Awesome List Updates on Sep 06, 2025

4 awesome lists updated today.

🏠 Home · 🔍 Search · 🔥 Feed · 📮 Subscribe · ❤️ Sponsor

1. Awesome Cakephp

Console

• SignalHandler plugin (⭐2) - Cross-platform signal handling for CakePHP console commands with zero external dependencies. Supports Linux (pcntl), Windows (native API).

2. Awesome Go

Utilities / Utility/Miscellaneous

• antham/ghokin (⭐49) — Parallelized formatter with no external dependencies for gherkin (cucumber, behat...) ☆49

3. Awesome Webaudio

Packages / Frameworks

• React Native Audio API (⭐594) - Web Audio API implementation for native apps based on react-native.

4. Static Analysis

Programming Languages / Other

• STOKE ⚠️ — A programming-language agnostic stochastic optimizer for the x86_64 instruction set. It uses random search to explore the extremely high-dimensional space of all possible program transformations.

• cpplint (⭐1.7k) — Automated C++ checker that follows Google's style guide.

• ENRE-cpp ⚠️ — ENRE (ENtity Relationship Extractor) is a tool for extraction of code entity dependencies or relationships from source code. ENRE-cpp is a ENtity Relationship Extractor for C/C++ based on @eclipse/CDT. (Under development)

• flawfinder ⚠️ — Finds possible security weaknesses.

• flint++ ⚠️ — Cross-platform, zero-dependency port of flint, a lint program for C++ developed and used at Facebook.

• MATE ⚠️ — A suite of tools for interactive program analysis with a focus on hunting for bugs in C and C++ code. MATE unifies application-specific and low-level vulnerability analysis using code property graphs (CPGs), enabling the discovery of highly application-specific vulnerabilities that depend on both implementation details and the high-level semantics of target C/C++ programs.

• vera++ ⚠️ — Vera++ is a programmable tool for verification, analysis and transformation of C++ source code.

• CSharpEssentials ⚠️ — C# Essentials is a collection of Roslyn diagnostic analyzers, code fixes and refactorings that make it easy to work with C# 6 language features.

• Infer# ⚠️ — InferSharp (also referred to as Infer#) is an interprocedural and scalable static code analyzer for C#. Via the capabilities of Facebook's Infer, this tool detects null pointer dereferences and resource leaks.

• VSDiagnostics ⚠️ — A collection of static analyzers based on Roslyn that integrates with VS.

• coffeelint ⚠️ — A style checker that helps keep CoffeeScript code clean and consistent.

• Dart Code Metrics ⚠️ — Additional linter for Dart. Reports code metrics, checks for anti-patterns and provides additional rules for Dart analyzer.

• Linter for dart (⭐627) — Style linter for Dart.

• elm-analyse ⚠️ — A tool that allows you to analyse your Elm code, identify deficiencies and apply best practices.

• Primitive Erlang Security Tool (PEST) ⚠️ — A tool to do a basic scan of Erlang source code and report any function calls that may cause Erlang source code to be insecure.

• FSharpLint (⭐315) — Lint tool for F#.

• fprettify ⚠️ — Auto-formatter for modern fortran source code, written in Python. Fprettify is a tool that provides consistent whitespace, indentation, and delimiter alignment in code, including the ability to change letter case and handle preprocessor directives, all while preserving revision history and tested for editor integration.

• dingo-hunter ⚠️ — Static analyser for finding deadlocks in Go.

• dupl ⚠️ — Reports potentially duplicated code.

• goast ⚠️ — Go AST (Abstract Syntax Tree) based static analysis tool with Rego.

• gocyclo ⚠️ — Calculate cyclomatic complexities of functions in Go source code.

• interfacer ⚠️ — Suggest narrower interfaces that can be used.

• lll ⚠️ — Report long lines.

• maligned ⚠️ — Detect structs that would take less memory if their fields were sorted.

