Syft is a production-grade CLI tool and Go library for generating Software Bills of Materials (SBOMs) from container images, filesystems, directories, and OCI artifacts. It detects and catalogs packages across 40+ ecosystems (Alpine, Debian, RPM, Python, Java, Go, Ruby, Rust, JavaScript, .NET, etc.) by parsing lockfiles, package databases, binary metadata, and source manifests. The tool outputs SBOMs in multiple formats including CycloneDX (JSON/XML), SPDX (JSON/tag-value), Syft JSON, and GitHub Dependency Snapshots, with version-aware encoding and decoding. Architecturally, Syft uses a modular cataloger system where each ecosystem implements a `generic.Cataloger` with parser functions registered by file globs or MIME types. A task-based pipeline orchestrates file indexing, package cataloging, dependency resolution, and relationship linking. The system supports both library integration via `syft.CreateSBOM()` and a CLI with cobra commands (`scan`, `attest`, `convert`, `cataloger`). A bubbletea-based TUI provides real-time progress feedback during image pulls and cataloging. External dependencies include `stereoscope` for container image access, `cosign` for attestation signing, and `go-partybus` for event-driven UI. Key entry points include `cmd/syft/main.go` (CLI), `syft/create_sbom.go` (library API), `syft/get_source.go` (source resolution), and the format encoders/decoders in `syft/format/`. The codebase demonstrates strong engineering practices: extensive test coverage (unit, integration, snapshot), CI/CD with GitHub Actions, auto-generated JSON schemas, and drift-check scripts for capabilities and schema. Notable reusable components include the generic cataloger framework, the dependency resolver, and the file resolver abstraction.
Deps.rs is a production web service that analyzes Rust project dependencies to detect outdated or insecure versions. It fetches Cargo.toml manifests from source repositories (GitHub, GitLab, Bitbucket, SourceHut, Codeberg, Gitea) or crates.io, crawls workspace members and internal dependencies, then compares declared version requirements against the latest crates.io releases while checking every release against the RustSec Advisory Database. Results are rendered as an HTML page with per-dependency status tables and as configurable SVG badges (flat, flat-square, for-the-badge) for README integration, plus a shields.io-compatible JSON endpoint. Built as a single-binary monolithic web server using Actix-web, Tokio, and Reqwest, the application maintains its own cached crates.io Git index with smart recovery strategies (slotmap expansion, full reclone) and uses an LRU cache with TTL for query responses. The codebase follows modern Rust idioms (async/await, edition 2024, comprehensive testing) and is well-organized into separable modules: an engine with finite-state machines for manifest crawling and dependency analysis, a badge rendering library (standalone workspace member), and a parser for Cargo.toml with support for target-specific and renamed dependencies.
e18e/cli is a command-line tool that analyzes JavaScript and TypeScript projects for packaging issues, dependency health, and opportunities to replace dependencies with lighter or native alternatives. It runs multiple checks: publint for publishing best practices, dependency replacement suggestions from curated manifests (native, preferred, micro-utilities), core-js polyfill analysis against declared engine ranges, duplicate dependency detection, and web feature codemod suggestions. The CLI also includes a `migrate` subcommand that can automatically apply codemods to rewrite imports for selected replacements. The architecture is plugin-based: each analysis is a self-contained `ReportPlugin` that receives an `AnalysisContext` and returns messages and stats, aggregated by a `runPlugins` orchestrator. The tool uses an abstract `FileSystem` interface with a `LocalFileSystem` implementation, making it extensible for custom environments. Output is either an interactive TUI via @clack/prompts or JSON. This is a pre-1.0 project, actively developed with good code quality and comprehensive tests.