3.9

Adjusted Signal

3.9

Raw Pattern Score

100%

Time Factor

2026-10-30

Last Push

5.8K

Stars

Ruby

Language

597.1K

Lines of Code

2.5K

Files

1.7K

Pattern Hits

2026-10-31

Scan Date

0.02

HC Hit Rate

Risk Review · Payload v1

Use each vector to guide manual verification of the underlying findings.

Payload schema: 1.0.0 · Engine: 2.0.0 · Scoring: heuristic-density-v1 · Scan date: 2026-10-31.

Cognitive Ownership Risk 15.2/100 · LOW

Can maintainers explain intent, assumptions, and trade-offs? 1596 finding(s).

Hallucinated Dependency & Supply Chain Risk 0.2/100 · LOW

Are imports declared and package/API names verified? 13 finding(s).

Agent Over-Engineering Ratio 11.9/100 · LOW

Are wrappers, guards, and repeated structures necessary? 1254 finding(s).

PR Review Velocity Impact 16.9/100 · LOW

Which changes need focused human review? 1680 finding(s).

What These Metrics Mean

Adjusted Signal: Legacy pattern score normalized per 1,000 scanned lines and multiplied by the repository-level time factor. It is not an estimate of AI authorship.
Raw Pattern Score: Sum of severity- and context-weighted pattern findings before applying the time factor.
Time Factor: A coarse multiplier based on repository last-push metadata. It does not identify when individual code was written.
Pattern Hits: Count of configured pattern findings. Review each location and surrounding code before acting.
HC Hit Rate: High- and critical-severity findings per scanned file. Severity is a configured detector weight, not proof of a vulnerability or authorship.
Lines / Files: Scan coverage denominators used by the legacy normalized score.

Pattern-Signal History

This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.

Severity Breakdown

Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.

CRITICAL 1HIGH 42MEDIUM 152LOW 1485

Directory Score Breakdown

This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.

Pattern Findings

The scanner identified 1680 distinct pattern matches across 18 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.

Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.

