apitable/apitable: technical due diligence, read from its repository

5 of 11 `FROM` lines in product Dockerfiles name an image without a version, or with `latest`. Each build pulls whatever the registry serves that day, so the image that ships can change without a commit, and last month's build cannot be reproduced. Pin a version, or a digest.

478 test files against 6,761 source files (7.1%). This does not measure whether the tests are good, only whether enough of them exist for the codebase to be changed safely by someone who did not write it — which is exactly the situation after an acquisition.

packages/datasheet/package.json declares 194 direct dependencies. Each one is a maintenance obligation, a supply-chain surface and a potential licence question that transfers with the asset. The count says nothing about whether any given dependency was a good choice; it says how many such choices a buyer inherits.

Of 54 fixes in the last 24 months, 0 touched a test. A fix without the test that would have caught the bug can quietly come back, and the suite never learns from what went wrong.

Within a single package: HTTP clients: axios, node-fetch; dates: date-fns, dayjs, luxon, moment; state management: jotai, redux. Each duplicate is bundle size, two ways of doing the same thing in one codebase, and two upgrade paths to maintain. It is usually the residue of a migration that stopped halfway.

No USER instruction switches away from root, so the process runs with full privileges inside the container. It is a one-line fix and an ordinary expectation, which is why its absence is worth asking about: it usually says more about whether anyone has reviewed the deployment than about this container specifically.

123 of 4,059 locked dependencies match 241 published advisories in OSV, 120 of them rated high or critical. A lockfile says which version is installed, not whether the flawed code is reachable from this product, so each needs a look. Most are fixed by an upgrade, and the advisory names the version. This lockfile pins development tools alongside what ships and does not say which is which, so some of these may never reach a user.

The newest was published on 2026-10-15. A project that publishes advisories is telling its users about its fixes, and the count and pace say how much security work it carries.