• safesql ⚠️ — Static analysis tool for Golang that protects against SQL injections.

• brittany ⚠️ — Haskell source code formatter

• ENRE-java ⚠️ — ENRE (ENtity Relationship Extractor) is a tool for extraction of code entity dependencies or relationships from source code. ENRE-java is a ENtity Relationship Extractor for Java projects based on @Eclipse JDT/parser.

• HuntBugs ⚠️ — Bytecode static analyzer tool based on Procyon Compiler Tools aimed to supersede FindBugs.

• steady ⚠️ — Analyses your Java applications for open-source dependencies with known vulnerabilities, using both static analysis and testing to determine code context and usage for greater accuracy.

• aether ⚠️ — Lint, analyze, normalize, transform, sandbox, run, step through, and visualize user JavaScript, in node or the browser.

• ClosureLinter ⚠️ — Ensures that all of your project's JavaScript code follows the guidelines in the Google JavaScript Style Guide. It can also automatically fix many common errors.

• complexity-report ⚠️ — Software complexity analysis for JavaScript projects.

• es6-plato ⚠️ — Visualize JavaScript (ES6) source complexity.

• escomplex ⚠️ — Software complexity analysis of JavaScript-family abstract syntax trees.

• Esprima ⚠️ — ECMAScript parsing infrastructure for multipurpose analysis.

• hegel ⚠️ — A static type checker for JavaScript with a bias on type inference and strong type systems.

• JSPrime ⚠️ — Static security analysis tool.

• plato ⚠️ — Visualize JavaScript source complexity.

• RSLint ⚠️ — A (WIP) JavaScript linter written in Rust designed to be as fast as possible, customizable, and easy to use.

• TypL ⚠️ — With TypL, you just write completely standard JS, and the tool figures out your types via powerful inferencing.

• yardstick ⚠️ — Javascript code metrics.

• Luanalysis ⚠️ — An IDE for statically typed Lua development.

• nimfmt ⚠️ — Nim code formatter / linter / style checker

• Mondrian ⚠️ — A set of static analysis and refactoring tools which use graph theory.

• pdepend ⚠️ — Calculates software metrics like cyclomatic complexity for PHP code.

• PHP Semantic Versioning Checker ⚠️ — Suggests a next version according to semantic versioning.

• PHP-Token-Reflection ⚠️ — Library emulating the PHP internal reflection.

• php7cc ⚠️ — PHP 7 Compatibility Checker.

• php7mar ⚠️ — Assist developers in porting their code quickly to PHP 7.

• PHP_CodeSniffer ⚠️ — Detects violations of a defined set of coding standards.

• phpca ⚠️ — Finds usage of non-built-in extensions.

• phpcpd ⚠️ — Copy/Paste Detector for PHP code.

• phpdcd ⚠️ — Dead Code Detector (DCD) for PHP code.

• PhpDependencyAnalysis ⚠️ — Builds a dependency graph for a project.

• PhpDeprecationDetector ⚠️ — Analyzer of PHP code to search issues with deprecated functionality in newer interpreter versions. It finds removed objects (functions, variables, constants and ini-directives), deprecated functions functionality, and usage of forbidden names or tricks (e.g. reserved identifiers in newer versions).

• phpdoc-to-typehint ⚠️ — Add scalar type hints and return types to existing PHP projects using PHPDoc annotations.

• phpsa ⚠️ — Static analysis tool for PHP.

• Qafoo Quality Analyzer ⚠️ — Visualizes metrics and source code.

• ENRE-py ⚠️ — ENRE (ENtity Relationship Extractor) is a tool for extraction of code entity dependencies or relationships from source code. ENRE-py is a ENtity Relationship Extractor for Python based on Python Language Services of The Standard Library.

• InspectorTiger ⚠️ — IT, Inspector Tiger, is a modern python code review tool / framework. It comes with bunch of pre-defined handlers which warns you about improvements and possible bugs. Beside these handlers, you can write your own or use community ones.

