Show repo issue and PR count in package page

[bluwy]

Description

Currently, only the stars and forks count are shown. And a link to the repo issues. It would be nice to show the issue and PR count like on npm.

Potential solution

Currently the repo data is backed by https://github.com/unjs/ungh, but it does not return open_issues_count from the main github api (e.g. https://api.github.com/repos/npmx-dev/npmx.dev).

Unfortunately that number includes both the issue and pr count, so you'd have to do another fetch to retrieve the pr count to subtract it, so I'm not sure if it's feasible to do this in ungh without doubling the request. Maybe it's fine upstream if it's behind a flag or something.

Alternatively we could fetch the data in the client side instead? Or a hybrid of returning open_issues_count in ungh, and calculating the PR count in the client side?

Notes

I have an implementation for fetching the PR count here, which is the same as what npm does under the hood because GitHub doesn't provide a nice API for it.

PS I would prefer not showing the forks count if we show these two data, as I feel they provide a more informed decision about the state of the package.

[serhalp]

We could/should also add these as selectable facets on the /compare page!

[ivanm696]

{
"schema_version": "1.4.0",
"id": "GHSA-9583-h5hc-x8cw",
"modified": "2026-01-11T14:53:55Z",
"published": "2026-01-08T20:45:07Z",
"aliases": [
"CVE-2025-61686"
],
"summary": "React Router has Path Traversal in File Session Storage",
"details": "If applications use createFileSessionStorage() from @react-router/node (or @remix-run/node/@remix-run/deno in Remix v2) with an unsigned cookie, it is possible for an attacker to cause the session to try to read/write from a location outside the specified session file directory. The success of the attack would depend on the permissions of the web server process to access those files. \n\nRead files cannot be returned directly to the attacker. Session file reads would only succeed if the file matched the expected session file format. If the file matched the session file format, the data would be populated into the server side session but not directly returned to the attacker unless the application logic returned specific session information.\npnpm update @remix-run/node@2.17.2 @remix-run/react@2.17.2 @remix-run/serve@2.17.2 --latest",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H"
}
],
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "@react-router/node"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "7.0.0"
},
{
"fixed": "7.9.4"
}
]
}
],
"database_specific": {
"last_known_affected_version_range": "<= 7.9.3"
}
},
{
"package": {
"ecosystem": "npm",
"name": "@remix-run/node"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "2.17.2"
}
]
}
],
"database_specific": {
"last_known_affected_version_range": "<= 2.17.1"
}
},
{
"package": {
"ecosystem": "npm",
"name": "@remix-run/deno"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "2.17.2"
}
]
}
],
"database_specific": {
"last_known_affected_version_range": "<= 2.17.1"
}
}
],
"references": [
{
"type": "WEB",
"url": "https://github.com/remix-run/react-router/security/advisories/GHSA-9583-h5hc-x8cw"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-61686"
},
{
"type": "PACKAGE",
"url": "https://github.com/remix-run/react-router"
}
],
"database_specific": {
"cwe_ids": [
"CWE-22"
],
"severity": "CRITICAL",
"github_reviewed": true,
"github_reviewed_at": "2026-01-08T20:45:07Z",
"nvd_published_at": "2026-01-10T03:15:48Z"
}
}