Decisions, Open Source, Graph Theory, and Static Analysis
summary
Builds a dependency graph over ~880,000 npm packages (millions of versioned nodes if you include history) and extracts ranked codependency matrix rows to show what people who depend on A also depend on. Demoed a public beta that computes top co-dependencies (async 240, underscore 207, optimist relationships with async 534), draws arcs sized by degree and colored by dominant package, and returns actionable results. Adds static analysis with apra to scan dependents’ source and flags surprising API use (Winston’s warn used as often as log).
AI-written summary · about
chapters (5)
- 0:00Start
- 2:00HCI & Static Analysis?
- 5:14Dependency graphs
- 8:21Codependencies
- 16:14I should use static analysis with npm
related talks
11mDependencies Static Analysis and The Grid
41mThe Future of JavaScript Package Management
42mSecuring Your Software Supply Chain
24mManaging Dependencies with Confidence
20mEfficient Static Vulnerability Analysis for JavaScript with Multiversion Dependency Graphs
42mThe Good, the Bad and NPX- 41mThe Future of JavaScript Package Management
19mNavigating JavaScript Userland