• mccabe ⚠️ — Check McCabe complexity.

• py-find-injection ⚠️ — Find SQL injection vulnerabilities in Python code.

• pydocstyle ⚠️ — Check compliance with Python docstring conventions.

• PyT - Python Taint ⚠️ — A static analysis tool for detecting security vulnerabilities in Python web applications.

• wily ⚠️ — A command-line tool for archiving, exploring and graphing the complexity of Python source code.

• CodeDepends ⚠️ — Static Code Analysis for R.

• cane ⚠️ — Code quality threshold checking as part of your build.

• Churn ⚠️ — A Project to give the churn file, class, and method for a project for a given checkin. Over time the tool adds up the history of churns to give the number of times a file, class, or method is changing during the life of a project.

• flay ⚠️ — Flay analyzes code for structural similarities.

• flog ⚠️ — Flog reports the most tortured code in an easy to read pain report. The higher the score, the more pain the code is in.

• laser ⚠️ — Static analysis and style linter for Ruby code.

• MetricFu ⚠️ — MetricFu is a set of tools to provide reports that show which parts of your code might need extra work.

• Querly ⚠️ — Pattern Based Checking Tool for Ruby.

• Railroader ⚠️ — An open source static analysis security vulnerability scanner for Ruby on Rails applications.

• Roodi ⚠️ — Roodi stands for Ruby Object Oriented Design Inferometer. It parses your Ruby code and warns you about design issues you have based on the checks that it has configured.

• ruby-lint ⚠️ — Static code analysis for Ruby.

• Saikuro ⚠️ — A Ruby cyclomatic complexity analyzer.

• SandiMeter ⚠️ — Static analysis tool for checking Ruby code for Sandi Metz' rules.

• cargo-inspect ⚠️ — Inspect Rust code without syntactic sugar to see what the compiler does behind the curtains.

• electrolysis ⚠️ — A tool for formally verifying Rust programs by transpiling them into definitions in the Lean theorem prover.

• herbie ⚠️ — Adds warnings or errors to your crate when using a numerically unstable floating point expression.

• linter-rust ⚠️ — Linting your Rust-files in Atom, using rustc and cargo.

• MIRAI ⚠️ — And abstract interpreter operating on Rust's mid-level intermediate language, and providing warnings based on taint analysis.

• prae ⚠️ — Provides a convenient macro that allows you to generate type wrappers that promise to always uphold arbitrary invariants that you specified.

• Prusti ⚠️ — A static verifier for Rust, based on the Viper verification infrastructure. By default Prusti verifies absence of panics by proving that statements such as unreachable!() and panic!() are unreachable.

• Rudra ⚠️ — Rust Memory Safety & Undefined Behavior Detection. It is capable of analyzing single Rust packages as well as all the packages on crates.io.

• Rust Language Server ⚠️ — Supports functionality such as 'goto definition', symbol search, reformatting, and code completion, and enables renaming and refactorings.

• sqlcheck ⚠️ — Automatically identify anti-patterns in SQL queries.

• TSqlRules ⚠️ — TSQL Static Code Analysis Rules for SQL Server.

• linter ⚠️ — Linter is a Scala static analysis compiler plugin which adds compile-time checks for various possible bugs, inefficiencies, and style problems.

• Tailor ⚠️ — A static analysis and lint tool for source code written in Apple's Swift programming language.

• Codelyzer ⚠️ — A set of tslint rules for static code analysis of Angular 2 TypeScript projects.

• stc ⚠️ — Speedy TypeScript type checker written in Rust

• tslint ⚠️ — TSLint has been deprecated as of 2019. Please see this issue (⭐5.9k) for more details. typescript-eslint is now your best option for linting TypeScript. TSLint is an extensible static analysis tool that checks TypeScript code for readability, maintainability, and functionality errors. It is widely supported across modern editors & build systems and can be customized with your own lint rules, configurations, and formatters.

