Borehole · Project · free tier
treeverse/lakefs
Free reading: not for reliance
3456769 · 6,569 commits · 2,771 files
Read 2026-10-23

treeverse/lakefs: technical due diligence, read from its repository

What Borehole read in treeverse/lakefs's code and history at 3456769: its licence, security advisories, releases, review practice, tests, dependencies and operations. Every finding cites the file and line it rests on. The full report also covers the team and asks the questions the code cannot answer.

DimensionRating
Architecture & Codebase — including AI provenancestrong
Engineering Process & SDLC Maturitystrong
Product & Engineering Maturityadequate
Security & Reliability Postureadequate
Observability & Operationsadequate
Fit with the Acquirernot assessable

What the repository says

  • LICENSE:1: The licence is BUSL-1.1: source available, not open source
  • LICENSE: Relicensed: Apache-2.0 → BUSL-1.1 (2026-09-22)

Architecture & Codebase — including AI provenance

strong
01.6

pkg/api/controller.go is 6,106 lines, 71× this codebase's median file

adequate

The median source file here is 86 lines. 8 files exceed 1,000 lines, the largest being 6,106. Size is not a defect on its own — some problems genuinely live in one place — but these are where merge conflicts, review fatigue and single-owner knowledge concentrate, and they are the first thing that slows an inheriting engineer down.

Evidence
pkg/api/controller.go:1 — 6,106 lines (71× median)
pkg/graveler/graveler.go:1 — 4,015 lines (46× median)
pkg/catalog/catalog.go:1 — 3,571 lines (41× median)
webui/src/pages/repositories/repository/objects.jsx:1 — 1,609 lines (18× median)
webui/src/lib/api/index.js:1 — 1,500 lines (17× median)
01.33

A move from JavaScript to TypeScript began 48 months ago and is 39% done

adequate

38 product files are in the new language and 59 are still in the old one, 48 months after the first new file appeared. The new language's share of the lines rose from 0% to 20%, and moved 3 percentage points in the last year. Two languages for one job doubles what an engineer has to know, and the unmoved half is usually what nobody wants to touch. Ask whether finishing it is planned, and what it costs.

Evidence
59 old, 38 new

Engineering Process & SDLC Maturity

strong

No finding.

Product & Engineering Maturity

adequate
04.3

93 direct dependencies in a single manifest

adequate

go.mod declares 93 direct dependencies. Each one is a maintenance obligation, a supply-chain surface and a potential licence question that transfers with the asset. The count says nothing about whether any given dependency was a good choice; it says how many such choices a buyer inherits.

Evidence
go.mod — 93 declared
webui/package.json — 39 declared
clients/python/pyproject.toml — 4 declared
clients/python-wrapper/pyproject.toml — 2 declared
04.38

15 files still carry code deprecated more than two years ago

adequate

15 files were marked deprecated over two years ago and still are, the oldest since Apr 2021. A deprecation is a promise to remove. Ask what still depends on these, and whether removing them is scheduled.

Evidence
pkg/catalog/catalog.pb.go — deprecated since Apr 2021
pkg/block/adapter.go — deprecated since Apr 2021
pkg/catalog/model.go — deprecated since Apr 2021
pkg/graveler/graveler.pb.go — deprecated since Jun 2021
pkg/graveler/settings/test_settings.pb.go — deprecated since Sep 2021

Security & Reliability Posture

adequate
05.1

1 credential-shaped string committed to the tree

adequate

Matches for AWS access key appear in tracked files outside test and fixture paths. They stay in the history even after they leave the tree, so what matters is whether each was rotated. The code cannot tell whether any of them is live, and that decides whether this matters: none sits in production configuration, and none is in a format its provider keeps for live keys. Is any of these live? Show that each was rotated after it was committed, and when.

Evidence
AWS access key pattern matched
05.27

The build runs third-party code it does not pin

adequate

20 third-party CI actions are referenced by a tag or branch rather than a commit, so they run whatever that tag points to on the day. Tags have been moved to malicious commits in real supply-chain attacks, and a piped script is whatever the server returns that minute. Pinning to a commit is the fix, and it is small.

Evidence
.github/workflows/check-webui-docs-links.yaml:37 — action pinned by tag
.github/workflows/claude.yml:35 — action pinned by tag
05.22

1 deserialiser that can run code

adequate

1 places read data with a deserialiser that executes what it reads (`yaml.load` without a safe loader). That is safe on data the system wrote itself and remote code execution on anything else. Ask where each one's input comes from.

