Good First Issues

This is a list of JavaScript repositories with good first issues for newcomers to open source. Contributions are welcome!

This list gets updated every day at midnight.

modusensus/dsh-mneme

• [Feature] 面板标注「极简模式下注入按宿主设计关闭」
• [Feature Request] scope 标注缺人工入口与提升回路：自动载体标签不该直接吃硬过滤效力

chrisriv10/Soterios

• Upgrade CodeQL to v4 and add Rust analysis
• Avoid hard-coded release versions in README download instructions
• Bound the FolderWatcher scan queue and recent-scan dedup state
• Add CI checks for broken links in README and documentation
• Add Dependabot updates for npm, GitHub Actions, and Rust dependencies
• Add polished product screenshots and an animated demo to the README

Zoverions/AXIOM-MESH

• Security Agent Cell Pilot #1 — independently attack RT-AUTH-001
• Agent Community engagement: first outside Security Cell result
• Community Testnet v0 — recruit independent operators and hardware evidence
• Agent Commons: external-agent contribution and interoperability layer

Jason-Vaughan/TangleClaw

• ui/integration: six v2 palette pairs fall below the 4.5:1 contrast floor
• Add JSDoc to the 9 undocumented private helpers
• [feature] Set CLAUDE_CODE_ARTIFACT_AUTO_OPEN=0 for spawned Claude sessions — artifact tabs pile up on a host nobody watches
• tests: stop regex-matching exact public/* source text in frontend tests
• Tighten FEATURES.md citation-contract coverage
• [chore] Log when resolveSessionRange downgrades a session SHA to the trunk range
• wrap: changelog promotion emits headings with no link-reference defs
• projects: stranded-config guard misses .gemini artifacts
• Suppress node:sqlite ExperimentalWarning via --disable-warning flag

vicharanashala/tenali

• Wire BKT into lil/masteryEngine so mastery is actually computed and persisted
• Fold Guess the Number into its parent topic (bases - it is a binary trick)
• Fold Comic Addition into Addition
• Docs overstate BKT: spacingLadder is not BKT-driven, and server/lib/bkt.js is not a shared utility
• Use the canonical gym names
• Fix eslint errors in the 49 remaining low-count client files
• Confirm the API contract test still passes after the removal
• Drop the three stale vite proxy entries on main
• Fold Idli Vada Sambhar and The Car Journey into their parent topics
• Fix the contradictory puzzle counts in the README

meshery/meshery.io

• [DevOps] Populate Meshery Catalog with Sample Apps using meshery UI
• Website: Consolidate duplicative and unused CSS
• Touch interactions provide no visual feedback on Catalog cards in mobile view
• [Bug] Fix Meshery Docs Link Styling
• [Bug] Copy Button Flickering on Hover

RikepilB/spaceapps-harness-plan

• Link checker: Node fetch fails on hosts that curl reaches
• Update the hardcoded eval model from claude-opus-4-8

Venari-Hunt/Noctivago

• Add a README to the hello-world plugin explaining how to write a plugin
• CI: update GitHub Actions off the deprecated Node 20 runtime

CarolineChiari/AgentVille

• Villagers wear their names
• Move around with WASD, and smooth held-key panning
• Docs: how to write a harness adapter
• Content Security Policy for the page
• Remember the window size and position between launches
• Tasks every repo offers, and placeholders in task prompts
• A better empty state and a first-run tour
• Send a villager to review a PR, from its bud

vercel/next.js

• Parameter on AppType is used incorrectly
• @next/next/no-html-link-for-pages rule does not work with pageExtensions
• Redux-observable server side fetching
• getInitialProps is not running when Router.replace's "href" and "as" contains hash and query params inside "href" change.
• Scrolling happens when user returns to a page with hash using browser back button
• Dynamic Routes in Symlinks is not working
• Misleading "next-head-count is missing" error for invalid head tags
• POST request succeeds for pages with next dev
• Inconsistent Error Messaging / Handling in getStaticPaths

