kestra-io/kestra

• CAI 54 → 60 (+6.2)
• Rubric changed (rubric-2026.08.17 → rubric-2026.08.18) — scores are not directly comparable.

• Code Health 80 → 80 (-0.2)
• Architecture 69 → 69 (+0.0)
• Maturity 61 → 61 (+0.7)
• Readiness 60 → 60 (+0.0)
• Security 59 → 80 (+20.8)
• Domain Modelling 100 → 100 (+0.0)
• Accessibility 44 → 54 (+10.4)

• Dependency hygiene not measured — no supported dependency manifest was read
• High: security finding (details withheld)
• High: security finding (details withheld)
• High: security finding (details withheld)
• High: security finding (details withheld)
• High: security finding (details withheld)
• High: security finding (details withheld)
• High: security finding (details withheld)
• High: security finding (details withheld)
• High: security finding (details withheld)
• High: security finding (details withheld)
• High: security finding (details withheld)
• High: security finding (details withheld)
• High: security finding (details withheld)
• High: security finding (details withheld)
• High: security finding (details withheld)
• High: security finding (details withheld)
• High: security finding (details withheld)
• High: security finding (details withheld)
• High: security finding (details withheld)
• …and 42 more

• AgentOrchestrator.runLoop (cognitive 32) (webserver/src/main/java/io/kestra/webserver/services/ai/agent/AgentOrchestrator.java)
• Build action pinned to a mutable branch
• ChatMessageAdaptor.project (cognitive 18) (webserver/src/main/java/io/kestra/webserver/services/ai/agent/internals/ChatMessageAdaptor.java)
• Dependency hygiene not measured — dependency manifest found but not parsed for hygiene
• ExecutorService.addWorkerTaskResult (cognitive 22) (executor/src/main/java/io/kestra/executor/ExecutorService.java)
• High CVE: [GHSA redacted] (ui/package-lock.json)
• High CVE: [GHSA redacted] (ui/package-lock.json)
• ILogs.whereWithGlobalFilters (cognitive 21) (core/src/main/java/io/kestra/plugin/core/dashboard/data/ILogs.java)
• ILogs.whereWithGlobalFilters (cyclomatic 18) (core/src/main/java/io/kestra/plugin/core/dashboard/data/ILogs.java)
• PR-triggered workflow without a permissions block
• SearchPluginsTool.searchPlugins (cognitive 20) (webserver/src/main/java/io/kestra/webserver/services/ai/agent/tool/SearchPluginsTool.java)

• 162 commits — 86 feature/other, 76 fixes

• ui/src — 50 commits
• core/src — 32 commits
• ui/packages — 24 commits
• platform/build.gradle — 14 commits
• webserver/src — 10 commits
• .github/workflows — 6 commits
• (root) — 5 commits
• executor/src — 3 commits
• jdbc-mysql/src — 3 commits
• cli/src — 2 commits
• jdbc-h2/src — 2 commits
• jdbc/src — 2 commits
• storage-local/src — 2 commits
• tests/src — 2 commits
• charts/kestra — 1 commit
• jdbc-postgres/src — 1 commit
• script/src — 1 commit
• ui/package.json — 1 commit
• worker-controller/build.gradle — 1 commit

• fix: Fix save filter dialog to display condition groups (#16434) (#17335)
• fix: Revert "test: add code coverage for DashboardRepository"
• fix: fix(ai): give the copilot new chat button hover and disabled states (#17697)
• fix: fix(ai): keep the current flow open when applying a copilot change (#17706)
• fix: fix(ai): open flow blueprints from the copilot card (#17664)
• fix: fix(ai): refresh the copilot empty state logo with the new 3D mark (#17681)
• fix: fix(ai): stop the copilot working indicator dots from clipping at the top (#17707)
• fix: fix(build): correct jq filter for scoped package name in hey-api-plugin release workflow (#17588)
• fix: fix(build): drop invalid working-directory on the app-token action step (#17591)
• fix: fix(build): publish hey-api-plugin releases to kestra-io/hey-api-plugin (#17590)
• fix: fix(charts): remove unsupported --worker-group flag for v2 worker groups
• fix: fix(core): avoid YAML quoting from trailing spaces (#17667)
• fix: fix(core): bound the plugin documentation cache to stop unbounded heap growth
• fix: fix(core): bring back filter on flow exceution (#17698)
• fix: fix(core): center the icon in circle and square buttons (#17673)
• fix: fix(core): correct findLastNotTerminated predicate to skip terminated and paused runs
• fix: fix(core): count non-terminated task runs against Parallel/Dag concurrency limit (#17528)
• fix: fix(core): forward delete in policy (#17655)
• fix: fix(core): guard null input in startsWith/endsWith Pebble filters
• fix: fix(core): harden nanoId() against invalid inputs and biased alphabets
• …and 142 more

Written by watchdog.canine.dev from the codebase's own history, inside the signed delivery this page is composed from.

kestra-io/kestra was measured the same way every project in this corpus was: the same rubric, at a pinned commit, with the result published in full. Point a surveyor at a repository you know and see whether you agree with it.