Lightning Talk: Smaug's Cave: Studying Thousands of Gems at Shopify
summary
Shopify reconstructs historical RubyGem usage by scraping GitHub commits and extracting every Gemfile.lock change into SQLite, then joining that with the Ruby Advisory DB (rubysec) for vuln analysis. Results: 230,000 commits from ~1,300 repos since 2011, thousands of gems, about 75% still in use and ~25% abandoned, and dozens of new gems per month. Dependabot plus custom automation cut remediation time dramatically. Reconstruction works but requires robust scraping logic and normalized storage to enable meaningful plots.
AI-written summary · about
