@boilerbuilder/deps-analyzer
Advanced tools
CLI tool to analyze dependency evolution and release frequency
📊 Advanced CLI tool to analyze dependency evolution, release frequency, and semver patterns in JavaScript/Node.js projects.
git clone <repository-url>
cd deps-analyzer
npm install
npm run link # Link globally for testing
deps-analyzer --help # Test the command
npm run unlink # Unlink when done
For detailed information on specific topics:
# Analyze templates directory
deps-analyzer ./templates
# Analyze single project
deps-analyzer ./package.json
# Use glob patterns
deps-analyzer "projects/**/package.json"
# Analyze specific projects
deps-analyzer templates/next-app templates/react-spa-vite --output selected-projects
# Mix directories and files
deps-analyzer ./frontend ./backend/package.json --output fullstack-analysis
# Custom analysis period
deps-analyzer ./templates --months 18
# Custom output name
deps-analyzer ./templates --output my-report
# Skip NPM analysis (discovery only)
deps-analyzer ./templates --no-npm
# Use HTTP instead of npm CLI (slower but more compatible)
deps-analyzer ./templates --use-http
# Advanced filtering for internal libraries
deps-analyzer ./templates --internal-libs "@akad/*,design-system*"
# Skip specific version filters
deps-analyzer ./templates --ignore-filter alpha,beta,rc
# Combined enterprise usage
deps-analyzer ./templates --internal-libs "@company/*" --ignore-filter canary,nightly
# Custom max-deps configuration file
deps-analyzer ./templates --max-deps-config ./my-constraints.json
# Strategic version control example
echo '{"react": "^18.0.0", "typescript": "^5.0.0"}' > max-deps.json
deps-analyzer ./project --max-deps-config max-deps.json
# Help and version
deps-analyzer --help
deps-analyzer --version
Analyze only internal or external dependencies using --scope:
# Analyze only internal dependencies
deps-analyzer ./templates --scope=internal --internal-libs "@company/*"
# Analyze only external dependencies (excludes internal)
deps-analyzer ./templates --scope=external --internal-libs "@company/*"
# Analyze all dependencies (default behavior)
deps-analyzer ./templates --scope=all --internal-libs "@company/*"
Strategic version control with custom configuration files:
# Production environment constraints
deps-analyzer ./templates --max-deps-config ./configs/production.json
# Shared team constraints
deps-analyzer ./templates --max-deps-config /shared/team-constraints.json
# Benchmark analysis (zero-drift simulation)
deps-analyzer ./templates --max-deps-config ./benchmarks/zero-drift.json --output benchmark
# Enterprise compliance analysis
deps-analyzer ./microservices --max-deps-config ./security/approved-versions.json
The tool generates two files with comprehensive analysis:
<output>.json){
"metadata": {
"generatedAt": "2025-08-14T00:26:31.877Z",
"period": "24 months",
"totalProjects": 2,
"totalDependencies": 52,
"uniqueDependencies": 36,
"globalUniqueReleases": {
"totalLast12m": 1130,
"totalLast12to24m": 983,
"avgPerMonthLast12m": 94.17,
"avgPerMonthLast12to24m": 81.92,
"semverBreakdown": {
"majorLast12m": 26,
"minorLast12m": 165,
"patchLast12m": 597,
"avgMajorPerMonthLast12m": 2.17,
"avgMinorPerMonthLast12m": 13.75,
"avgPatchPerMonthLast12m": 49.75
}
}
},
"projects": {
"react-spa-vite": {
"packagePath": "/path/to/package.json",
"dependencyCount": 32,
"dependencies": {
"react": {
"currentVersion": "19.1.1",
"last12Months": 3,
"months12to24": 2,
"totalReleases": 345,
"avgReleasesPerMonthLast12m": 0.25,
"avgReleasesPerMonthLast12to24m": 0.17,
"avgDaysBetweenReleases": 14.6,
"semverBreakdown": {
"majorLast12m": 1,
"minorLast12m": 1,
"patchLast12m": 1,
"majorLast12to24m": 0,
"minorLast12to24m": 1,
"patchLast12to24m": 1
},
"monthlyBreakdown": {
"2024-12": ["19.0.0"],
"2025-03": ["19.1.0"],
"2025-07": ["19.1.1"]
},
"mostActiveMonth": "2024-12 (1)"
}
},
"metadata": {
"totalReleasesLast12m": 672,
"totalReleasesLast12to24m": 655,
"totalReleases": 6429,
"avgReleasesPerMonthLast12m": 56,
"avgReleasesPerMonthLast12to24m": 54.58,
"semverBreakdown": {
