Good First Issues

This is a list of JavaScript repositories with good first issues for newcomers to open source. Contributions are welcome!

This list gets updated every day at midnight.

hackforla/devops

• Delete the redundant blank-issue.md template

radiantearth/stac-browser

• render temporal extent without time
• favicon browser tab

jellyfin/jellyfin-web

• The homepage only displays the backdrops from libraries of the "movie" type

StudentSuite/awesome-student-resources

• Add a community for international/exchange students to Communities
• Add an eating-disorder support resource to Mental Health & Wellbeing
• Add a personal-finance-for-students book to Books We Trust
• Blogs, Newsletters & Podcasts is entirely English-language; add a non-English entry
• Add a LinkedIn profile optimization guide to Applications & Resumes
• Add a second global student-discount platform to Student Discounts & Free Access
• Add a Middle East-specific scholarship search to Scholarships & Financial Aid
• Add the all-contributors bot

layer5io/docs

• [Bug] Image not rendering correctly
• Screen capture includes Grammarly
• [Docs] Floating Card Overlapping Navbar

TryGhost/Ghost

• 🌐 i18n mega-issue
• Share profile image generation is broken for some avatars and cover images
• Incorrect links from Top sources in analytics
• a11y: kg-toggle-card not usable properly with a screenreader

stdlib-js/stdlib

• Fix JavaScript lint errors
• Fix EditorConfig lint errors
• [RFC]: Add C implementation for @stdlib/stats/base/dists/beta/median
• [RFC]: Add C implementation for @stdlib/stats/base/dists/chisquare/pdf
• [RFC]: Migrate math/base/special packages from relative tolerance testing to ULP difference testing (tracking issue)
• [RFC]: Improve doctests for ndarray instances in documentation examples (tracking issue)
• Fix broken Markdown link: https://bugzilla.mozilla.org/show_bug.cgi?id=892671

LucaBonamino/Clavimit

• Key inputs are not cleared after failed decryption
• Syncr package.json version with manifest.json

code-charity/youtube

• 💡 Separate quality setting for 60 fps videos
• Settings with toggles look narrower when they're set to "on"
• 🐞live stream event doesn't start playing automatically
• 🐞Tooltips are hidden behind the video player
• Cinema mode makes my screen go black🐞
• Remember playback Speed
• 🐞pause play
• 🐞"Chapters (Sidebar) On/Off" not working in full screen
• Player buttons to be added </video>
• 🐞Classic thumbnail metadata toggle no longer working for thumbnail links below a watched video
• 🐞Weird ass color glitch
• 💡[Feature Request] Option to force resume/autoplay video after page refresh
• 💡Release latest version to Edge Extension Store
• 💡Remove 'member first' videos
• Add an option to filter videos with less than 1000 views
• 💡Display watched sections of the video on the seek bar
• 💡Manage/Restrict automated low-value PRs from specific accounts
• 💡Hide AI videos
• 💡Option to disable confirmation before closing on Youtube Music

MyZubster-Ecosystem/myzubster

• [Free] Add status badges and license
• [Agricoltori] Registro delle colture e rotazione
• [Free] Display Seed Exchanges on the map
• [Community] Creare una rete di orti urbani connessi
• [Arboristi] Mappa degli alberi monumentali
• [Botanici] Aggiungere scheda botanica dettagliata per le piante
• [Free] Scheda di dettaglio per un orto
• [Free] Aggiungere la categoria 'Orto Urbano' alla mappa globale
• [Free] Add a CONTRIBUTING.md guide
• [Free] Create a simple project website with GitHub Pages
• [Free] Add a CONTRIBUTING.md guide

meshery/meshery.io

• [Bug] Fix Meshery Docs Link Styling
• Website: Consolidate duplicative and unused CSS
• [Bug] Copy Button Flickering on Hover
• [CI] Enhance appropriate github issue templates with mention of and hyperlink to self-pace contributor training

product-on-purpose/pm-skills

• good first issue: author samples for the three remaining AI conditional sections
• good first issue: add a visual to the quickstart (screenshot or short gif of a first skill run)

