Dependency analysis patterns

Skill vibeeval/vibecosystem/skills/dependency-analysis-patterns

AI software team for Claude Code - 138 agents, 295 skills, 73 hooks. Self-learning, multi-agent swarm, autonomous skill evolution.

Install

npx -y skills add vibeeval/vibecosystem --skill dependency-analysis-patterns

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

What its author says it does

Copied from the file, not written here

Dependency graph visualization, circular dependency detection, CVE scanning, and license compliance

SKILL.md

2.5 KB, as published. Nobody here has run it

Dependency Analysis Patterns

Dependency Graph Visualization

# npm
npx depcruise --output-type dot src/ | dot -T svg > deps.svg

# Python
pipdeptree --graph-output svg > deps.svg

# Go
go mod graph | modgraphviz | dot -T svg > deps.svg

Circular Dependency Detection

# JavaScript/TypeScript
npx madge --circular src/
npx dpdm --circular src/index.ts

# Python
pydeps --cluster --no-show src/

Fix Strategies

Circular Tip	Çözüm
A → B → A	Interface/port ile inversion
A → B → C → A	Shared module extract et
Barrel file circular	Direct import kullan

CVE Scanning

# npm
npm audit --json | jq '.vulnerabilities | to_entries[] | select(.value.severity == "critical")'

# pip
pip-audit --format json --desc

# Go
govulncheck ./...

# Multi-tool
trivy fs --severity CRITICAL,HIGH .

CVE Prioritization

CVSS	Severity	Aksiyon	SLA
9.0+	Critical	Hotfix	24h
7.0-8.9	High	Sprint fix	1 hafta
4.0-6.9	Medium	Backlog	1 ay
<4.0	Low	Track	Fırsatçı

License Compliance

# npm
npx license-checker --production --json --failOn "GPL-3.0;AGPL-3.0"

# Python
pip-licenses --format=json --fail-on="GPL-3.0"

License	Commercial OK	Copyleft	Risk
MIT	Evet	Hayır	Düşük
Apache-2.0	Evet	Hayır	Düşük
BSD-3	Evet	Hayır	Düşük
MPL-2.0	Evet	Kısmi	Orta
LGPL	Dikkat	Kısmi	Orta
GPL-3.0	Dikkat	Evet	Yüksek
AGPL-3.0	Dikkat	Evet	Çok yüksek

Update Impact Analysis

# npm - outdated
npm outdated --json

# Semver risk
# patch (0.0.x) → güvenli
# minor (0.x.0) → genelde güvenli
# major (x.0.0) → breaking change riski

# Test after update
npm update <pkg> && npm test

Checklist

npm audit / pip-audit temiz (critical/high yok)
License audit pass (GPL yok)
Circular dependency yok
Lockfile committed ve güncel
Unused dependency yok (depcheck)
Renovate/Dependabot aktif
Major version behind ≤1

Anti-Patterns

Audit warning'leri ignore etmek
Lockfile commit etmemek
Pinned version kullanmamak (^, ~)
License check'siz production dependency
Dependency update'siz 6+ ay