"totalMajorLast12m": 22,
"totalMinorLast12m": 140,
"totalPatchLast12m": 419,
"avgMajorPerMonthLast12m": 1.83,
"avgMinorPerMonthLast12m": 11.67,
"avgPatchPerMonthLast12m": 34.92
}
}
}
}
}
<output>.md)# Dependencies Evolution Report
## Summary
- **Generated at:** 2025-08-14 00:26:31 UTC
- **Analysis period:** 24 months
- **Projects analyzed:** 2
- **Total dependencies:** 52
- **Unique dependencies:** 36
## Global Statistics
- **Total releases (12m):** 1,130 (avg: 94.17/month)
- **Total releases (12-24m):** 983 (avg: 81.92/month)
- **Semver breakdown (12m):** 26 major, 165 minor, 597 patch
## Project: react-spa-vite (32 dependencies)
### Dependencies Release Activity (Last 12m vs 12-24m)
| Package | Current | 12m | 12-24m | Major | Minor | Patch | Most Active Month |
|---------|---------|-----|--------|-------|-------|-------|-------------------|
| react | 19.1.1 | 3 | 2 | 1 | 1 | 1 | 2024-12 (1) |
const { main } = require('deps-analyzer');
// Basic analysis
const result = await main(['./templates']);
// Multiple patterns
const result = await main([
'./templates/next-app',
'./templates/react-spa-vite'
]);
// With options
const result = await main(['./templates'], {
months: 18,
output: 'custom-report',
analyzeNpm: true,
useNpmCli: true
});
| Option | Default | Description |
|---|---|---|
--months <number> | 24 | Analysis period in months |
--output <path>, -o | dependency-report | Output file base name |
--scope <type> | all | Filter dependencies by scope: internal, external, all |
--no-npm | false | Skip NPM registry analysis (discovery only) |
--use-http | false | Use HTTP requests instead of npm CLI (slower) |
--ignore-filter <list> | [] | Skip filtering specific version types (alpha,beta,rc,etc) |
--internal-libs <list> | [] | Libraries to include alpha/beta versions (supports wildcards: @akad/,design-system) |
--max-deps-config <path> | null | Custom max-deps.json file path for strategic version control |
--help, -h | - | Show help information |
--version, -v | - | Show version |
# Analyze all templates
deps-analyzer ./templates --months 12 --output templates-report
# Analyze specific templates
deps-analyzer templates/next-app templates/react-spa-vite --output selected-templates
# Analyze all packages
deps-analyzer "packages/*/package.json" --months 18
# Analyze specific workspaces
deps-analyzer packages/frontend packages/backend packages/shared --output monorepo-analysis
# Skip NPM analysis for faster results
deps-analyzer ./project --no-npm
# Discovery only with HTTP fallback
deps-analyzer ./project --no-npm --use-http
# Comprehensive analysis with custom period
deps-analyzer ./microservices ./shared-libs --months 36 --output enterprise-deps
The tool applies filtering in a specific order to ensure predictable results:
--scope): First, filter dependencies by scope (internal, external, all)--internal-libs): Classify remaining dependencies as internal/external--ignore-filter): Override specific version type filteringThe tool implements selective filtering that treats internal and external dependencies differently:
--internal-libs--scope=internal: Analyze only dependencies matching --internal-libs patterns--scope=external: Analyze only dependencies NOT matching --internal-libs patterns--scope=all: Analyze all dependencies (default), but still apply selective filtering logicThe --internal-libs flag supports wildcard patterns:
# Exact match
deps-analyzer ./project --internal-libs "my-package"
# Scoped packages with wildcard
deps-analyzer ./project --internal-libs "@company/*"
# Multiple patterns
deps-analyzer ./project --internal-libs "@company/*,design-system*,@internal/*"
Use --ignore-filter to skip specific version type filtering:
# Include alpha versions for ALL dependencies
deps-analyzer ./project --ignore-filter alpha
# Include multiple pre-release types
deps-analyzer ./project --ignore-filter alpha,beta,rc
# Combined usage: include alpha/beta for internal libs only
deps-analyzer ./project --internal-libs "@company/*" --ignore-filter canary,nightly
