Good First Issues

This is a list of JavaScript repositories with good first issues for newcomers to open source. Contributions are welcome!

This list gets updated every day at midnight.

davgross/homeless-in-slo-resource-guide

• "The Loop" at Cal Poly
• Add "Hope for Ashlynn" group
• New residential mental health facility for youth in SLO

SecureBananaLabs/bug-bounty

• Low Handing Fruit Automation
• Automate Bug Detection and Reviews
• upload endpoint accepts empty file submissions as successful uploads
• Search endpoint has no input validation or length limit on query
• Implement Secure Payment Gateway and Payment Service
• Implement a fully functional Admin Panel
• Benchmark APIs with p50, p95, p99 latency, RPS, error rate and TTFB
• Technical Poem Generation and Content Creation
• Pixel Art Creation with high Creative Thinking
• Calculate the exact value of PI #2872
• Calculate the exact value of PI
• Job validation should reject inverted budget ranges
• Reject inverted job budget ranges in job validation
• Freelancer profile route should resolve mock profiles by username
• Reject inverted job budget ranges in job validation
• registerUser access token can reference a different user id
• auth refresh endpoint issues tokens without verifying the requester
• Refresh token endpoint ignores the provided refresh token
• Registration token subject can drift from returned user id
• fix(auth): prevent admin role self-assignment during registration
• Bug: Proposal creation accepts records missing estimated duration
• Bug: Missing admin role authorization check on admin metrics endpoint
• Bug: Refresh endpoint mints tokens without validating a refresh token
• User creation endpoint has no input validation
• Payment endpoint lacks authentication — unauthenticated payment creation
• Upload endpoint lacks authentication — unauthenticated file uploads allowed
• Admin routes lack role-based access control — any authenticated user can access admin endpoints
• @freelanceflow/ui package entrypoint should be directly importable (reissue via #743)
• Notification creation should preserve server-owned id and read state
• Payment API should require authentication
• fix: prevent admin role self-assignment during registration
• fix: enforce authentication on job creation endpoint
• fix: prevent admin role self-assignment
• fix: prevent admin role self-assignment during registration
• fix: prevent admin role self-assignment

open-telemetry/opentelemetry.io

• [pt] Localize content/en/docs/collector pages
• [es] Spanish folder localization docs/demo
• [es] Spanish folder localization zero-code
• [es] Spanish folder localization guidance
• [es] Spanish folder localization docs/languages
• [es] Spanish folder localization blogs
• [es] Spanish folder localization docs/Platforms

nodejs/node

• test_runner: print failed coverage reports with dot runner
• Cpplint produces false positives for FastApiOptions
• Writable does not check if stream has been destroyed during _final and _write
• FATAL ERROR: v8::ToLocalChecked Empty MaybeLocal
• TextDecoder does not error incorrectly for legacy byte sequences
• test_runner: do not read from process.argv and process.cwd() in run()

OWASP/threat-dragon

• Add version to Docs site
• Automation: Trivy misreporting in housekeeping
• Feature: provide quick-start guide for new users

meshery/meshery.io

• [CI] Enhance appropriate github issue templates with mention of and hyperlink to self-pace contributor training
• Website: Consolidate duplicative and unused CSS
• [DevOps] Populate Meshery Catalog with Sample Apps using meshery UI

stdlib-js/stdlib

• Fix JavaScript lint errors
• [RFC]: add symbol/to-string-tag
• Fix JavaScript lint errors
• [RFC]: Migrate math/base/special packages from relative tolerance testing to ULP difference testing (tracking issue)
• Fix JavaScript lint errors

nextcloud/deck

• Attachments can not be deleted

nextcloud/spreed

• Guests in voice-rooms do not see "Leave call" button
• [Bug] Talk fails to upload files over HTTP (crypto.randomUUID is not a function)
• Compatibility with Cloudflare Calls (TURN & STUN servers)
• Dashboard widget should show the actual mention message
• Delete messages completely instead of showing "Message deleted by you" in "Note to self"