Evidence
clients/python-wrapper/lakefs/config.py:131 — code-executing deserialiser
05.26

18 locked dependencies have published vulnerabilities, 20 high or critical in what ships

adequate

18 of 964 locked dependencies match 58 published advisories in OSV, 30 of them rated high or critical. A lockfile says which version is installed, not whether the flawed code is reachable from this product, so each needs a look. Most are fixed by an upgrade, and the advisory names the version. This lockfile pins development tools alongside what ships and does not say which is which, so some of these may never reach a user.

Evidence
go.mod — github.com/getkin/kin-openapi v0.131.0: GHSA-r277-6w6q-xmqw (critical), fixed in 0.144.0
webui/package-lock.json — dompurify 3.4.12: GHSA-cg2g-xh64-v4q7 (critical), fixed in 3.4.17
go.mod — github.com/labstack/echo/v4 v4.11.4: GHSA-cxf3-9h37-7rr8 (critical), fixed in 4.16.1
05.49

The production build publishes source maps

adequate

The build configuration emits source maps for production, so the original source, with its comments and structure, is downloadable by every visitor. Upload them to an error tracker and keep them off the public server instead.

Evidence
webui/vite.config.mts:66 — source maps in a production build
05.66

The licence is BUSL-1.1: source available, not open source

adequate

LICENSE grants BUSL-1.1: source available, not open source; production use restricted until the change date. The reading comes from the licence's own title and clauses. Whether the terms fit the buyer's intended use, and whether any paid licence transfers with the code, is a question for counsel and the licensor.

Evidence
LICENSE:1 — 150 lines, BUSL-1.1
05.60

Relicensed: Apache-2.0 → BUSL-1.1 (2026-09-22)

adequate

The root licence changed 1 time(s). The latest terms restrict what users, hosts or a buyer may do in ways the earlier ones did not. Code taken under the old terms stays under them, so both matter in diligence.

Evidence
LICENSE — Apache-2.0 from 2020-08-02
LICENSE — BUSL-1.1 from 2026-09-22
05.65

10 advisories against this project in the last 24 months, 3 high or critical

adequate

The newest was published on 2026-10-01. A project that publishes advisories is telling its users about its fixes, and the count and pace say how much security work it carries.

Evidence
2026-10-01: GHSA-96f7-c79c-crg8 (high), fixed in 1.103.0: S3 gateway accepts unsigned headers on presigned URLs, allowing reads with the signer's permissions
2026-10-01: GHSA-223c-qwgx-wwcg (moderate): Server-side request forgery (SSRF) via action hooks (webhook, Airflow, Lua net/http)
2026-08-05: GHSA-gf2q-q6wc-x7fm (low): Improper access control: user can list branches via S3 gateway ListObjects API without the fs:ListBranches permission
2026-07-24: CVE-2026-66006 (moderate): lakeFS through 1.83.0, fixed in commit 71a45ee, contains an authentication bypass vulnerability in the /setup_comm_prefs endpoint that allows unauthenticated at
2026-05-21: GHSA-c2r5-5j4w-2xff (high), fixed in 1.81.1: stored XSS in rendered markdown previews via raw HTML

Observability & Operations

adequate
06.9

No error reporter is wired in

adequate

Nothing in the service initialises an error reporter (Sentry, Rollbar, Bugsnag, Honeybadger or an APM agent). An exception in production reaches a person only if someone is reading the logs, which usually means a customer reports it first.

Evidence
no error reporter initialised
06.35

Sends usage data to stats.lakefs.io by default

adequate

pkg/config/defaults.go sends to stats.lakefs.io, and clients/python/lakefs_sdk/api/internal_api.py leaves reporting on as shipped. Every installation reports to the vendor unless its operator turns this off. For a buyer running it inside their own product, that is an outbound data flow to a third party: ask what is sent, how often, and whether the buyer's customers were told.

Evidence
pkg/config/defaults.go:115 — reports to stats.lakefs.io
clients/python/lakefs_sdk/api/internal_api.py:1527 — the reporting setting is on by default

Fit with the Acquirer

not assessable

Not rated: structurally not assessable from a repository.

Read more, or read your own

The full report on treeverse/lakefs: every dimension, the questions for the room, and the audit log.

Survey a repository: free on public repositories. Private code is read on your own machine by a collector whose source you can read first.