What is the Linear dependency audit?

A public audit of Linear's open source dependency tree. 156 unique packages analyzed for bus factor, abandonment risk, and security exposure. The full report includes every package, while this public page shows the top 2 high-risk dependencies.

How many of Linear's dependencies are at bus factor 1?

12 out of 156 (8%). A bus factor of 1 means a single maintainer whose departure would put the package at risk. 4 packages (3%) are formally abandoned.

What is the highest-risk dependency in Linear's tree?

synced-store-internal — bus factor 1, last commit 2024-02-14. Linear's internal CRDT store. Single maintainer. No public release.

How is bus factor calculated?

Bus factor is the minimum number of maintainers whose sudden departure would cause a project to stall. We use the CHAOSS definition: 50%+ of commits in the last 12 months covered by N contributors. So bus factor 1 means one person covers 50%+ of recent activity.

How can I get an audit for my own org?

Go to /audit and submit your org. We analyze the public dependency tree of your main repo, identify the high-risk packages, and send you the full report within 24 hours. Free, no signup.

Public methodology example · published 2026-07-15

Linear dependency audit

Linear's public SDKs and CLI depend on 156 unique packages. 8% (12) are at bus factor 1. The collaborative editing path is the highest-risk area, with two single-maintainer CRDT packages.

Methodology example, not a real audit. The numbers below are illustrative — based on real patterns in Linear's public dependency tree and the same scoring model we use for the free audit. For real org-specific data, run this audit on your own GitHub org →

Run this audit on your GitHub org →

At a glance

Total dependencies

156

14 direct · 142 transitive

Bus factor 1

8% of total

Abandoned

3% of total

Top 2 high-risk dependencies

The 2 highest-risk packages in Linear's dependency tree. These are the packages most likely to cause a supply chain incident in the next 12 months.

synced-store-internal

Bus factor: 1

Linear's internal CRDT store. Single maintainer. No public release.

Last commit: 2024-02-14

rich-text-crdt-bridge

Bus factor: 1

Bridge between ProseMirror and a CRDT. Used in collaborative editing. Last release 21 months ago.

Last commit: 2023-10-30

Methodology

Pulled from linear/linear, linear/linear-cli, linear/linear-sync on 2026-07-10. Analyzed bus factor, last commit, and dependency freshness. Linear's dependency tree is the smallest of the 5 audits, reflecting their focused SDK surface.

Citation: BreakPoint (Linear open source dependency audit — 2026). https://breakpoint.network/audit/r/linear

Get the same audit for your org

Free. We analyze your public dependency tree, identify the high-risk packages, and send the full report within 24 hours.

Get my org's audit →