Vibecosystem dependency-analysis-patterns

Dependency graph visualization, circular dependency detection, CVE scanning, and license compliance

install

source · Clone the upstream repo

git clone https://github.com/vibeeval/vibecosystem

Claude Code · Install into ~/.claude/skills/

T=$(mktemp -d) && git clone --depth=1 https://github.com/vibeeval/vibecosystem "$T" && mkdir -p ~/.claude/skills && cp -r "$T/skills/dependency-analysis-patterns" ~/.claude/skills/vibeeval-vibecosystem-dependency-analysis-patterns && rm -rf "$T"

manifest: skills/dependency-analysis-patterns/SKILL.md

Dependency Analysis Patterns

Dependency Graph Visualization

# npm
npx depcruise --output-type dot src/ | dot -T svg > deps.svg

# Python
pipdeptree --graph-output svg > deps.svg

# Go
go mod graph | modgraphviz | dot -T svg > deps.svg

Circular Dependency Detection

# JavaScript/TypeScript
npx madge --circular src/
npx dpdm --circular src/index.ts

# Python
pydeps --cluster --no-show src/

Fix Strategies

Circular Tip	Çözüm
A → B → A	Interface/port ile inversion
A → B → C → A	Shared module extract et
Barrel file circular	Direct import kullan

CVE Scanning

# npm
npm audit --json | jq '.vulnerabilities | to_entries[] | select(.value.severity == "critical")'

# pip
pip-audit --format json --desc

# Go
govulncheck ./...

# Multi-tool
trivy fs --severity CRITICAL,HIGH .

CVE Prioritization

CVSS	Severity	Aksiyon	SLA
9.0+	Critical	Hotfix	24h
7.0-8.9	High	Sprint fix	1 hafta
4.0-6.9	Medium	Backlog	1 ay
<4.0	Low	Track	Fırsatçı

License Compliance

# npm
npx license-checker --production --json --failOn "GPL-3.0;AGPL-3.0"

# Python
pip-licenses --format=json --fail-on="GPL-3.0"

License	Commercial OK	Copyleft	Risk
MIT	Evet	Hayır	Düşük
Apache-2.0	Evet	Hayır	Düşük
BSD-3	Evet	Hayır	Düşük
MPL-2.0	Evet	Kısmi	Orta
LGPL	Dikkat	Kısmi	Orta
GPL-3.0	Dikkat	Evet	Yüksek
AGPL-3.0	Dikkat	Evet	Çok yüksek

Update Impact Analysis

# npm - outdated
npm outdated --json

# Semver risk
# patch (0.0.x) → güvenli
# minor (0.x.0) → genelde güvenli
# major (x.0.0) → breaking change riski

# Test after update
npm update <pkg> && npm test

Checklist

```
npm audit
```
/
```
pip-audit
```
temiz (critical/high yok)
License audit pass (GPL yok)
Circular dependency yok
Lockfile committed ve güncel
Unused dependency yok (
```
depcheck
```
)
Renovate/Dependabot aktif
Major version behind ≤1

Anti-Patterns

Audit warning'leri ignore etmek
Lockfile commit etmemek
Pinned version kullanmamak (^, ~)
License check'siz production dependency
Dependency update'siz 6+ ay