Fmarzochi/EGC

• test(v1.1.17): upgrade or install on Windows and report behavior
• test(v1.1.17): upgrade or install on macOS and report behavior

vercel/next.js

• @next/next/no-html-link-for-pages rule does not work with pageExtensions
• Redux-observable server side fetching
• Misleading "next-head-count is missing" error for invalid head tags
• Dynamic Routes in Symlinks is not working

louislam/uptime-kuma

• Pausing a group does not pause the individual monitors of that group
• On the maintenance creation form, link start and end times together

jeremysball/taskferry

• resolveInvokedPath duplicated verbatim between cli.js and client.js
• checkClaudeIntegration duplicates the ENOENT/status/success pattern PR #199 just extracted
• logHasEventCache eviction duplicated across 3 task-settlement paths
• checkBwrapAvailable and checkBwrapAvailableAsync are two copies of the same logic, sync and async
• sanitizeActivityText recompiles its regexes on every call instead of hoisting them to module scope
• The mkdirSync+chmodSync 0700 directory-setup pattern is copy-pasted in three files
• parseNumber() reimplements the safe-integer check already centralized in numbers.js
• emptyCounts() in daemon.js duplicates the status-counts literal already inline in tasks.js's list()
• responseError() reimplements errorValue()'s error/help line extraction
• sandboxAuthFile's name/typedef no longer matches its post-#142 behavior
• New pi-executor sandbox test in executor.test.js is redundant with an existing one
• tasks.test.js hand-reimplements piExecutor().sandboxAuthFile() instead of importing it
• Drop the unnecessary array copy of executor-provided ro-binds in startTask()
• result message truncation
• wait --summarize model override
• defaultTaskManager is dead code with import-time side effects and a stale comment
• Surface completion timestamp in list/status output

hackforla/tdm-calculator

• Dev: Update notes icon in Admin

TryGhost/Ghost

• Newsletter - H1 tag missing
• Header card HTML parser incorrectly defaults to split layout when image is present
• Share profile image generation is broken for some avatars and cover images
• {{contrast_text_color}} helper returns incorrect text color
• a11y: kg-toggle-card not usable properly with a screenreader

HarperFast/harper

• static file handler should have configurable index.html
• Update TLS privateKey to use relative path and update tests
• Incorrect logic for matching index.html

WordPress/gutenberg

• Make tooltips dismissable
• RichText: registerFormatType should allow identification by style rule
• Dependency Extraction Webpack Plugin: Prettify the output of the development asset files
• DEWP docs and implementation mismatch/confusion in regards of assets file name
• The description of the More block is not clear
• Original PRs may not be tagged properly when a manual cherry-pick is performed.
• Documentation: Clarify the behavior of parent when empty during block registration
• "Read more" options for post excerpts do not contain accessible names
• Coding standards: Use WordPress-Extra ruleset to prevent potential security issues
• Column block: Dropping block into an empty column using a drop zone.
• check-licenses: GPLv3 isn't recognized as a compatible license

prometheus/client_js

• [BUG] ERR_IPC_CHANNEL_CLOSED showing up on new deployments
• Please consider adding a getClusterMetricsAsJSON funtion
• Compliancy the default metrics with Prometheus Naming Convention

SemanticMediaWiki/SemanticResultFormats

• [jqplot] use .jqplot-container instead of .container CSS class

CircuitVerse/CircuitVerse

• 🐞 Bug : Image upload in simulator fails due to Imgur API error
• Remove feature flag active_storage_s3

lapic-ufjf/searchat-behavior-ui

• Split ICF description into multiple input texts fields
• Questionnaires: Include a blank space between question statement and the input boxes

Savitura/crowdpay

• Getting Started for New Contributors
• Public Campaign Embed API; JWT-Scoped Embed Tokens, iframe Widget & Cross-Origin Contribution Flow

ronak-create/FableCut

• Design a new animated SVG element for the built-in library
• examples/auto-captions: STT word timestamps -> karaoke text clips

