kitodo/publication

Dependency profilecaution

The 18 runtime dependencies reflect a substantial TYPO3, search, and metadata integration package; this adds maintenance surface but is consistent with its broad application role.

Repo bus factorcaution

All 17 recent commits came from one contributor, creating a real continuity risk. Organization backing partly compensates because maintenance can potentially be handed off within the project.

Token permissionscaution

One workflow omits top-level permissions and another grants top-level write access, leaving avoidable CI token exposure despite the absence of other dangerous workflow patterns.