Bundlephobia is a production web application that analyzes the bundle-size cost of npm packages by performing real builds with a bundler. It exposes a public REST API (endpoints for size, exports, history, trends, similar packages) and a rich Next.js frontend with interactive visualizations (treemaps, trends charts, export analysis). The architecture is microservice-oriented: a main Koa/Next.js server orchestrates requests, a Fastify build-service executes package builds with timeout and profiling, a cache-service backed by Firebase and LRU memory stores results, and an installation-service deduplicates npm installs with lease-based concurrency control. The system also includes a separate Kotlin/Gradle sub-project for JVM package analysis (Maven, Android AAR/JAR) and a curated similar-packages catalog maintained via automated AI research workflows. External dependencies include npm registry, GitHub API, Algolia, Contentful, and Amplitude analytics. Key design patterns include a language-agnostic analysis gateway with adapter registration, a middleware pipeline for request processing (caching, rate-limiting, error handling), typed service contracts using Zod schemas, and a queue service with priority and cancellation. The codebase demonstrates strong engineering practices with extensive unit and e2e tests, custom Oxlint lint rules enforcing internal TypeScript standards, and CI/CD automation for package recommendation updates and JVM releases. While primarily an application, the repository also contains data-research elements: a curated similar-packages catalog with weighted tags, trends analysis merging npm downloads and GitHub stars, and automated library research scripts that propose catalog updates. These are integrated into the application's recommendation features.
Athens is an open-source, enterprise-ready Go module proxy server that implements the Go Modules download protocol. It caches and serves Go modules from upstream sources, providing a private, reliable, and fast proxy for module downloads. The system is a monolithic HTTP server built in Go, with a modular architecture that supports multiple storage backends (disk, GCP, Azure Blob, S3, Minio, MongoDB, in-memory, external HTTP) and distributed locking mechanisms (etcd, Redis, GCS, Azure Blob) for concurrent stash operations. It includes middleware for request ID, structured logging, authentication, filter rules, validation webhooks, and OpenTelemetry tracing. The proxy is configured via environment variables and TOML files, and it provides health and readiness endpoints, as well as an integrity verification sweep against the Go checksum database. Key features include a pluggable storage interface with a compliance test suite, a flexible download mode system (sync, redirect, async, none) with HCL-based per-module rules, and a distributed singleflight pattern to deduplicate concurrent module fetches across nodes. The codebase is well-structured with clear separation of concerns, though it has a large dependency surface and some legacy cloud SDK versions. The project is actively maintained with CI/CD pipelines, Docker images, and a Helm chart. It is designed for production deployments in cloud and on-premises environments.
This is an ESLint plugin that provides a single rule, `ban-dependencies`, which flags usage of npm packages that have better alternatives or are redundant. It uses presets (e.g., native, microutilities, preferred) from the `module-replacements` package to suggest replacements. The plugin also supports user-defined module bans and allowlists, and can lint `package.json` files to detect banned dependencies. The codebase is written in TypeScript, well-tested, and follows modern ESLint plugin conventions. The repository appears to be superseded by `@e18e/eslint-plugin` as noted in the README, and is likely no longer actively developed.
Dependency Guard is a Gradle plugin that monitors and protects against unintentional dependency changes in JVM-based projects. It creates baseline files of project dependencies for specified configurations and compares current dependencies against these baselines during build execution. When unintended changes are detected, it fails the build and provides a clear diff of what changed, allowing developers to either re-baseline for intentional changes or investigate problematic dependency drift. The plugin supports both simple list format and hierarchical tree format for dependency reporting, with the list format being recommended for CI usage due to less noise. It integrates with Gradle's lifecycle by automatically attaching to the 'check' task and provides clear commands for creating and updating baselines.