Avenx-JS/avenx-js

• Good First Issue: Add Prettier Configuration Template to avenx init output
• Docs: Document Warning Code AVX_W28 (COMPILER_MULTIPLE_STATE_TAGS)
• Docs: Document Warning Code AVX_W27 (ROUTER_GUARD_UNDEFINED_RETURN)
• Docs: Document Missing Key Modifiers (.esc, .space, .tab, .delete) in Event Handling Guide
• Docs: Document Performance Profiling API, Dynamic Runtime Flag, and Measure Formatting
• Docs: Document the LruCache Utility API
• Docs: Document Warning Code AVX_W25 (COMPILER_INVALID_CONFIG)
• Docs: Document Warning Code AVX_W09 (ROUTE_PARAM_DECODE_FAILED)
• Docs: Document Warning Code AVX_W02 (COMPILER_EMPTY_TEMPLATE)
• Good First Issue: Document Compiler Error Code AVX_C02 (COMPILER_SRC_DIR_MISSING)
• Good First Issue: Add --version / -v Options to CLI Tool
• Docs: Document Route Guard Control Objects for Custom Redirects and Query Parameters
• Docs: Document StateFactory Options and the onChange Callback API
• Docs: Document the Mock Route Object Structure in AvenxSandbox.setRoute(route)
• Docs: Add Developer Guide for TypeScript & JSDoc Type Support
• Good First Issue: Handle Anonymous and Unnamed Component Classes in StyleMountManager
• Good First Issue: Make VirtualList Responsive to Viewport Container Resizing
• Good First Issue: Support Keyboard System Modifier Keys in EventBinder
• Select Dynamic Option Double-Binding Failure
• Good First Issue: Document Implicit index Variable inside VirtualList Template Slots
• Docs: Document the provide/inject API for ancestor-descendant communication
• Docs: Document Route Guards and provide usage examples
• Good First Issue: Standardize validation error guidelines in compiler and runtime agent files
• Good First Issue: Refine CLI Agent instructions for new subcommands in .agents/cli_agent.md
• Good First Issue: Add authentication guard page sample in templates
• Good First Issue: Document Warning Code AVX_W21 (DIRECTIVE_HTML_EVALUATION_FAILED)
• Good First Issue: Custom registration paths inside Duplicate Component Name error
• Good First Issue: Unit Test Cases for Router Guard Redirects
• Good First Issue: Enhance CLI Help Command with ANSI Colors
• Good First Issue: Document Warning Code AVX_W22 (DIRECTIVE_SHOW_EVALUATION_FAILED)
• Good First Issue: Clarify Component Registry Documentation in AvenxPage API Reference
• Good First Issue: Document Warning Code AVX_W20 (RENDER_LIST_DUPLICATE_KEY)
• Component Unmount Does Not Remove Scoped Style Elements Concurrently
• Document Warning Code AVX_W19 (RENDER_KEY_EVALUATION_FAILED)
• Document Warning Code AVX_W14 (COMPONENT_RESTORE_SLOT_CONTENT_FAILED)
• Doc: Document Reactivity Tracking Exclusions (Symbols and Non-Plain Objects)
• Document Warning Code AVX_W18 (RENDER_LIST_EVALUATION_FAILED)
• Declarative State Persistence Utility (data-persist)
• Fix Incorrect Signature and Example for AvenxApp.mount() in API Reference
• Document Automatic HTML Boolean Attributes Coercion in Templates
• Automatic Watcher Cleanup on Component Unmount
• Document CLI check/lint command in CLI reference
• Import and Package Name Inconsistencies (avenx-js vs. avenx-core)

PipedreamHQ/pipedream

• [ACTION] [App] Ringba — request for additional pre-built components
• [ACTION] Add action to process a refund for Shopify orders
• [ACTION] DPD Shipping - Get Tracking Data with Weight (detail=3)
• Feature Request: Expand Monta Connector Coverage
• Tools for Sugar CRM
• [ACTION] Jira: Download Attachment
• Meta Ads
• [ACTION] Zendesk - side conversations
• [ACTION] Contacts+

nodejs/undici

• Improve tests with more checks for unexpected 'disconnect'
• Default fetch timeout too short

jlab-sensing/ENTS-backend

• Cannot download sensor data with csv

gsmmediaro/fulcru

• Add an --endpoint flag
• Respect NO_COLOR and add colour to the gaps output
• Validate the report section instead of sending a typo to the server
• Say something useful when the network is down
• Add fulcru --version

fastify/fastify

• How to separate api endpoints in google cloud.
• Support pino logger customAttributeKeys to replace existing req res reqId log record fields

google/site-kit-wp

• Add next report date to the subscription status box
• PSI module - See full details link enhancement
• Add features menu for mobile and tablet viewports
• Replace usage of Lodash cloneDeep with native structuredClone.

CesiumGS/cesium

• Ongoing documentation fixes
• Docs Demo of WebMapTileServiceImageryProvider giving error
• EntityCluster hasLabelIndex always returns false
• clockTrackedDataSource tracks non-clock dataSources

jeremysball/token-burn-dashboard

• Analytics table: can't scroll horizontally on mobile; column headers should sort
• Show a clearer error when the dashboard can't reach the backend
• Redo README with real screenshots
• handleSpikesListRoute missing writableEnded guard (same class as #26)

opengeo-tech/GeoPicker

• OGC API Features - endpoint integration
• process metadata in input geometry
• unit testing