Good First Issues

This is a list of JavaScript repositories with good first issues for newcomers to open source. Contributions are welcome!

This list gets updated every day at midnight.

eyal-weiss/wonderlattice

• Room idea: Light a town 100 km away (why power lines use high voltage)
• Room idea: The shape hiding inside randomness (a Galton board)
• Room idea: Random jumps, perfect triangle (the chaos game)
• Room idea: The sunflower's secret angle (the golden angle)
• Room idea: Fold a dragon (the paper-folding curve)
• Room idea: Rhythms from Euclid (evenly spread beats)
• Room idea: The punishment illusion (regression to the mean)
• Room idea: Needles that know π (Buffon's needle)
• Room idea: The ruler on its edge (why beams are I-shaped)

darshi1337/apogee

• [chore] Add TTL to pendingFinalizeRetries
• [chore] Share or document duplicated limit constants
• [bug] suggest-questions-bg rebuilds promptsCacheKey without focusKeyword
• [bug] Hidden focus keyword fragments summary cache keys
• [bug] Video path drops focusKeyword in ollamaSummarize
• [chore] Combine duplicated focus keyword reset into clearFocusKeyword() helper
• [chore] Name timeout, retry, and delay magic numbers
• [chore] Remove unused makeOpusTranslateFn export
• [chore] Remove unused MAX_VIEW_STATE_BYTES export
• [test] Export RETRIEVAL_CHUNK_CHARS and pin with test

nodejs/undici

• SSRF protection in undici / native-node-fetch
• HTTP2 Requests hang upon receiving 'Stream closed with error code NGHTTP2_INTERNAL_ERROR'

Uuriko/project-room

• Verify open-room share-link flow end-to-end post-#817; close #612 or file follow-ups
• scripts/room rebuild --commit-push aborts when --out is inside the repo cwd
• [instinct-comms] Member-map lookups should use own-property checks (hardening, low)
• Agents start here — join the live room in 5 minutes
• [good-first] scripts/room claim --lane accepts values the parser can't read (not fail-closed)
• [good-first] Docs-only: ROOM-PROTOCOL.md never states the lane-tag charset
• [good-first] lease: 6h rejected with an error that doesn't say the fix
• [good-first] prose/malformed board comments vanish — no log entry at all
• [good-first] Lane tags with spaces parse as prose — claim silently never registers
• [good-first] Dead links to removed AGENT-CONNECTION.md, AGENT-HOSTS.md and AGENT-WRITE-GUIDE.md in dated docs

Hylozoic/hylo

• Add Join button to events that have a virtual meeting link 15 minutes before the event
• New SPARKLE for Tracks button
• Add user rsvp calendar sub link to Calendar ViewMode
• Off-page overflow in message thread
• translation script sort reverses case
• Layout: highlighted comment missing top margin/padding

nextcloud/text

• Ctrl+A inside table cell should only select all of the cell's content instead of the whole document.

myselfsiddharth/Flecto

• CHANGELOG release sections keep growing duplicate ### headings — add a check
• Document that a committed .flectorc ignore can silence the merge gate
• Warn when the baseline resolves to an empty document, so it is distinguishable from "nothing changed"
• Exclude Google Place IDs and IPFS CIDv0 from the entropy secret detector
• Correct the "0 false positives" claim in src/secrets.js to name its corpus

nextcloud/serverinfo

• Do not show EFI boot partition in serverinfo#status

vercel/next.js

• ISG with GIP in _app overrides cache-control of ISG page
• @next/next/no-html-link-for-pages rule does not work with pageExtensions
• Parameter on AppType is used incorrectly

nextcloud/mail

• Specify rich text colors in RGB or Hex by default
• Show email next to name in Search dropdown
• Change Message-ID format

Indicaza/holdfast

• [Good first issue] Add a friendly local persona chooser for development
• [Good first issue] Add an internal Markdown link checker to CI
• [Good first issue] Add sanitized product screenshots to the README

meshery/meshery.io

• [Bug] Copy Button Flickering on Hover
• [DevOps] Populate Meshery Catalog with Sample Apps using meshery UI
• Website: Consolidate duplicative and unused CSS
• Touch interactions provide no visual feedback on Catalog cards in mobile view

SecureBananaLabs/bug-bounty

• Technical Poem Generation and Content Creation
• Low Handing Fruit Automation
• Benchmark APIs with p50, p95, p99 latency, RPS, error rate and TTFB
• Pixel Art Creation with high Creative Thinking
• Search endpoint has no input validation or length limit on query
• Automate Bug Detection and Reviews
• Reject inverted job budget ranges in job validation
• registerUser access token can reference a different user id
• auth refresh endpoint issues tokens without verifying the requester
• Freelancer profile route should resolve mock profiles by username
• upload endpoint accepts empty file submissions as successful uploads
• Job validation should reject inverted budget ranges
• Calculate the exact value of PI #2872
• Calculate the exact value of PI
• CORS configured without origin allowlist in app.js (reissue via #743)
• Bug: user creation accepts empty payloads and client-controlled ids
• Admin routes lack role-based access control — any authenticated user can access admin endpoints
• Upload endpoint lacks authentication — unauthenticated file uploads allowed
• Payment endpoint lacks authentication — unauthenticated payment creation
• User creation endpoint has no input validation
• POST /api/proposals endpoint missing authentication middleware (reissue via #743)
• POST /api/reviews endpoint missing authentication middleware (reissue via #743)
• POST /api/users endpoint missing authentication middleware (reissue via #743)
• Implement a fully functional Admin Panel

