dbt-labs/dbt: technical due diligence, read from its repository

The median source file here is 68 lines. 151 files exceed 1,000 lines, the largest being 11,634. Size is not a defect on its own — some problems genuinely live in one place — but these are where merge conflicts, review fatigue and single-owner knowledge concentrate, and they are the first thing that slows an inheriting engineer down.

The newest release, v2.0.8, is not on the branch this survey read; the newest release on it is v0.19.0. The shipped product may differ from what this report describes. Survey the release branch too.

21 third-party CI actions are referenced by a tag or branch rather than a commit, so they run whatever that tag points to on the day; 1 step pipes a download straight into a shell. Tags have been moved to malicious commits in real supply-chain attacks, and a piped script is whatever the server returns that minute. Pinning to a commit is the fix, and it is small.

13 of 1,007 locked dependencies match 27 published advisories in OSV, 17 of them rated high or critical. A lockfile says which version is installed, not whether the flawed code is reachable from this product, so each needs a look. Most are fixed by an upgrade, and the advisory names the version. None of the high or critical ones is in what the product ships: their lockfile is a separate application (an internal tool, an editor extension), not the product.

Third-party code is committed into this repository without any statement of the terms it arrived under. Unknown terms are harder to deal with than inconvenient ones: an awkward licence can be complied with, an absent one cannot. Each of these needs its origin established before the code changes hands.

The newest was published on 2026-10-14. A project that publishes advisories is telling its users about its fixes, and the count and pace say how much security work it carries. Whether 9 of them are fixed in the code you ship could not be told from this history: its version is only known to be at least 2.0.8. Answer lives in: the release you run, set against each fixed version. The record is incomplete: NVD: 2 records name dbt with nothing tying them to this repository (CVE-2024-10586, CVE-2026-49360).

Nothing in the service initialises an error reporter (Sentry, Rollbar, Bugsnag, Honeybadger or an APM agent). An exception in production reaches a person only if someone is reading the logs, which usually means a customer reports it first.