Karsten Schmidt<p>My appeal to purveyors of large portals providing "Open Source Insights": Please, please update/fix your analysis logic (or provide config support) to support monorepos! At the very least refrain from actively spreading misinformation and by doing so negatively impacting/hurting package selection/uptake/usage decisions! Please consider the downstream effects on indy open source developers!</p><p>Latest case: Google's <a href="https://deps.dev" rel="nofollow noopener noreferrer" translate="no" target="_blank"><span class="invisible">https://</span><span class="">deps.dev</span><span class="invisible"></span></a> (to which I just emailed the below), but numerous other similar "analysis" portals exist, most of them not supporting/considering monorepo setups either and therefore ending up mistreating/misjudging not just a single project, but ALL (in my case ~200) other projects in such repos! All being punished by negative scoring caused by analysis errors!</p><p>"[...]your service is producing factually wrong metadata for projects hosted in large Google-style multi-project monorepos. For example, my monorepo (<a href="https://thi.ng/umbrella" rel="nofollow noopener noreferrer" translate="no" target="_blank"><span class="invisible">https://</span><span class="">thi.ng/umbrella</span><span class="invisible"></span></a>) is home to ~200 TypeScript projects/packages, all of which are distributed as independent offerings. Yet, your analysis logic does not consider such monorepo setups at all and wrongly causes a severe negative impact on the scoring of *all* of projects developed & hosted in such a manner. This is simply unacceptable and is actively hurting (not just my own) efforts of maintaining a large number of open source projects for a long time...</p><p>Random package from that monorepo (but again, the very same issues are reported for ALL packages in the repo):<br><a href="https://deps.dev/npm/%40thi.ng%2Ftransducers" rel="nofollow noopener noreferrer" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">deps.dev/npm/%40thi.ng%2Ftrans</span><span class="invisible">ducers</span></a></p><p>Issue #1: Vulnerabilities</p><p>Your analysis claims there're 7 existing vulnerabilities (listed below), but again NONE of them applies to the package in question and only 2 of them actually ever related to other packages in this repo. Both have been fixed months/years ago, within a few days of reporting:</p><p>- GHSA-rj44-gpjc-29r7 (only applied to thi.ng/egf, fixed 2021-03-27)<br>- GHSA-8ppr-www8-hfjx (only applied to thi.ng/paths, fixed 2024-01-30)<br>- GHSA-pxg6-pf52-xh8x (UNRELATED to any package in this repo)<br>- GHSA-78xj-cgh5-2h22 (UNRELATED)<br>- GHSA-2p57-rm9w-gvfp (UNRELATED)<br>- GHSA-gcx4-mw62-g8wm (UNRELATED)<br>- GHSA-f5x3-32g6-xq36 (UNRELATED)</p><p>Issue #2: Binary assets</p><p>Here your analysis WRONGLY states this package contains two binary artifacts, however the files listed are _test assets_ for a completely different package (<a href="https://deps.dev/npm/%40thi.ng%2Fwasm-api" rel="nofollow noopener noreferrer" translate="no" target="_blank"><span class="invisible">https://</span><span class="ellipsis">deps.dev/npm/%40thi.ng%2Fwasm-</span><span class="invisible">api</span></a>), and even for this other package, these test binaries are NOT distributed as part of the package (they're merely present in the repo only). This is completely misleading!"</p><p>cc/ <span class="h-card" translate="no"><a href="https://hachyderm.io/@robpike" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@<span>robpike</span></a></span> (who I remeber mentioned to have helped with this)</p><p><a href="https://mastodon.thi.ng/tags/OpenSource" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>OpenSource</span></a> <a href="https://mastodon.thi.ng/tags/SupplyChain" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>SupplyChain</span></a> <a href="https://mastodon.thi.ng/tags/Monorepo" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>Monorepo</span></a> <a href="https://mastodon.thi.ng/tags/Analysis" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>Analysis</span></a> <a href="https://mastodon.thi.ng/tags/ThingUmbrella" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>ThingUmbrella</span></a></p>