WordPress/gutenberg

• NumberControl: Disable dragging on touch devices
• Make tooltips dismissable
• Page jumps away when trying to edit an anchor link if you only enter #
• Problem with updating widgets
• stylelint-config: the selector-class-pattern rule rejects some default block, widget, and editor classes
• Original PRs may not be tagged properly when a manual cherry-pick is performed.
• Insert image using url for cover
• Add linting rule to fail build if package A incorrectly depends on package B

Open-Sourcery-UMD/random-dungeon-gen

• Log out and Settings
• Dungeon Generation Technique Research

Ryoseiimai/pocket-gym

• ダンベル種目に重さの目安を書く
• 実行画面の「次:」表記を「次のセット」に直す
• 種目を1つ追加する

aadorian/opencodeCLI

• chore(deps-dev): bump the vscode-test group with 2 updates
• chore(deps-dev): bump sharp from 0.35.2 to 0.35.5
• chore(deps-dev): bump playwright from 1.62.1 to 1.63.0

RexCode-Digital/shopify-upgrade-guard

• Add Windows path and symlink discovery fixtures
• Add one evidence-backed Customer Account or POS migration rule

stdlib-js/stdlib

• Fix JavaScript lint errors
• [RFC]: Migrate math/base/special packages from relative tolerance testing to ULP difference testing (tracking issue)
• Fix broken Markdown link: http://www.speech.cs.cmu.edu/cgi-bin/cmudict#about
• Fix JavaScript lint errors

nextcloud/spreed

• Always show filters in conversation search
• Option to set "Original image quality" as default setting
• talk couldn't work after install the “talk_matterbridge”
• Write tests for "Team resources" integration
• System message shows "guest added user" to a conversation when adding through circle/team
• Reactions notifications when fully subscribed in federated conversations
• Limit to groups in federated target server breaks federation
• Instant meeting outside of dashboard?
• Go back to autopilot mode if re-clicking selected participant
• Imprint and privacy links in public talk conversations
• Migrate addParticipantToRoom to InvitationList
• Migrate OCC to InvitationList
• Guests in voice-rooms do not see "Leave call" button

RexCode-Digital/shopify-app-changeguard

• Add redaction regression cases for URL-bearing app configuration
• Add privacy-safe webhook and Events fixture coverage

Mito1st-Information-Committee/mito1-digital-studenthandbook

• 保健室利用規定の並び順
• 教育課程の整理
• 年間主要行事の項目整理

louislam/uptime-kuma

• Password Reset via CLI does not work on Embedded MariaDB

ProjectEvergreen/greenwood

• windows builds fail very intermittently on various issues
• update Greenwood to address all (as many) TypeScript no check comments
• init scaffolding should prompt for installing Greenwood plugins

happy520ai/unified-ai-system

• No test covers the loopback half of http.js:114 - authRequired is only asserted from the authenticated side
• Our survey pages stated denominators their own tables contradicted (2/19 where the tally says 2/18)
• Add a secure Helm chart for the HTTP gateway (Phase 1)
• docs: extend MCP client matrix with verified client runs

processing/p5.js-web-editor

• Placeholder link style contrast refactor
• Clicking on the user-menu button breaks the screen layout
• Keyword Syntax highlighting still outdated

kiril6/vibeaudio

• Linux audibility: paplay and aplay untested, ffplay plumbing verified
• Add a new music genre

kiril6/termdeck

• Add a Web App Manifest so termdeck installs as a PWA
• Layout presets (1×1, 2×1, 2×2…) and Alt+1–9 to jump to a terminal