• tslint-microsoft-contrib ⚠️ — A set of tslint rules for static code analysis of TypeScript projects maintained by Microsoft.

• vint ⚠️ — Fast and Highly Extensible Vim script Language Lint implemented by Python.

Other / Other

• Go Meta Linter ⚠️ — Concurrently run Go lint tools and normalise their output. Use golangci-lint for new projects.

• shisho ⚠️ — A lightweight static code analyzer designed for developers and security teams. It allows you to analyze and transform source code with an intuitive DSL similar to sed, but for code.

• Enlightn ⚠️ — A static and dynamic analysis tool for Laravel applications that provides recommendations to improve the performance, security and code reliability of Laravel apps. Contains 120 automated checks.

• ciocheck ⚠️ — Linter, formatter and test suite helper. As a linter, it is a wrapper around pep8, pydocstyle, flake8, and pylint.

• multilint ⚠️ — A wrapper around flake8, isort and modernize.

• QuantifiedCode ⚠️ — Automated code review & repair. It helps you to keep track of issues and metrics in your software projects, and can be easily extended to support new types of analyses.

• quality ⚠️ — Runs quality checks on your code using community tools, and makes sure your numbers don't get any worse over time.

• cargo-bloat ⚠️ — Find out what takes most of the space in your executable. supports ELF (Linux, BSD), Mach-O (macOS) and PE (Windows) binaries.

• Twiggy (⭐1.4k) — Analyzes a binary's call graph to profile code size. The goal is to slim down wasm binary size.

• packj ⚠️ — Packj (pronounced package) is a command line (CLI) tool to vet open-source software packages for "risky" attributes that make them vulnerable to supply chain attacks. This is the tool behind our large-scale security analysis platform Packj.dev that continuously vets packages and provides free reports.

• pure ⚠️ — Pure is a static analysis file format checker that checks ZIP files for dangerous compression ratios, spec deviations, malicious archive signatures, mismatching local and central directory headers, ambiguous UTF-8 filenames, directory and symlink traversals, invalid MS-DOS dates, overlapping headers, overflow, underflow, sparseness, accidental buffer bleeds etc.

• ktool ⚠️ — Fully cross-platform toolkit and library for MachO+Obj-C editing/analysis. Includes a cli kit, a curses GUI, ObjC header dumping, and much more.

• Manalyze ⚠️ — A static analyzer, which checks portable executables for malicious content.

• mcsema ⚠️ — Framework for lifting x86, amd64, aarch64, sparc32, and sparc64 program binaries to LLVM bitcode. It translates ("lifts") executable binaries from native machine code to LLVM bitcode, which is very useful for performing program analysis methods.

• Parker ⚠️ — Stylesheet analysis tool.

• sass-lint ⚠️ — A Node-only Sass linter for both sass and scss syntax.

• scsslint ⚠️ — Linter for SCSS files.

• Specificity Graph (⭐703) — CSS Specificity Graph Generator.

• Puppet Lint ⚠️ — Check that your Puppet manifests conform to the style guide.

• collector ⚠️ — Run arbitrary scripts inside containers, and gather useful information.

• dagda ⚠️ — Perform static analysis of known vulnerabilities in docker images/containers.

• Docker Label Inspector ⚠️ — Lint and validate Dockerfile labels.

• Bootlint ⚠️ — An HTML linter for Bootstrap projects.

• HTML Inspector ⚠️ — HTML Inspector is a code quality tool to help you and your team write better markup.

• kube-hunter ⚠️ — Hunt for security weaknesses in Kubernetes clusters.

• kubeval ⚠️ — Validates your Kubernetes configuration files and supports multiple Kubernetes versions.

• mdl ⚠️ — A tool to check Markdown files and flag style issues.

• android-lint-summary ⚠️ — Combines lint errors of multiple projects into one output, check lint results of multiple sub-projects at once.