Berserk-hub150/skillhawk

• [2–5 min] Define prompt injection for beginners
• [Good First Issue] Add a path-traversal review tip [MC-031]
• [Good First Issue] Add an MCP least-privilege tip [MC-011]
• [Good First Issue] Add a dependency-source trust tip [MC-030]
• [Good First Issue] Add a dependency-pinning tip [MC-013]
• [Good First Issue] Add a command-execution review tip [MC-015]
• [Good First Issue] Add a network-egress review tip [MC-014]
• [Good First Issue] Add a secret-handling tip [MC-016]
• [Good First Issue] Add a tool-permission tip [MC-018]
• [Good First Issue] Add a filesystem-scope tip [MC-017]
• [Good First Issue] Add a URL-allowlist tip [MC-020]
• [Good First Issue] Add an environment-variable tip [MC-019]
• [Good First Issue] Add a shell-interpolation tip [MC-021]
• [Good First Issue] Add an untrusted-input boundary tip [MC-023]
• [Good First Issue] Add a destructive-action confirmation tip [MC-022]
• [Good First Issue] Add a CI-scanning tip [MC-025]
• [Good First Issue] Add a logging-privacy tip [MC-024]
• [Good First Issue] Add a rule-test coverage tip [MC-026]
• [Good First Issue] Add a safe-defaults tip [MC-028]
• [Good First Issue] Add an evidence-reproducibility tip [MC-027]
• [Good First Issue] Add an external-script review tip [MC-029]
• [Good First Issue] Add an output-encoding tip [MC-032]
• [2–5 min] Add one prompt-injection remediation tip
• [2–5 min] Add one precision flashcard
• [2–5 min] Add one safe-fixture writing tip
• [2–5 min] Add one severity-labeling tip
• [2–5 min] Add one MCP config review use case
• [2–5 min] Add one false-negative reporting tip
• [2–5 min] Add one false-positive reporting tip
• [2–5 min] Add one benchmark FAQ answer
• [2–5 min] Add one local repository scan use case
• [2–5 min] Add one pull-request scanning use case
• [2–5 min] Add one Claude Code review use case
• [2–5 min] Add one Agent Skill review use case
• [2–5 min] Add one recall flashcard
• [2–5 min] Add one static-vs-dynamic analysis flashcard
• [2–5 min] Add one secrets-handling flashcard
• [2–5 min] Add one static-only safety flashcard
• [2–5 min] Add one rule ID flashcard
• [2–5 min] Add one CI security gate flashcard
• [2–5 min] Add one Code Scanning flashcard
• [2–5 min] Add one GitHub Action flashcard
• [2–5 min] Add one flashcard about zero dependencies
• [2–5 min] Define least privilege for beginners
• [2–5 min] Define remediation for beginners
• [2–5 min] Define security severity levels
• [2–5 min] Define recall for beginners
• [2–5 min] Define precision for beginners
• [2–5 min] Define false negative for beginners
• [2–5 min] Define false positive for beginners
• [2–5 min] Define SARIF for beginners
• [2–5 min] Define static analysis for beginners
• Add detection for suspicious PowerShell download-and-execute patterns
• Add a compact README demo GIF or terminal screenshot

nextcloud/forms

• Replace description fields with NcRichText

haoxiang-xu/PuPu

• web_fetch returns noise-dominated, silently truncated output that drives model fabrication
• AskUserQuestion: clearer prompt guidance and a free-text input question form
• Add Context7 to the MCP store registry (good first issue: register a new MCP server)
• Register MCP server: Bug Bounty Intelligence (smart contract security, x402 paid)

nextcloud/spreed

• Recording chunked upload would fail with token length > 13
• Go back to autopilot mode if re-clicking selected participant
• Dashboard widget should show the actual mention message
• Imprint and privacy links in public talk conversations
• Migrate addParticipantToRoom to InvitationList
• Migrate OCC to InvitationList
• Guests in voice-rooms do not see "Leave call" button
• talk couldn't work after install the “talk_matterbridge”
• Write tests for "Team resources" integration
• System message shows "guest added user" to a conversation when adding through circle/team
• Reactions notifications when fully subscribed in federated conversations
• Limit to groups in federated target server breaks federation
• Instant meeting outside of dashboard?

nextcloud/mail

• Add a CONST for the Oracle Max Chunk size and replace all occurrences

simple-icons/simple-icons

• Request: postmarketOS

open-telemetry/opentelemetry.io

• [es] Spanish folder localization guidance
• [pt] Localize content/en/docs/collector pages
• [Docs] homepage feature image is misleading
• [es] Spanish folder localization zero-code
• [es] Spanish folder localization docs/languages
• [pt] Localize content/en/docs/languages/js pages
• [pt] Localize content/en/docs/platforms pages

