islandora/crayfish

Collection of Islandora microservices, lovingly known as Crayfish.

Latest 5.0.2

78%

Total Score

healthy

Healthy package with active releases and organizational backing, despite single-contributor activity and partly unpinned workflows.

Are you affected? Scan for Free

Health Score Breakdown

Repo bus factor

One contributor made all 2 recent commits, concentrating recent activity completely in one person. Organization backing provides some handoff capacity, but no second recent contributor is shown.

Repo commit activity

Only 2 commits occurred in the last 3 months, indicating limited direct commit activity. Recent pull-request merges partly compensate, but the signal still suggests slower maintenance.

Workflow audit

All four workflows were analyzed with no audit findings, no untrusted checkouts, no script injection, and no top-level write permissions. However, 8 of 16 action references are unpinned, which weakens build reproducibility.

Vulnerabilities

Title	Versions	Severity
CVE-2025-25286 islandora/crayfish is vulnerable to Improper Neutralization of Escape, Meta, or Control Sequences in versions 0.0.0 - 4.1.0.	0.0.0 - 4.1.0	Critical