Good First Issues

This is a list of JavaScript repositories with good first issues for newcomers to open source. Contributions are welcome!

This list gets updated every day at midnight.

nodejs/doc-kit

• Consideration: detect doc-kit.config.mjs automatically
• Customize Shiki

highlightjs/highlight.js

• Looking for maintainers / contributors / code reviewers...

webbrain-one/webbrain

• Expand button at the top of the sidepanel
• Discord Server to discuss everything WebBrain

nodejs/node

• test_runner: print failed coverage reports with dot runner
• Writable does not check if stream has been destroyed during _final and _write
• FATAL ERROR: v8::ToLocalChecked Empty MaybeLocal
• TextDecoder does not error incorrectly for legacy byte sequences
• test_runner: do not read from process.argv and process.cwd() in run()

layer5io/docs

• [Docs] Improve visibility of carousel navigation

RoryGlenn/commitment-issues

• Add a local Markdown link checker for repository docs
• Add a --random option to the message-state runner
• Document how to add and preview a message state
• Add a documentation index for the docs/ directory

Fmarzochi/EGC

• test(v1.1.14): upgrade or install on Linux and report behavior
• test(v1.1.14): upgrade or install on macOS and report behavior

vercel/next.js

• Redux-observable server side fetching
• Misleading "next-head-count is missing" error for invalid head tags
• Dynamic Routes in Symlinks is not working

meshery/meshery.io

• [CI] Enhance appropriate github issue templates with mention of and hyperlink to self-pace contributor training
• Website: Consolidate duplicative and unused CSS
• [DevOps] Populate Meshery Catalog with Sample Apps using meshery UI

nextcloud/spreed

• [Bug] Talk fails to upload files over HTTP (crypto.randomUUID is not a function)
• Compatibility with Cloudflare Calls (TURN & STUN servers)
• Dashboard widget should show the actual mention message
• Delete messages completely instead of showing "Message deleted by you" in "Note to self"
• Go back to autopilot mode if re-clicking selected participant
• Imprint and privacy links in public talk conversations
• Migrate addParticipantToRoom to InvitationList
• Migrate OCC to InvitationList
• talk couldn't work after install the “talk_matterbridge”
• Write tests for "Team resources" integration
• System message shows "guest added user" to a conversation when adding through circle/team
• Reactions notifications when fully subscribed in federated conversations
• Limit to groups in federated target server breaks federation
• Temporary message added before date separator
• Instant meeting outside of dashboard?
• Recording chunked upload would fail with token length > 13

Deen-Bridge/dnb-frontend

• [Enhancement] Remove unused dependencies (socket.io-client, react-select-country-list) and dead components
• [Bug] Jitsi Meet integration fails to initialize video rooms
• [Docs] Replace placeholder README images and fix broken project links
• [Bug] Module-level auth header captures a stale token at import time and logs the JWT to the console
• [Bug] Axios interceptor auto-retries failed POSTs, risking duplicate Stellar payment submissions
• [Bug] Book preview API route uses params and cookies() synchronously (deprecated in Next 15)

louislam/uptime-kuma

• Pausing a group does not pause the individual monitors of that group
• On the maintenance creation form, link start and end times together

opengeo-tech/GeoPicker

• unit testing

badges/shields

• Mozilla Thunderbird add-ons (ATN)

mubasshirahin/ToLet-Mama

• File Upload Middleware for Listing Images
• Shared UI Components
• Responsive Layout & Mobile Navigation
• Add Dark Mode Support
• Empty States & Loading Skeletons
• Add Seed Script for Sample Listings & Users

SecureBananaLabs/bug-bounty

• Automate Bug Detection and Reviews
• upload endpoint accepts empty file submissions as successful uploads
• Search endpoint has no input validation or length limit on query
• Implement Secure Payment Gateway and Payment Service
• Implement a fully functional Admin Panel
• Benchmark APIs with p50, p95, p99 latency, RPS, error rate and TTFB
• Technical Poem Generation and Content Creation
• Pixel Art Creation with high Creative Thinking
• Low Handing Fruit Automation
• Calculate the exact value of PI #2872
• Calculate the exact value of PI
• Job validation should reject inverted budget ranges
• Reject inverted job budget ranges in job validation
• Freelancer profile route should resolve mock profiles by username
• Reject inverted job budget ranges in job validation
• registerUser access token can reference a different user id
• auth refresh endpoint issues tokens without verifying the requester
• Refresh token endpoint ignores the provided refresh token
• Registration token subject can drift from returned user id
• fix(auth): prevent admin role self-assignment during registration
• Bug: Proposal creation accepts records missing estimated duration
• Bug: Missing admin role authorization check on admin metrics endpoint
• Bug: Refresh endpoint mints tokens without validating a refresh token
• User creation endpoint has no input validation
• Payment endpoint lacks authentication — unauthenticated payment creation
• Upload endpoint lacks authentication — unauthenticated file uploads allowed
• Admin routes lack role-based access control — any authenticated user can access admin endpoints
• @freelanceflow/ui package entrypoint should be directly importable (reissue via #743)
• Notification creation should preserve server-owned id and read state
• Payment API should require authentication
• fix: prevent admin role self-assignment during registration
• fix: enforce authentication on job creation endpoint
• fix: prevent admin role self-assignment
• fix: prevent admin role self-assignment during registration
• fix: prevent admin role self-assignment
• Bug: Multiple security vulnerabilities in API layer - registerUser() ID mismatch, missing auth, missing validation