• iblessing ⚠️ — iblessing is an iOS security exploiting toolkit. It can be used for reverse engineering, binary analysis and vulnerability mining.

• paprika ⚠️ — A toolkit to detect some code smells in analyzed Android applications.

• qark ⚠️ — Tool to look for several security related Android application vulnerabilities.

• statix (⭐733) — Lints and suggestions for the Nix programming language. "statix check" highlights antipatterns in Nix code. "statix fix" can fix several such occurrences.

• promformat ⚠️ — Promformat is a PromQL formatter written in Python.

• LunaSec ⚠️ — Open Source AppSec platform that automatically notifies you the next time vulnerabilities like Log4Shell or node-ipc happen. Track your dependencies and builds in a centralized service.

• OWASP Noir — Attack surface detector that identifies endpoints by static analysis.

• dennis ⚠️ — A set of utilities for working with PO files to ease development and improve quality.

• Vetur ⚠️ — Vue tooling for VS Code, powered by vls (vue language server). Vetur has support for formatting embedded HTML, CSS, SCSS, JS, TypeScript, and more. Vetur only has a "whole document formatter" and cannot format arbitrary ranges.

• After the Deadline ⚠️ — Spell, style and grammar checker.

Multiple languages / Other

• Atom-Beautify ⚠️ — Beautify HTML, CSS, JavaScript, PHP, Python, Ruby, Java, C, C++, C#, Objective-C, CoffeeScript, TypeScript, Coldfusion, SQL, and more in Atom editor.

• Betterscan CE ⚠️ — Checks your code and infra (various Git repositories supported, cloud stacks, CLI, Web Interface platform, integrationss available) for security and quality issues. Code Scanning/SAST/Linting using many tools/Scanners deduplicated with One Report (AI optional).

• BugProve ⚠️ ©️ — BugProve is a firmware analysis platform featuring both static and dynamic analysis techniques to discover memory corruptions, command injections and other classes or common weaknesses in binary code. It also detects vulnerable dependencies, weak cryptographic parameters, misconfigurations, and more.

• coala ⚠️ — Language independent framework for creating code analysis - supports over 60 languages by default.

• Corrode ⚠️ — Semi-automatic translation from C to Rust. Could reveal bugs in the original implementation by showing Rust compiler warnings and errors. Superseded by C2Rust.

• cqc ⚠️ — Check your code quality for js, jsx, vue, css, less, scss, sass and styl files.

• DeepCode ⚠️ ©️ — DeepCode was acquired by Snyk is now Snyk Code.

• goone ⚠️ — Finds N+1 queries (SQL calls in a for loop) in go code

• Hopper ⚠️ — A static analysis tool written in scala for languages that run on JVM.

• Hound CI ⚠️ — Comments on style violations in GitHub pull requests. Supports Coffeescript, Go, HAML, JavaScript, Ruby, SCSS and Swift.

• imhotep ⚠️ — Comment on commits coming into your repository and check for syntactic errors and general lint warnings.

• include-gardener ⚠️ — A multi-language static analyzer for C/C++/Obj-C/Python/Ruby to create a graph (in dot or graphml format) which shows all #include relations of a given set of files.

• pfff ⚠️ — Facebook's tools for code analysis, visualizations, or style-preserving source transformation for many languages.

• PT.PM ⚠️ — An engine for searching patterns in the source code, based on Unified AST or UST. At present time C#, Java, PHP, PL/SQL, T-SQL, and JavaScript are supported. Patterns can be described within the code or using a DSL.

• Scrutinizer ⚠️ ©️ — A proprietary code quality checker that can be integrated with GitHub.

• shipshape ⚠️ — Static program analysis platform that allows custom analyzers to plug in through a common interface.

• Super-Linter ⚠️ — Combination of multiple linters to install as a GitHub Action.

• Wotan ⚠️ — Pluggable TypeScript and JavaScript linter.

• Prev: Sep 07, 2025
• Next: Sep 05, 2025