Mixxx is DJ software for performing live mixes. It has the decks, mixer, EQs, effects, sync, key detection, looping and hot cues of a commercial DJ app, a music library that reads tags and can import crates from other DJ tools, and recording and live broadcasting of your set. It runs on Windows, macOS and Linux.
Its strength is hardware support. Mixxx ships mappings for a long list of MIDI and HID controllers from the major brands, and anyone can write a new mapping in JavaScript, so a second-hand controller usually just works. It also supports timecode vinyl, so you can control digital tracks with turntables.
It has been developed in the open since 2001 and is GPLv2 or later, with about 7,300 stars and 467 contributors, at release 2.5.6 when scanned.
- Repository: github.com/mixxxdj/mixxx
- Licence: custom (Other)
- Language: C++. Stars: 7,314. Forks: 2,010. Last push: Oct 25, 2026.
- Scan: safe, Oct 26, 2026, commit ee17a27
Who it is for
Beginner and working DJs who want full-featured mixing software without a subscription, owners of DJ controllers, and Linux users, who have few other serious DJ options.
Getting started
1. macOS (Homebrew)
brew install --cask mixxx2. Windows (winget)
winget install Mixxx.Mixxx3. Linux (Flathub)
flatpak install flathub org.mixxx.MixxxInstallers for every platform, including development builds, are on mixxx.org/download. Check the hardware compatibility list in the Mixxx manual before buying a controller for it.
Safety scan
We cloned mixxxdj/mixxx at commit ee17a27 on Oct 26, 2026 and ran the checks described on the GitHub Tools page: credential patterns, decode-and-execute code, install-time scripts, committed binaries, risky CI workflows, every host the code talks to, known vulnerabilities in pinned dependencies, and project hygiene. A person read every hit. This is what we found.
- No secrets, no suspicious code patterns and no committed binaries across 6,065 files. The scanner's total of almost 2 million lines is inflated: about 1.38 million of them are Qt translation files (res/translations/*.ts) that it counted as TypeScript. The real code is about 280,000 lines of C++ plus the JavaScript controller mappings.
- The one installer hit, lib/kaitai/.build/run-unittest.ps1, is a 31-line test runner belonging to a vendored parsing library.
- There is no lockfile for the C++ dependencies, so the scanner had nothing to check for advisories; libraries come from system packages or the project's prepared build environments.
- 15 workflows. The labeler uses pull_request_target with read-only permissions and does not check out pull request code. None of the 23 third-party actions is pinned to a commit. Its OpenSSF Scorecard is 5.2 out of 10, with a full 10 for code review and 0 for token permissions and pinned dependencies. Dependabot and code of conduct present; no security policy.
What the scanner counted
| Check | Result |
|---|---|
| Secrets | None found. |
| Suspicious code | None found. |
| Install-time code | 1 installer script |
| Committed binaries | None. |
| CI workflows | 15 workflows. 1 uses pull_request_target, none check out the pull request head. 23 of 23 third-party actions pinned to a tag rather than a commit. |
| Network hosts | 40 distinct hosts referenced from source; most often github.com, tc39.es, mixxx.org, doc.qt.io. No URLs to bare IP addresses. |
| Known vulnerabilities | No lockfile to check: dependencies are declared as ranges, so what gets installed is whatever is current on the day. |
| Project hygiene | Has automated dependency updates, licence file, contributing guide. Missing security policy, CodeQL. |
| OpenSSF Scorecard | 5.2 out of 10, as of Oct 19, 2026. |
The raw findings
Every hit the scanner wrote out, with a link to the exact line at the scanned commit. Secrets candidates are redacted.
Installer scripts (1)
- lib/kaitai/.build/run-unittest.ps1, 31 lines; talks to learn.microsoft.com
Workflows worth a look
- .github/workflows/labeler.yml: pull_request_target
By the numbers
| Stars | 7,314 |
|---|---|
| Forks | 2,010 |
| Contributors | 467 |
| Commits | 54.1K |
| Open issues | 2,469 |
| Open pull requests | 506 |
| Releases | 31 |
| Latest release | 2.5.6 |
| Licence | custom |
| Main language | C++ |
| Project age | 13 years |
| Last push | Oct 25, 2026 |
| Tracked files | 6,065 |
| Lines of code | 2M |
| Checkout size | 189 MB |
Lines by language: TypeScript 1.4M, C++ 277.3K, JavaScript 155.8K, C/C++ header 103.5K, C 22.6K, Shell 12.7K.
Questions
Is Mixxx free?
Yes. Mixxx is free and open source under GPLv2 or later, with every feature available and no subscription. The project is funded by donations.
Does Mixxx work with my DJ controller?
Probably. Mixxx ships mappings for a long list of MIDI and HID controllers, and the manual's hardware compatibility list shows which are supported and how well. If yours is missing, mappings can be written in JavaScript or created with the built-in MIDI learning wizard.
Can I use streaming services in Mixxx?
Mixxx plays music files from your own library. It does not integrate streaming services, so tracks need to be downloaded files you have the right to use.
This post is part of GitHub Tools, where every repository is cloned and scanned before it is written up. The scan is a snapshot of one commit on one day; the repository has moved on since, so check it before you install.