Techtonica/curriculum

• Update documentation for outdated topic outlines
• Create topic outline with interactive walkthrough and visuals for NP Completeness
• Create topic outline with interactive walkthrough and visuals for Strongly Connected Components
• Create topic outline with interactive walkthrough and visuals for Heavy & Light Decomposition
• Create topic outline with interactive walkthrough and visuals for Ford-Fulkerson Algorithm
• Create topic outline with interactive walkthrough and visuals for Edmonds-Karp Algorithm
• Create topic outline with interactive walkthrough and visuals for Floyd-Warshall Algorithm
• Create topic outline with interactive walkthrough and visuals for Bellman-Ford Algorithm
• Create topic outline with interactive walkthrough and visuals for Bitmasking or Subset DP
• Create topic outline with interactive walkthrough and visuals for Disjoint Set Union or Union-Find
• Create topic outline with interactive walkthrough and visuals for Maximum number of non-overlapping intervals on an axis

nextcloud/spreed

• talk couldn't work after install the “talk_matterbridge”
• Write tests for "Team resources" integration
• System message shows "guest added user" to a conversation when adding through circle/team
• Reactions notifications when fully subscribed in federated conversations
• Limit to groups in federated target server breaks federation
• Instant meeting outside of dashboard?
• Recording chunked upload would fail with token length > 13
• Go back to autopilot mode if re-clicking selected participant
• Dashboard widget should show the actual mention message
• Imprint and privacy links in public talk conversations
• Migrate addParticipantToRoom to InvitationList
• Migrate OCC to InvitationList
• Guests in voice-rooms do not see "Leave call" button

career-ops-hq/career-ops

• i18n(fr): bring the French interview modes (plan/practice/debrief) back to parity with the English ones
• i18n: translate the interview modes (plan/practice/debrief) to Portuguese (Brazil)
• feat(scan): domain-level aggregator repost list, complementing the SimHash cross-listing warning
• feat(cli): four documented scripts have no --help — add the usage block (one script per PR)
• i18n: translate the interview modes (plan/practice/debrief) to Spanish
• i18n(pl): re-sync modes/pl/oferta.md (Polish) to the canonical A–H + Risk Summary structure
• i18n: add the interview README to de/id/ru/ua/zh (one language per PR)
• Native-speaker check wanted: the human-in-the-loop row in 11 languages (a940028a)
• fix(analyze-patterns): --min-threshold and --min-vendor-n values are never validated
• update-system.mjs commits the auto-update onto whatever branch you are on, including a contributor's feature branch
• Umbrella: bring the Hired Wall section to the 16 localized READMEs
• i18n(ua): re-sync modes/ua/oferta.md (Ukrainian) to the canonical A–H + Risk Summary structure
• verify-cv-facts: flag scope-verb inflation and unsourced adoption claims, not just numbers
• i18n(pt): re-sync modes/pt/oferta.md (Portuguese) to the canonical A–H + Risk Summary structure
• i18n(da): re-sync modes/da/oferta.md (Danish) to the canonical A–H + Risk Summary structure
• i18n: translate the interview modes (plan/practice/debrief) to Indonesian
• docs(i18n): translate the new README FAQ into the remaining 13 languages
• i18n: translate the interview modes (plan/practice/debrief) to Polish
• i18n: translate the interview modes (plan/practice/debrief) to Korean
• i18n: translate the interview modes (plan/practice/debrief) to Japanese

404-PF/commit-echo

• [Bug] Streaming ignores delta.reasoning_content, so reasoning models stream nothing / yield unparseable output
• [Bug] Malformed SSE JSON chunks are silently swallowed in streaming
• [Bug] Batch mode skips repositories with only untracked files
• [Performance] countEntries() reads the entire history.jsonl into memory
• [Bug] batch and git hooks call bare git, bypassing the resolved executable
• [Bug] Global --no-color flag is a no-op for all commands

microcks/microcks.io

• External Link Check Report
• Align and pin Hugo across local deployment, CI, and Netlify

louislam/uptime-kuma

• Password Reset via CLI does not work on Embedded MariaDB

ProjectEvergreen/greenwood

• windows builds fail very intermittently on various issues
• refactor usages of glob-promise with native NodeJS fs.glob

agilare/ladecadanse

• Event copy: replace the two date fields with a date range picker (Air Datepicker)
• SEO: homepage meta description ignored by Google (too long, keyword list)
• Organizer: add a Type(s) field
• Front-end libraries : manage them all with npm, one source of truth instead of three
• 4. Setup unit tests
• Event : make "Signaler une erreur" easier to use
• Clean web/css/ (step 1) : Cleanup — duplicate imprimer.css, browser hacks, commented-out declarations
• SEO: no rel=canonical anywhere on the site
• Event : replace Zebra Datepicker in forms by native <input type="date"> ?
• Lieu, organisateur : add a new "en pause" status

dheerajjha/reviewer

• npm test fails on Windows and no CI leg would ever tell us (needs a Windows machine)
• The file sidebar renders only 2 of 5 statuses, so deleted, binary and renamed files all look modified