santifer/career-ops

• feat(dashboard): Responded is missing from the pipeline filter tabs
• docs(i18n): translate the new README FAQ into the remaining 13 languages
• feat: ATS-friendliness check — score a generated CV for ATS parseability
• i18n: translate the interview modes (plan/practice/debrief) to Japanese
• docs: verified recipe for Kimi k2.5 as the model inside OpenCode (budget guide)
• i18n: translate the interview modes (plan/practice/debrief) to Polish (pl)
• Sync the tracker's PDF column from data/pdf-index.tsv (❌ stays stale when the PDF is generated later)
• i18n: translate the interview modes (plan/practice/debrief) to Korean (ko)
• i18n: translate the interview modes (plan/practice/debrief) to Italian (it)
• i18n: translate the interview modes (plan/practice/debrief) to Portuguese (pt-BR)
• i18n: add Dutch (nl) modes
• doctor: treat missing first-run setup files as warnings, not hard failures

genome-spy/genome-spy

• Feature Request: Line Charts

Facelessism/cradle

• Doc: Merge ARCHITECTURE.md and README.md for reading progress tracker
• Add keyboard navigation to project grid
• Doc: Merge ARCHITECTURE.md and README.md for time planner

gatsbyjs/gatsby

• Page 404 not rendering react when using pathPrefix and redirect
• New gatsby-cli installation on ubuntu (wsl2) shows errors when running the command gatsby in terminal

processing/p5.js

• [p5.js 2.0 Beta Bug Report]: Document difference between textWidth and fontWidth with respect to whitespace
• [p5.js 2.0 Bug Report]: noise(null) is treated as noise(0) while noise(undefined) errors, and this behaviour is undocumented and inconsistent.

TryGhost/Ghost

• a11y: kg-toggle-card not usable properly with a screenreader
• Editor opening staff settings/profile triggers forbidden API calls and unrelated permission toast
• {{contrast_text_color}} helper returns incorrect text color

Deen-Bridge/dnb-backend

• [Enhancement] Protect unauthenticated Stellar wallet lookup/enumeration endpoints
• [Bug] deleteReelComment calls removed Mongoose 8 subdocument .remove() and always 500s
• [Bug] fetchRecommendedBooks throws on undefined variable and swallows all errors
• [Bug] List endpoints return 200 with success:false for empty results and inconsistent response shapes

fastify/fastify

• How to separate api endpoints in google cloud.
• Support pino logger customAttributeKeys to replace existing req res reqId log record fields

extra-org/extra

• Widget shows generic "Something went wrong" when a conversation hits the token budget (429)
• Orchestrator prompt not attached: falls back to description, losing context

khushi897920-lang/hercycle-ai

• ui/ux: Redundant success checkmark icons in Log Saved notification toast
• accessibility: Missing Labels on Navigation and Media Controls in GuidedExercise
• backend: Improve cycle prediction grace-handling for empty history
• backend: Inject userId context into delete-account logger errors
• backend: Prevent processing of empty/whitespace AI chat messages
• backend: Add request timeout signal abort handling for Groq Fallback API
• backend: Validate input categories for setHerVibe server action
• backend: Add date format validation for cycle tracking inputs
• perf(core): implement multi-level caching mechanism for expensive computations and data retrieval
• [Security]: Implement Data Privacy Hub and JSON Export
• [Feature]: Implement PWA Push Notification Preferences
• [Enhancement]: Replace Mock Rule-Based Engine with a Real Machine Learning Microservice
• [FEAT] Add Full Menstrual Cycle Phase Tracking with Educational Mood Insights
• [GOOD FIRST ISSUE] Improve README Screenshot Layout and Add Contributors Section
• [UI/UX] Add CSV Export Button for Cycle History on Insights Page

