissue via #743)
• registerUser access token can reference a different user id
• upload endpoint accepts empty file submissions as successful uploads
• Registration should require fullName to match User model
• @freelanceflow/db package should expose an importable workspace entrypoint
• Job creation endpoint lacks authentication — anyone can post jobs
• Job validation should reject inverted budget ranges

product-on-purpose/pm-skills

• good first issue: author samples for the three remaining AI conditional sections
• good first issue: add a visual to the quickstart (screenshot or short gif of a first skill run)

davgross/homeless-in-slo-resource-guide

• Verify "St. Patrick’s Shamrock Thrift" data
• Verify correct locations of "Catholic Charities"
• Add "Hope for Ashlynn" group
• SLO YMCA moving to 24-hour schedule

nextcloud/forms

• Replace description fields with NcRichText

WordPress/wordpress-playground

• Missing CONTRIBUTING.md file
• Provide unit and e2e test instructions in the top-level README

nextcloud/contacts

• Contact Groups edit field: horizontal scrollbar covers the contact group(s)

darshi1337/apogee

• Hoist duplicate user-facing strings into a single messages module
• Give an actionable message when Ollama host validation fails
• Add per-summary keyword focus

nextcloud/spreed

• Recording chunked upload would fail with token length > 13
• Go back to autopilot mode if re-clicking selected participant
• Dashboard widget should show the actual mention message
• Imprint and privacy links in public talk conversations
• Migrate addParticipantToRoom to InvitationList
• Migrate OCC to InvitationList
• Guests in voice-rooms do not see "Leave call" button
• talk couldn't work after install the “talk_matterbridge”
• Write tests for "Team resources" integration
• System message shows "guest added user" to a conversation when adding through circle/team
• Reactions notifications when fully subscribed in federated conversations
• Limit to groups in federated target server breaks federation
• Instant meeting outside of dashboard?

louislam/uptime-kuma

• Password Reset via CLI does not work on Embedded MariaDB
• Pausing a group does not pause the individual monitors of that group

Zoverions/AXIOM-MESH

• Community Testnet v0 — recruit independent operators and hardware evidence
• Security Agent Cell Pilot #1 — independently attack RT-AUTH-001
• Agent Community engagement: first outside Security Cell result
• Agent Commons: external-agent contribution and interoperability layer

stdlib-js/stdlib

• Fix broken Markdown link: https://en.wikipedia.org/wiki/Anglit_distribution
• Fix JavaScript lint errors
• Fix EditorConfig lint errors
• [RFC]: Add C implementation for @stdlib/stats/base/dists/beta/median
• [RFC]: Add C implementation for @stdlib/stats/base/dists/chisquare/pdf
• [RFC]: Migrate math/base/special packages from relative tolerance testing to ULP difference testing (tracking issue)
• [RFC]: Improve doctests for ndarray instances in documentation examples (tracking issue)
• Fix broken Markdown link: https://bugzilla.mozilla.org/show_bug.cgi?id=892671