camunda/camunda-modeler

• Form Text Field is not resizable

SecureBananaLabs/bug-bounty

• Low Handing Fruit Automation
• Pixel Art Creation with high Creative Thinking
• Implement a fully functional Admin Panel
• upload endpoint accepts empty file submissions as successful uploads
• POST /api/reviews endpoint missing authentication middleware (reissue via #743)
• registerUser access token can reference a different user id
• Job validation should reject inverted budget ranges
• Technical Poem Generation and Content Creation
• auth refresh endpoint issues tokens without verifying the requester
• User creation endpoint has no input validation
• Automate Bug Detection and Reviews
• Benchmark APIs with p50, p95, p99 latency, RPS, error rate and TTFB
• Calculate the exact value of PI #2872
• Calculate the exact value of PI
• Implement Secure Payment Gateway and Payment Service
• Bug: Missing admin role authorization check on admin metrics endpoint
• Bug: Proposal creation accepts records missing estimated duration
• Upload endpoint lacks authentication — unauthenticated file uploads allowed
• Registration token subject can drift from returned user id
• fix: prevent admin role self-assignment during registration
• Bug: Refresh endpoint mints tokens without validating a refresh token
• fix(auth): prevent admin role self-assignment during registration
• Bug: Multiple security vulnerabilities in API layer - registerUser() ID mismatch, missing auth, missing validation
• fix: prevent admin role self-assignment
• Admin routes lack role-based access control — any authenticated user can access admin endpoints
• Payment endpoint lacks authentication — unauthenticated payment creation
• Bug: user creation accepts empty payloads and client-controlled ids
• Bug: registerUser signs token with a different generated user id
• Bug: Rate limiter should count malformed JSON before body parsing
• fix: prevent admin role self-assignment
• CORS configured without origin allowlist in app.js (reissue via #743)
• POST /api/users endpoint missing authentication middleware (reissue via #743)
• POST /api/proposals endpoint missing authentication middleware (reissue via #743)
• Registration should require fullName to match User model
• @freelanceflow/db package should expose an importable workspace entrypoint

PipedreamHQ/pipedream

• [ACTION] Rewardful — Affiliate & Commission Management
• Add tools to Yahoo Sports
• [TRIGGER]
• Open new source to check Webhook [TRIGGER]
• eBay Creating/Publishing Listings
• [ACTION]
• [riddle_quiz_maker] Update app metadata: description, logo and MCP URL

Berserk-hub150/skillhawk

• [Good First Issue] Add an educational-warning tip [MC-016]
• [Good First Issue] Add an actionable-remediation tip [MC-003]
• [Good First Issue] Add a minimal-evidence tip [MC-002]
• [Good First Issue] Add a false-positive review tip [MC-004]
• [Good First Issue] Add a severity calibration tip [MC-006]
• [Good First Issue] Add a narrow-rule design tip [MC-005]
• [Good First Issue] Add a safe-fixture writing tip [MC-007]
• [Good First Issue] Add a suspicious-fixture writing tip [MC-008]
• [Good First Issue] Add a SKILL.md trust-boundary tip [MC-012]
• [Good First Issue] Add a redaction tip [MC-009]
• [Good First Issue] Add a SARIF-result tip [MC-015]
• [Good First Issue] Add a regression-test tip [MC-014]
• [2–5 min] Define static analysis for beginners
• [2–5 min] Define prompt injection for beginners
• [2–5 min] Add one prompt-injection remediation tip

GoogleChrome/lighthouse

• runWarnings format difficult for pragmatic usage
• Add a check to test if :hover styles require doubletapping links
• "Properly size image" report is too strict?
• Add guidance about preferring secure canonical links

i-ops-hq/iops-rooms

• The live-server test flakes on Windows with EBUSY during temp cleanup
• One test fails on every branch that is not main, so contributors always see red
• The README's images are broken on npm — they are not in the published tarball
• The npm page describes a different product from the README

genome-spy/genome-spy

• Feature Request: Line Charts

Mayor-s-Office-of-Innovation/good-neighbor-app

• As a PFS user, I can see a lightbox version of any photo in the app
• Use lower res imagery for card thumbnails

medic/cht-core

• Add constant for 'person' document type
• Add constant for 'contact' document type
• Add constants for 'task', 'target', and 'user-settings' document types

taskcluster/taskcluster

• Dependencies / Dependents list should have identical maximum height and indication if they are scrollable

jellyfin/jellyfin-web

• The homepage only displays the backdrops from libraries of the "movie" type

TheFleece/dota2-mod-manager

• Linux: check that preset links and .d2mm files open the app
• Mask the account name in the diagnostic report