# Analyze with company-specific internal libraries
deps-analyzer ./packages/* \
--internal-libs "@acme/*,design-tokens*" \
--ignore-filter canary \
--output enterprise-analysis
# Allow alpha/beta for internal libs, strict filtering for external
deps-analyzer ./apps/frontend ./apps/backend \
--internal-libs "@company/*,internal-*" \
--output mixed-dependencies
# Skip all pre-release filtering for specific analysis
deps-analyzer ./legacy-projects \
--ignore-filter alpha,beta,rc,canary,experimental \
--output legacy-comprehensive
The tool provides two different types of drift/pulse calculations that serve different purposes:
react appears in 4 projects, its drift is counted only oncereact appears in 4 projects, its drift is counted 4 timesScenario:
react with 2 years of driftlodash with 1 year of driftGlobal Drift (Unique Dependencies):
react: 2 years (counted once)lodash: 1 year (counted once)Project Drift (Sum Across Projects):
react (2y) + lodash (1y) = 3yreact (2y) + lodash (1y) = 3yreact (2y) + lodash (1y) = 3yreact (2y) + lodash (1y) = 3y| Scenario | Use Global Metrics | Use Project Metrics |
|---|---|---|
| Prioritizing which deps to update | ✅ Focus on unique deps | ❌ May mislead priorities |
| Estimating update effort/time | ❌ Underestimates work | ✅ Shows true scope |
| Executive reporting | ✅ Clear strategic view | ❌ May seem inflated |
| Sprint planning | ❌ Doesn't show full work | ✅ Shows actual tasks |
| Ecosystem health assessment | ✅ True portfolio state | ❌ Duplicated concerns |
The tool performs intelligent semver analysis:
Automatically filters out:
-dev, -nightly)-alpha, -beta)-rc)-experimental, -canary)0.0.0-*)The tool detects version backports/downgrades:
node_modules/, public/, dist/, build/ directoriesdeps-analyzer/
├── package.json
├── README.md
├── bin/
│ └── deps-analyzer.js # CLI entry point
├── lib/
│ ├── index.js # Core logic & discovery
│ ├── npm-client.js # NPM registry client
│ ├── libyear.js # Drift/pulse calculations
│ └── reporter.js # Report generation
└── utils/ # Utility functions
├── chunkArray.js # Array chunking
├── cleanVersion.js # Version cleaning
├── filterDependenciesByScope.js # Dependency filtering
├── findMaxAllowedVersion.js # Version constraint parsing
├── findWorkspaceRoot.js # Workspace detection
├── isInternalLib.js # Internal library matching
├── parsePnpmLock.js # PNPM lock file parsing
├── parseYarnLock.js # Yarn lock file parsing
└── versionSatisfiesConstraint.js # Semver constraint checking
npm run start # Run with default args
npm run test # Test with templates
npm run dev # Run with debugging
npm run link # Link globally
npm run unlink # Unlink globally
# Enable detailed error information
DEBUG=1 deps-analyzer ./templates
# Use HTTP instead of npm CLI if issues
deps-analyzer ./templates --use-http
npm CLI not found
# Use HTTP fallback
deps-analyzer ./templates --use-http
Permission errors
# Check npm permissions
npm config get prefix
npm config get cache
Network timeouts
# Increase npm timeout
npm config set timeout 60000
deps-analyzer ./templates
Memory issues with large projects
# Analyze projects separately
deps-analyzer ./project1 --output report1
deps-analyzer ./project2 --output report2
--no-npm for quick dependency discoveryMIT
git checkout -b feature/amazing-feature)git commit -m 'Add some amazing feature')git push origin feature/amazing-feature)Built with ❤️ for better dependency management and DevOps insights
FAQs
CLI tool to analyze dependency evolution and release frequency
We found that @boilerbuilder/deps-analyzer demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
/Security News
Impostor NuGet package Tracer.Fody.NLog typosquats Tracer.Fody and its author, using homoglyph tricks, and exfiltrates Stratis wallet JSON/passwords to a Russian IP address.
Security News
Deno 2.6 introduces deno audit with a new --socket flag that plugs directly into Socket to bring supply chain security checks into the Deno CLI.
Security News
New DoS and source code exposure bugs in React Server Components and Next.js: what’s affected and how to update safely.