beautifier/js-beautify

• Add defaultOptions method to main beautifier

hackforla/website

• added docker technologies to lucky-parking project
• Update Project Profile: Lucky Parking (Add Tech: Docker)
• Update Project Profile: Hack for LA Site Remove Gilbert Quionnez
• Update Project Profile: Hackforla.org Website Remove Ryan Keller
• Update Project Profile: Hackforla.org Website Add Maleah Castillo Smith
• Update Project Profile: Hackforla.org Website Add Jose Santiago
• Skills Issue: Developer: Juan Yepez
• Update docker-compose.yml: Remove top-level version element
• Update Project Profile: Not Today (Update Project's Description)
• Add github-handle for Isabelle Wagenvoord in public-tree-map.md
• Add github-handle for Isabelle Wagenvoord in public-tree-map.md
• Add github-handle for Kate Rose in hellogov.md
• Update Project Profile: Civic Tech Jobs (Move Figma from Technology to Tool)
• Update Project Profile: Design Systems
• Epic: Create issues to add false positives to cspell.json
• Add ESlint VS Code installation instructions
• Design System Audit: Text Elements: Toolkit Page
• Mobile Responsiveness on toolkit
• ER: Find all the places that Github should be GitHub and fix
• Update Donate page in Figma to reflect changes on site
• ER: Rationalizing the sponsors and partners info in code base
• Add github-handle for Bonnie Wolfe in guides-teams.md
• Add github-handle for Hunter Owens in work-for-la.md
• Add github-handle for Kalyani Raman in open-community-survey.md
• Add github-handle for Snow in open-community-survey.md
• Add github-handle for Greg Pawin in lucky-parking.md
• Add additional repo(s) for project: Access the Data
• Update Project Profile: Food Oasis Add Bonnie Wolfe
• Update Project Profile: Food Oasis Add Jelena Karanovic
• Update Project Profile: Food Oasis Add Shienny Sutanto
• Update Project Profile: Food Oasis Add Whitney Gould
• Update Project Profile: Food Oasis Add Ling Dong
• Update Project Profile: Food Oasis Add Luigi Olianas
• Update Project Profile: Food Oasis Add Alexa Ray
• Update Project Profile: Food Oasis Add Caitlin Jimenez
• Update Project Profile: Food Oasis Add Christina Nguyen
• Update Project Profile: Food Oasis Add Zainab Adenaike
• Update Project Profile: Food Oasis Add Jaclyn Chin
• Update Project Profile: Food Oasis Remove Andy Arensman
• Update Project Profile: Food Oasis Remove Belen Garcia Martinez
• Update Project Profile: Food Oasis Remove Krista Strucke
• Update Project Profile: Food Oasis Remove Qiqi Zheng
• Design System Audit: Text Elements: Join Us Page
• Correct Oxford Comma in Communities of Practice Page
• Update Project Profile: GreenEarthOS (Update Project's Description)
• Update Project Profile: Open Community Survey (Update Project's Description)

Berserk-hub150/skillhawk

• [Good First Issue] Add a secure-example writing tip [MC-013]
• [Good First Issue] Add a minimal-evidence tip [MC-002]
• [Good First Issue] Add an actionable-remediation tip [MC-003]
• [Good First Issue] Add a narrow-rule design tip [MC-005]
• [Good First Issue] Add a false-positive review tip [MC-004]
• [Good First Issue] Add a severity calibration tip [MC-006]
• [Good First Issue] Add a safe-fixture writing tip [MC-007]
• [Good First Issue] Add a redaction tip [MC-009]
• [Good First Issue] Add a suspicious-fixture writing tip [MC-008]
• [Good First Issue] Add a SKILL.md trust-boundary tip [MC-012]
• [Good First Issue] Add an output-encoding tip [MC-032]
• [2–5 min] Define prompt injection for beginners
• [Good First Issue] Add a path-traversal review tip [MC-031]
• [2–5 min] Add one prompt-injection remediation tip
• [2–5 min] Add one precision flashcard
• [2–5 min] Add one safe-fixture writing tip
• [2–5 min] Add one severity-labeling tip
• [2–5 min] Add one MCP config review use case
• [2–5 min] Add one false-negative reporting tip
• [2–5 min] Add one false-positive reporting tip
• [2–5 min] Add one benchmark FAQ answer
• [2–5 min] Add one local repository scan use case
• [2–5 min] Add one pull-request scanning use case
• [2–5 min] Add one Claude Code review use case
• [2–5 min] Add one Agent Skill review use case
• [2–5 min] Add one recall flashcard
• [2–5 min] Add one static-vs-dynamic analysis flashcard
• [2–5 min] Add one secrets-handling flashcard
• [2–5 min] Add one static-only safety flashcard
• [2–5 min] Add one rule ID flashcard
• [2–5 min] Add one CI security gate flashcard
• [2–5 min] Add one Code Scanning flashcard
• [2–5 min] Add one GitHub Action flashcard
• [2–5 min] Add one flashcard about zero dependencies
• [2–5 min] Define least privilege for beginners
• [2–5 min] Define remediation for beginners
• [2–5 min] Define security severity levels
• [2–5 min] Define recall for beginners
• [2–5 min] Define precision for beginners
• [2–5 min] Define false negative for beginners
• [2–5 min] Define false positive for beginners
• [2–5 min] Define SARIF for beginners
• [2–5 min] Define static analysis for beginners
• Add detection for suspicious PowerShell download-and-execute patterns
• Add a compact README demo GIF or terminal screenshot