io.kestra:kestra

The linked Kestra project shows exceptionally strong ongoing maintenance and organizational backing: 197 releases in the last 12 months, 1,451 commits from 100 active maintainers in three months, substantial issue and pull-request throughput, a non-archived repository, broad contributor distribution, security tooling, and build provenance. However, the published artifact's README identifies itself as MySQL Connector/J and refers to Oracle, despite the package being io.kestra:kestra and the linked repository matching Kestra; this is a serious release-transparency and artifact-integrity concern that materially reduces confidence in depending on this specific release. Workflow permission hygiene also has notable gaps, although the repository has a security policy and active project governance.

Latest 2.0.0

Maven

58%

Total Score

Maintainer Stability

100

Dependencies

Maturity

Supply Chain

Attestations

100

Are you affected? Scan for Free

Vulnerabilities

Title	Versions	Severity
AIKIDO-2026-789992 New kestra is vulnerable to Remote Code Execution in versions 0.2.0 - 1.0.44 and 1.1.0 - 1.3.20.	0.2.0 - 1.0.441.1.0 - 1.3.20	Critical
CVE-2026-55839 io.kestra:kestra is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in versions 0.0.0 - 1.3.24.	0.0.0 - 1.3.24	High

Package versions

Maintainers

No maintainer information available.

Direct Dependencies

Dependency	Last Release	Score
com.google.guava:guava Version *	—	—
commons-io:commons-io Version *	—	—
org.apache.commons:commons-lang3 Version *	—	—
io.swagger.core.v3:swagger-annotations Version *	—	—
com.google.code.findbugs:jsr305 Version *	—	—