Dependencies Static Analysis and The Grid
summary
Builds a pipeline that walks the global NPM dependency graph, downloads tarballs, generates ASTs and runs static analysis so answers that were minutes or hours now finish quickly. Uses esprima or recast to parse code, a generic worker module to fetch and run analysis, and massive parallelism (spin up a hundred machines). Detects Shellshock-style env usage in child_process.exec, flags unsafe updates, and cuts tens of minutes to tens of seconds (Winston previously took about an hour).
AI-written summary · about
chapters (9)
- 0:00Dependencies static analysis
- 1:15Academic research
- 3:01Dependency graphs in NPM
- 4:28Package.json to graph
- 5:33Graph questions from metadata
- 6:58Static analysis insights
- 8:29Fast analysis with pipelines
- 9:14Parallelizing analysis
- 10:39Future questions
related talks
18mDecisions, Open Source, Graph Theory, and Static Analysis
21mIA para videojuegos con JS
42mThe Good, the Bad and NPX
25mMetro: Scaling JavaScript Build Systems
36mThe Eternal Sunshine of the Zero Build Pipeline
40mRefactoring large JavaScript codebases
45mBundler Bonanza
44mJavaScript AST programming: Introduction and beyond