ProjectEvergreen/greenwood

• refactor usages of glob-promise with native NodeJS fs.glob
• windows builds fail very intermittently on various issues
• consolidate all internal rollup plugin usages to Rollup config
• Have develop command pick next randomly available port for dev and live reload servers

SecureBananaLabs/bug-bounty

• POST /api/reviews endpoint missing authentication middleware (reissue via #743)
• Automate Bug Detection and Reviews
• Implement a fully functional Admin Panel
• Benchmark APIs with p50, p95, p99 latency, RPS, error rate and TTFB
• Technical Poem Generation and Content Creation
• Pixel Art Creation with high Creative Thinking
• Low Handing Fruit Automation
• Calculate the exact value of PI #2872
• Calculate the exact value of PI
• Implement Secure Payment Gateway and Payment Service
• Bug: Missing admin role authorization check on admin metrics endpoint
• Bug: Proposal creation accepts records missing estimated duration
• Upload endpoint lacks authentication — unauthenticated file uploads allowed
• Registration token subject can drift from returned user id
• fix: prevent admin role self-assignment during registration
• Bug: Refresh endpoint mints tokens without validating a refresh token
• User creation endpoint has no input validation
• fix(auth): prevent admin role self-assignment during registration
• Bug: Multiple security vulnerabilities in API layer - registerUser() ID mismatch, missing auth, missing validation
• fix: prevent admin role self-assignment
• Admin routes lack role-based access control — any authenticated user can access admin endpoints
• Payment endpoint lacks authentication — unauthenticated payment creation
• Bug: user creation accepts empty payloads and client-controlled ids
• Bug: registerUser signs token with a different generated user id
• Bug: Rate limiter should count malformed JSON before body parsing
• fix: prevent admin role self-assignment
• CORS configured without origin allowlist in app.js (reissue via #743)
• auth refresh endpoint issues tokens without verifying the requester
• POST /api/users endpoint missing authentication middleware (reissue via #743)
• POST /api/proposals endpoint missing authentication middleware (reissue via #743)
• registerUser access token can reference a different user id
• upload endpoint accepts empty file submissions as successful uploads
• Registration should require fullName to match User model
• @freelanceflow/db package should expose an importable workspace entrypoint
• Job creation endpoint lacks authentication — anyone can post jobs
• Job validation should reject inverted budget ranges
• Freelancer profile route should resolve mock profiles by username

nextcloud/contacts

• Contact Groups edit field: horizontal scrollbar covers the contact group(s)

CesiumGS/cesium

• Irrelevant error message from PerInstanceColorAppearance

Savitura/crowdpay

• Stellar DID Layer, Cross-Campaign Reputation Score & Privacy-Preserving KYC Attestations
• Path Payment Preview, Slippage Protection & Contributor Asset Intelligence

vercel/next.js

• @next/next/no-html-link-for-pages rule does not work with pageExtensions
• Inconsistent Error Messaging / Handling in getStaticPaths

louislam/uptime-kuma

• Password Reset via CLI does not work on Embedded MariaDB
• Pausing a group does not pause the individual monitors of that group

medic/cht-core

• Investigate loading externally hosted media into forms
• Add constant for 'contact' document type
• Add constants for 'task', 'target', and 'user-settings' document types
• Add constant for 'person' document type

WordPress/gutenberg

• Make tooltips dismissable
• PostCSS/esbuild/Vite token-fallback plugins incorrectly rewrite var()-like text inside strings
• Cover block: empty block shows as black box on frontend
• Restore the full search visibility in embed links
• Dependency Extraction Webpack Plugin: Prettify the output of the development asset files
• Custom font upload not working
• Twitter embed block should expose options for how the tweet is displayed
• Audio Block: Autoplay does not happen on first load
• Improve the manual git cherry-pick instructions left when performing an automatic cherry-pick fails
• Documentation: Clarify the behavior of parent when empty during block registration
• Allow the PanelColorSettings to be visible if no colors and but with children
• NumberControl: Disable dragging on touch devices
• ESLint plugin: Relax the rule for @since in JSDoc
• The category set in Default Post Category is not selected in the display when posting a new post.