Add DepTend - #3270
Open
SpIob wants to merge 1 commit into
Open
Conversation
Added DepTend to the list of code analysis tools.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Added DepTend to the list of code analysis tools.
Project
DepTend
Checklist
Add project-name- [project-name](url) - Description ending with period.Why This Project Is Awesome
Which criterion does it meet? (pick one)
Explain:
DepTend just launched, so I want to be upfront that it doesn't have traction numbers to point to yet. What it does have: it takes a repo's dependencies, checks them against OSV, and turns the result into a ranked, fully explainable list of maintenance work, not just a severity number. Every score shows its source advisory and its scoring inputs one click away, and confidence is flagged honestly rather than hidden when an input is missing. It runs entirely on free-tier infrastructure with no account needed to browse. If "hidden gem" doesn't fit a brand-new project by your standards, I understand if this gets held for more history first, happy to resubmit once there's real usage to show.
How It Differs
The closest existing entries in Code Analysis (
code2flow,prospector,repowise,vulture) all analyze a codebase's structure or dead code. None of them score dependencies for known vulnerabilities or rank what to fix first. DepTend is also cross-ecosystem (npm, PyPI, Go) from one scoring method, and its public rescue board lets someone who isn't the maintainer claim a specific fix, closer to a bounty board than a private alert inbox.