
Security News
Lovable’s OJ Rewrites Vite’s Dev Server in Rust as AI Lowers the Cost of Forking Open Source
Lovable’s OJ rewrites Vite’s dev server in Rust, reducing memory use and preview times as AI lowers the cost of open source reimplementation.
@deplens/core
Advanced tools
Programmatic API for inspecting installed packages: runtime exports, parsed type signatures, and JSDoc.
npm i @deplens/core
import { runInspect, runDiff } from '@deplens/core';
const output = await runInspect({
target: 'ai',
showTypes: true,
filter: 'generate',
resolveFrom: process.cwd(),
});
console.log(output);
const diff = await runDiff({
package: 'express',
from: '4.18.0',
to: '4.19.0',
format: 'json',
});
console.log(diff.output);
runInspect returns a string when no custom writers are provided. If you pass write or writeError, it will stream to those instead.
target (string, required): package name or import path (e.g. react, next/server)filter (string): substring filter for export namesshowTypes (boolean): include type signatures from .d.tskind (string[]): filter by export kind (function, class, object, constant)runtime (boolean): import the package entrypoint for runtime exports; set false for static type/package inspectionanalyzeSource (boolean): include source complexity and implementation summariesdepth (number): object inspection depth (0–5)resolveFrom (string): base directory for module resolutioncwd (string): working directory for the inspectionwrite (function): output sink (defaults to collecting and returning a string)writeError (function): error output sinkJSDoc options:
jsdoc (string): off | compact | fulljsdocOutput (string): off | section | inline | onlyjsdocQuery (object):
symbols: string or string[]sections: summary | params | returns | tagstags.include / tags.exclude: string[]mode: compact | fullmaxLen: numbertruncate: none | sentence | wordExample: JSDoc focused on params/returns
await runInspect({
target: 'ai',
showTypes: true,
jsdocOutput: 'section',
jsdocQuery: {
symbols: 'generateText',
sections: ['params', 'returns'],
tags: { include: ['param', 'returns'] },
mode: 'compact',
truncate: 'sentence',
maxLen: 220,
},
});
.d.ts declarations, not runtime JS.--resolve-from is essential in monorepos to avoid false negatives.MIT
FAQs
Core engine for inspecting installed package exports and types
The npm package @deplens/core receives a total of 18 weekly downloads. As such, @deplens/core popularity was classified as not popular.
We found that @deplens/core demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
Lovable’s OJ rewrites Vite’s dev server in Rust, reducing memory use and preview times as AI lowers the cost of open source reimplementation.

Security News
It has been one year since Shai-Hulud made its first appearance on npm.

Research
/Security News
Operators behind PolinRider used a compromised GitHub account to plant malware in four development versions of a Packagist package with 700,000+ downloads.