Finding Relationships Between Ruby’s Top 100 Packages and Their Dependencies - Shopify

This post details an investigation into the dependency relationships between high-download Ruby packages (gems) and lower-download packages. The author explored direct dependencies using the RubyGems API and then all transitive dependencies using Bundler. The findings revealed that some high-download gems depend on lower-download gems, creating potential security loopholes. The post also describes the creation of dependency graphs using the 'graph' gem and a custom depth-first search algorithm to visualize these relationships and identify all paths from big gems to small gems.