Ruby Dependency Security and Analysis
Finding Relationships Between Ruby’s Top 100 Packages and Their Dependencies - Shopify

Finding Relationships Between Ruby’s Top 100 Packages and Their Dependencies - Shopify

10/19/2022

What this post added

This post details an investigation into the dependency relationships between large (>= 180M downloads) and small (< 180M downloads) RubyGems. It describes methods used to identify these relationships, including direct dependency checks via the RubyGems API and sub-dependency analysis using Bundler. The post also covers the creation of visualizations using the 'graph' gem and a custom graph data type to illustrate these dependencies and identify paths from large to small gems. The findings highlight reasons for small dependencies on large packages, such as newer gems or gems shipped with Ruby.

Read the original post ↗