International-Arctic/Arctic-Trade-Lanes

• good first issue: densify remaining softish ATL ports (Nuupiluk / Indiga Cape Rumyanichny)
• good first issue: densify remaining soft ATL industry pins (Disko hydro / Sovinoye / Azane / Ranua / Kristinestad / …)
• good first issue: densify remaining soft ATL ports (Ura Guba / Wrangell / Indiga / Hoybukta / Nuupiluk)
• good first issue: densify Far East soft shipyard pins (Kawasaki / Hudong / Wuchang / Sembcorp / Hyundai soft)
• good first issue: densify remaining 2 port↔city stacks (Obskaya/Chevak)
• good first issue: densify US soft shipyard pins (Vigor / VT Halter / Eastern)
• good first issue: densify ARC-SHIP-069 Sevgiprorybflot off Murmansk city centroid
• GIS: densify remaining port↔city centroid stacks (help wanted)
• good first issue: densify remaining port↔city stacks (Barentsburg/Kangerlussuaq/Salekhard/…)
• GIS: densify remaining port↔city centroid stacks (help wanted)
• good first issue: CI for port↔city centroid densify (Maniitsoq/Mehamn/Oksfjord/Kjøllefjord/Seward/Fuglafjørður)
• good first issue: CI for port↔city centroid densify (Sisimiut/Akureyri/Churchill/Valdez/Kemi/Raahe)
• good first issue: CI for port↔city centroid densify (9 harbours)
• good first issue: CI for Vardø city diacritic + PORT-094/076 + AIR-010 densify
• good first issue: CI for city diacritic + Inuvik airport near-dup densify
• good first issue: CI for port soft-stack densify (096/097/100/146) + industry city offs
• good first issue: CI for coarse industry densify (Tornio/Laanila/Malmbjerg/Jan Mayen/Helguvík)
• good first issue: CI for Hammerfest Markoppneset/Rypefjorden densify (FAC-344/358)
• good first issue: CI for Utqiagvik ASRC/UIC Agvik densify + bare atlas.geojson
• good first issue: CI for industry centroid densify (NGA Bjerkvik / AWA Gruve 3 / Hotellneset)
• good first issue: CI for port LOCODE+coord stacks + NOVAW→NOVAO
• good first issue: CI for port expansion densify (restore soft-deduped berths)
• good first issue: CI for shipyard CSV column-shift (033/052/025)
• good first issue: CI for White Mountain densify + Whittier dock vs tunnel + Gamneset
• good first issue: CI assert port UN/LOCODE shape + banned aliases
• good first issue: CI for shipyard TBD ghost pins + banned Helsinki/Nuuk dups
• good first issue: CI for duplicate shipyard id + program name+coord pins
• good first issue: implement client-side filterGeoJson (null island / OOB / dedupe)
• good first issue: CI fail on duplicate program_id / Feature.id (airports+extras)
• good first issue: CI fail on non-empty unresolved_lane_waypoints
• good first issue: CI for lane start_port teleport (lon<-100 on non-Americas corridors)
• good first issue: extend CITY_TO_ISO2 for multi-country program HQ pins
• good first issue: assert atlas CRS stamps (4326 vs 3996) in CI

Deen-Bridge/dnb-backend

• [Enhancement] Protect unauthenticated Stellar wallet lookup/enumeration endpoints
• feat(security): Implement honeypot endpoints for attack detection
• feat(notifications): Implement notification preferences
• feat(auth): Add security questions for account recovery
• feat(security): Add CSP violation reporting endpoint
• feat(notifications): Implement Do Not Disturb schedules
• feat(notifications): Add notification sound/vibration settings

Avenx-JS/avenx-js

• Remove the stale generated JSDoc output and dead nested workflow from docs/
• Bug: avenx explain ignores --no-color, FORCE_COLOR and TERM=dumb
• Docs: Update the stale coverage figures and fixture list in test/e2e/README.md
• Docs: Add a README to the @avenx/vite plugin package
• A11y: Inspector connection status is announced to nobody and conveyed by colour alone
• Bug: the avenx init routing scaffold emits AVX_W40 warnings on its first build
• Testing: Add unit tests for the Avenx Prettier plugin
• Docs: Document expressionCacheCapacity and sourcesContent config keys
• Docs: Document the alias key in the configuration reference
• Docs: Document the router's accessibility options and data-ax-page-heading

Berserk-hub150/skillhawk

• [Good First Issue] Add a suspicious-fixture writing tip [MC-008]
• [Good First Issue] Add a SKILL.md trust-boundary tip [MC-012]
• [Good First Issue] Add a SARIF-result tip [MC-015]
• [Good First Issue] Add a redaction tip [MC-009]
• [Good First Issue] Add a minimal-evidence tip [MC-002]
• [Good First Issue] Add a false-positive review tip [MC-004]
• [Good First Issue] Add a narrow-rule design tip [MC-005]
• [Good First Issue] Add a safe-fixture writing tip [MC-007]
• [Good First Issue] Add a severity calibration tip [MC-006]
• [Good First Issue] Add an educational-warning tip [MC-016]
• [Good First Issue] Add a regression-test tip [MC-014]
• [Good First Issue] Add an actionable-remediation tip [MC-003]
• [2–5 min] Define static analysis for beginners

ToolJet/ToolJet

• Dark mode: Toggle not visible
• Anthropic logo is not visible in dark mode
• OpenAI logo is not visible in dark mode
• Dark mode: Workspace login
• Glitch: Tabs are moving on hover
• Icon colour on disabled buttons is incorrect
• Community template: Gym Membership Management System
• Community template: Unix time format converter
• [docs]: macOS contributor setup fails because postgresql@13 is disabled in Homebrew