Week 45, updated 2 Nov 2026

Media & creative Remotion

Is Remotion safe?

Short answer: Caution. StackGrade's weekly scan of remotion-dev/remotion gives it a Caution label for 13 critical-severity known vulnerabilities in runtime dependencies (OSV). It does list 141 high-severity advisories in runtime dependencies, which don't change the label. Critical advisories are counted once per package; a known issue in a locked package version does not prove Remotion is exploitable in your setup. Automated scan of commit 1e55bdc on 2 Nov 2026, not a manual audit.

Updated : the last week its score, rank or safety result changed.

Make videos programmatically with React.

  • 69,828 stars
  • pushed 1 Nov
  • Remotion License
  • TypeScript

github.com/remotion-dev/remotion · remotion.dev

43score out of 100

#37of 52 overall#1in Media & creativesame score as Week 44

  • Maintenance 30%61
  • Adoption 30%47
  • Docs 20%8
  • Community 20%–
W42W43W44W45

Score over the last 4 weeks: 44, 43, 43, 43.

Caution

13 critical-severity known vulnerabilities in runtime dependencies (OSV).

How this score works

Each part is a percentile among all 52 tracked tools, so 50 is average for this list. Community is not measured yet; the score uses the other 80%.

  • Maintenance: Last push 1 Nov 2026. Last 10 GitHub releases within 27 days (about 10 per 30 days), latest release 26 Oct 2026. Issue close time: fewer than 5 closed issues, so not used.
  • Adoption: 69,828 stars (70%), 5,743 forks (30%).
  • Docs: README 4,616 characters, 6 headings, 1 code blocks, install section: yes.

Methodology

#1 of 1 in Media & creative

Ranked by score. The yellow row is this tool.

Media & creative, Week 45score 0–100, safety
  1. 1Remotion#37 overall43Caution

Safety scan, 2 Nov 2026

Automated scan of commit 1e55bdc, 11,416 files. Not a manual audit.

Caution

  • 13Critical dependency advisories141 high, 119 medium, 32 low. OSV, runtime dependencies only.
  • 0Install hooksNo npm install scripts found.
  • 0Remote-code patternsFor example eval(fetch(…)).
  • 473Agent files checked0 phrases flagged for review.
  • 4curl | sh installersIn docs or program code. Information only.
Why this label?

Why this label:

  • 13 critical-severity known vulnerabilities in runtime dependencies (OSV)

Known vulnerabilities in runtime dependencies (OSV): 13 critical, 141 high, 119 medium, 32 low, 23 unrated

  • form-data@2.5.1 (GHSA-fjxv-7rqg-78g4) in bun.lock
  • happy-dom@14.5.1 (GHSA-37j7-fg3j-429f) in bun.lock
  • happy-dom@14.5.1 (GHSA-96g7-g7g9-jxw8) in bun.lock
  • immutable@4.3.6 (GHSA-wf6x-7x77-mvgw) in bun.lock
  • maplibre-gl@5.21.1 (GHSA-jrc7-96c5-q579) in bun.lock

Also found (informational, does not change the label):

  • 141 high-severity known vulnerabilities in runtime dependencies (OSV)
  • Program code runs a curl|sh style installer (1 occurrence, e.g. packages/lambda-binaries/build-chrome.sh)
  • Documents curl|sh style installer (3 occurrences, e.g. .circleci/config.yml)
  • Critical advisories counted once per package: 16 matches across 1 lockfile

Notes:

  • 3 affected packages only in dev/test/docs manifests, not counted
  • Telemetry/analytics references in code: amplitude, telemetry

Automated scan of commit 1e55bdc on 2 Nov 2026, not a manual audit. 11,416 files checked. What we check

Repo activity

From the GitHub API, fetched 2 Nov 2026.

  • 10+Releases, 90 daysLatest v4.0.539, 26 Oct
  • –Median issue closeFewer than 5 closed issues
  • 69.8kStars+2,294 since 26 Oct
  • 5.7kForks185 open issues
  • 2020Repo created23 Jun 2020
30 days ago2 Nov
7 releases in the last 30 days, one mark each (GitHub releases feed, last 10 entries).

7 releases in the last 30 days (GitHub releases feed, last 10 entries):

Questions about Remotion

Answers use this week's StackGrade data.

Is Remotion safe to use?

Caution. StackGrade's weekly scan of remotion-dev/remotion gives it a Caution label for 13 critical-severity known vulnerabilities in runtime dependencies (OSV). It does list 141 high-severity advisories in runtime dependencies, which don't change the label. Critical advisories are counted once per package; a known issue in a locked package version does not prove Remotion is exploitable in your setup. Automated scan of commit 1e55bdc on 2 Nov 2026, not a manual audit.

How does StackGrade score Remotion?

Remotion scores 43 out of 100 in Week 45: #37 of 52 tracked tools overall and #1 in Media & creative. The score combines maintenance (61), adoption (47) and docs (8) as percentiles among all 52 tracked tools; community (20% weight) is not measured yet, so the score uses the other 80%. It is not a hands-on test and it is separate from the safety label.

What licence does Remotion use?

The licence listed for remotion-dev/remotion is Remotion License. Read the licence text before commercial use.

Compare and use it

Used in 1 AI use case

All facts and sources
Type
AI tool
License
Remotion License
Language
TypeScript
Created
23 Jun 2020
Owner
remotion-dev (Organization)
Forks
5,743
Homepage
remotion.dev

GitHub description: “🎥 Make videos programmatically with React”

Sources: github.com/remotion-dev/remotion, api.github.com/repos/remotion-dev/remotion, raw.githubusercontent.com/remotion-dev/remotion/main/README.. Fetched 2 Nov 2026.

Know when Remotion changes label

One email a week: the new top 10, the biggest score changes and every safety label that changed.

Free. Double opt-in: you confirm by email first, unsubscribe in one click.