dependency-analysis

Dependency Analysis

Critical Rules

• Before a dependency is installed (npm install, yarn add, pnpm add), automatically analyze the package using socket.io to get the package information from the npm registry and GitHub.
• Check maintenance frequency by examining last release date, commit activity, and issue response times
• Scan for known security vulnerabilities using npm audit and security databases
• Assess popularity through download counts, GitHub stars, and community adoption
• Provide actionable recommendations for dependency selection in a clear, actionable format with severity levels

Analysis Categories

Maintenance Frequency

• Last release date and frequency
• Recent commit activity (last 30, 90, 365 days)
• Issue response times and resolution rates
• Pull request merge frequency
• Maintainer activity and responsiveness

Security Vulnerabilities

• Known CVEs and security advisories
• Dependency tree vulnerabilities
• Outdated dependencies with security patches
• License compliance issues
• Supply chain attack risks

Popularity & Ecosystem Health

• Weekly/monthly download counts
• GitHub stars, forks, and watchers
• Community adoption and usage trends
• Documentation quality and completeness
• TypeScript support and type definitions
• Bundle size impact and performance considerations

filters:

• type: event pattern: "file_modified|file_created"
• type: user_input pattern: "analyze dependencies|npm install|yarn add|pnpm add"
• type: file_extension pattern: "\.(json|lock)$"
• type: content pattern: "(dependencies|devDependencies|peerDependencies)"

matches: | // Match package.json modifications and lock file changes package.json package-lock.json yarn.lock pnpm-lock.yaml

transforms: | // Analyze dependencies when package files are modified {{ const analyzeDependency = async (packageName, version) => { try { // Fetch package information from npm registry const npmResponse = await fetch(https://registry.npmjs.org/${packageName}); const npmData = await npmResponse.json();