In progress

Supply-chain observatory

Continuous monitoring of the open-source packages civic tech depends on, surfacing maintenance and security risks early. First pass under way: dependency graphs for the 44 map initiatives with public code show a median of 537 packages per project, and the same small npm utilities turning up in 24 of them.

First pass: what the map runs on

In October 2026 we pulled the GitHub dependency graphs for the 44 initiatives on the civic tech map that link to public code. Where an entry points to an organisation rather than a repository, we took its main application repository.

Python is the main language for 18 projects, Java for 7, Ruby for 6, TypeScript for 5 and JavaScript for 4.
npm is the common denominator: 27 of the 44 pull in npm packages, whatever their main language, and 37 use more than one package ecosystem.
Together they resolve to 13,835 distinct packages, with a median of 537 per project, counting indirect and development dependencies.
The same small npm utilities, such as debug, minimatch, ms, chalk, semver and glob, appear in 21 to 24 projects. Many have a single maintainer.
requests, urllib3, certifi and idna sit under 15 or 16 of the 17 Python projects. Rails runs 7 of the 8 Ruby ones, and Spring powers DHIS2, OpenMRS, X-Road and OpenELIS.
36 projects build on GitHub Actions and 35 of them use actions/checkout, so a single compromised action would reach almost all of them.
12 projects are AGPL-3.0. GitHub cannot identify the licence of 11 others.
One repository is archived and one has seen no commits in over a year.

Turn this snapshot into a scheduled check, starting with the shared packages above: who maintains them, how often they ship, and whether known vulnerabilities reach the projects that depend on them. Catala, adhocracy+ and Nextstrain need manual review, as GitHub's dependency graph covers them partly or not at all.