Dreamstick9/filedrop

• [Easy] server.js: validate AES key fragment is 64 hex chars before decrypt
• [Easy] package.json: npm test never runs test/integration/* suite
• [Easy] index.js/server.js: mDNS transfer id and X-Transfer-ID are generated separately and diverge
• [Easy] network.js: Docker bridge filtering only blocks 172.17.0.* (the d…
• [Easy] server.js: Hardcoded Cache-Control: max-age=31536000 for forge.min.js
• Rate Limit Memory Leak via Unbounded Map
• Sequential Port Availability Checking
• Synchronous File Stat in Loop
• Deprecated crypto.randomUUID fallback
• [Easy] lifecycle.js: Empty catch block silently swallows mdns.deregister() e…
• [Easy] lifecycle.js: Empty catch block silently swallows stdout flush errors…
• [Easy] index.js: Empty catch block suppresses errors during mdns.teardow…
• [Easy] index.js: Empty catch block suppresses errors during httpAppShutd…
• [Easy] server.js: Empty catch block suppresses errors during onShutdown c…
• [Easy] server.js: Shared ipRequestCounts Map is accessed without synchron…
• [Easy] index.js: Empty catch block suppresses errors during httpAppShutd…
• [Easy] index.js: Empty catch block suppresses errors during mdns.teardow…
• [Easy] cli.js: fs.statSync is called up to three times on the same `…
• [Easy] lifecycle.js: Empty catch block silently swallows server.shutdown() e…

cobusgreyling/loop-engineering

• Harden loop-action command invocation (safe quoting)
• Share a CI Sweeper production story
• Add loop-gate subsection to QUICKSTART
• Add loop-sandbox subsection to QUICKSTART
• Add loop-action subsection to QUICKSTART
• Add Hermes Issue Triage example doc
• Add Hermes CI Sweeper example doc
• Add Windsurf Dependency Sweeper example doc
• Add Windsurf Issue Triage example doc
• Add Windsurf CI Sweeper example doc
• Add your project to the adopters list
• Share an Issue Triage week-one story
• Share a PR Babysitter failure story
• Share your week-one Daily Triage story

jacobwright32/uk-grid-atlas

• Pipeline robustness: empty Overpass responses cached as success; corrupt line files silently skipped
• Regenerate og.png social card for the 8-grid branding
• window.__ukgridMap debug handle leaks after unmount

jeremysball/token-burn-dashboard

• dashboard/styles/README.md is stale: wrong CSS version, wrong deep-insights ownership, undocumented second theme block
• README.md is stale in 10+ places: Bun quick-start, fake keyboard shortcuts, wrong test stack, missing endpoints/env vars
• Analytics table: can't scroll horizontally on mobile; column headers should sort
• Show a clearer error when the dashboard can't reach the backend
• Redo README with real screenshots
• handleSpikesListRoute missing writableEnded guard (same class as #26)

ytsubhadip/X-Compiler

• Formate Password button UI change
• Remove the back home button
• Online compiler user Input connection established

edlopez000/merfluence

• docs: link the live Marketplace listing from the README
• docs: link the privacy policy and support contact from the repo
• docs: add community health files (CoC, issue/PR templates, CODEOWNERS, .gitattributes)

Savitura/crowdpay

• Make load test configurations read from environment variables
• Public Campaign Embed API; JWT-Scoped Embed Tokens, iframe Widget & Cross-Origin Contribution Flow
• Getting Started for New Contributors

imuniqueshiv/MeetOnMemory

• 🐞 Fix Browse Organizations Page Layout Overlapping with Navbar After Login
• 🤖 Adjust Issue Claim Automation: Extend Assignment Timeout to 48 Hours and Update Reminder Interval
• Fix Browse Organizations page layout overlapping with navbar after login

Abdulazeem-code/stellar-tags

• Use Dynamic URL for Federation Server in stellar.toml
• Filter Undefined Origins in CORS Configuration

NextCommunity/NextCommunity.github.io

• Pulse and Force surge buttons missing colors

CortexRail/cortex-protocols

• Add Freighter wallet connect
• CI: GitHub Actions for tests and build
• Micropayments contract: usage-based payment streaming

FarmData2/FarmData2

• Check for VSCode extensions before installing them

jeremysball/taskferry

• result message truncation
• wait --summarize model override
• defaultTaskManager is dead code with import-time side effects and a stale comment
• Surface completion timestamp in list/status output
• client.js's direct-execution guard isn't symlink-safe (asymmetric with cli.js)