Hyper-Verbose Identifiers1181 hits · 1202 pts

Severity	File	Line	Snippet	Context
LOW	…toolchain/lib/dependabot/rust_toolchain/file_parser.rb	89	def parse_plaintext_toolchain(content) = content.strip	CODE
LOW	…rust_toolchain/update_checker/latest_version_finder.rb	33	def apply_post_fetch_latest_versions_filter(releases)	CODE
LOW	…rust_toolchain/update_checker/latest_version_finder.rb	42	def apply_post_fetch_lowest_security_fix_versions_filter(releases)	CODE
LOW	terraform/lib/dependabot/terraform/file_fetcher.rb	107	def terraform_file_local_module_details(file)	CODE
LOW	…aform/lib/dependabot/terraform/requirements_updater.rb	117	def update_registry_requirement(req)	CODE
LOW	terraform/lib/dependabot/terraform/file_updater.rb	84	def updated_terraform_file_content(file)	CODE
LOW	terraform/lib/dependabot/terraform/file_updater.rb	142	def update_registry_declaration(new_req, old_req, updated_content)	CODE
LOW	terraform/lib/dependabot/terraform/file_updater.rb	276	def update_lockfile_declaration(updated_manifest_files) # rubocop:disable Metrics/AbcSize, Metrics/MethodLength, M	CODE
LOW	terraform/lib/dependabot/terraform/file_updater.rb	391	def provider_declaration_regex(updated_content)	CODE
LOW	terraform/lib/dependabot/terraform/file_updater.rb	445	def lockfile_declaration_regex(provider_source)	CODE
LOW	terraform/lib/dependabot/terraform/file_updater.rb	486	def handle_helper_subprocess_failed_error(error)	CODE
LOW	terraform/lib/dependabot/terraform/file_parser.rb	128	def build_terraform_dependency(file, name, source, details)	CODE
LOW	terraform/lib/dependabot/terraform/file_parser.rb	164	def build_provider_dependency(file, name, details = {})	CODE
LOW	terraform/lib/dependabot/terraform/file_parser.rb	190	def deprecated_provider_error(file)	CODE
LOW	terraform/lib/dependabot/terraform/file_parser.rb	207	def build_terragrunt_dependency(file, source)	CODE
LOW	terraform/lib/dependabot/terraform/file_parser.rb	262	def registry_source_details_from(source_string)	CODE
LOW	…/terraform/file_updater/provider_cli_config_builder.rb	107	def normalize_provider_source(source_address, name)	CODE
LOW	…/terraform/file_updater/provider_cli_config_builder.rb	137	def generate_provider_dev_overrides_config(provider_sources)	CODE
LOW	…ot/terraform/update_checker/latest_version_resolver.rb	40	def filter_versions_in_cooldown_period_from_provider(versions)	CODE
LOW	…ot/terraform/update_checker/latest_version_resolver.rb	66	def filter_versions_in_cooldown_period_from_module(versions)	CODE
LOW	…rn/spec/dependabot/npm_and_yarn/update_checker_spec.rb	16	def build_vulnerability_audit(attributes)	CODE
LOW	…rn/spec/dependabot/npm_and_yarn/update_checker_spec.rb	1518	def contain_exactly_including_metadata(*expected)	CODE
LOW	npm_and_yarn/lib/dependabot/npm_and_yarn/helpers.rb	58	def register_npm_version_selector(directory, version)	CODE
LOW	npm_and_yarn/lib/dependabot/npm_and_yarn/helpers.rb	68	def activate_npm_version_selector(files)	CODE
LOW	…m_and_yarn/lib/dependabot/npm_and_yarn/file_fetcher.rb	571	def path_dependency_details_from_manifest(file)	CODE
LOW	…m_and_yarn/lib/dependabot/npm_and_yarn/file_fetcher.rb	623	def path_dependency_details_from_npm_lockfile(parsed_lockfile)	CODE
LOW	…m_and_yarn/lib/dependabot/npm_and_yarn/file_fetcher.rb	635	def convert_dependency_path_to_name(path, value)	CODE
LOW	…m_and_yarn/lib/dependabot/npm_and_yarn/file_fetcher.rb	670	def fetch_lerna_packages_from_path(path)	CODE
LOW	…m_and_yarn/lib/dependabot/npm_and_yarn/file_fetcher.rb	726	def recursive_find_directories(glob, prefix = "")	CODE
LOW	…m_and_yarn/lib/dependabot/npm_and_yarn/file_fetcher.rb	745	def fetch_package_json_if_present(workspace)	CODE
LOW	…m_and_yarn/lib/dependabot/npm_and_yarn/file_fetcher.rb	884	def fetch_file_from_parent_directories(filename)	CODE
LOW	…nd_yarn/lib/dependabot/npm_and_yarn/metadata_finder.rb	116	def install_scripts_for_version(version)	CODE
LOW	…and_yarn/lib/dependabot/npm_and_yarn/update_checker.rb	172	def latest_resolvable_previous_version(updated_version)	CODE
LOW	…and_yarn/lib/dependabot/npm_and_yarn/update_checker.rb	722	def log_pnpm_cooldown_overrides(existing, minutes, days)	CODE
LOW	…and_yarn/lib/dependabot/npm_and_yarn/update_checker.rb	744	def log_npmrc_cooldown_conflicts(existing, npmrc_days)	CODE
LOW	…m_and_yarn/lib/dependabot/npm_and_yarn/file_updater.rb	434	def updated_yarn_lock_content(yarn_lock)	CODE
LOW	…m_and_yarn/lib/dependabot/npm_and_yarn/file_updater.rb	441	def updated_pnpm_lock_content(pnpm_lock)	CODE
LOW	…m_and_yarn/lib/dependabot/npm_and_yarn/file_updater.rb	579	def workspace_package_json_updates(file)	CODE
LOW	…m_and_yarn/lib/dependabot/npm_and_yarn/file_updater.rb	584	def updated_package_json_content(file)	CODE
LOW	…m_and_yarn/lib/dependabot/npm_and_yarn/file_updater.rb	597	def updated_pnpm_workspace_content(file)	CODE
LOW	npm_and_yarn/lib/dependabot/npm_and_yarn/file_parser.rb	430	def parse_alias_package_requirement(requirement)	CODE
LOW	npm_and_yarn/lib/dependabot/npm_and_yarn/file_parser.rb	454	def extract_real_name_from_alias_key(name)	CODE
LOW	npm_and_yarn/lib/dependabot/npm_and_yarn/file_parser.rb	532	def version_from_git_revision(requirement, git_revision)	CODE
LOW	…nd_yarn/lib/dependabot/npm_and_yarn/package_manager.rb	192	def find_engine_constraints_as_requirement(name)	CODE
LOW	…nd_yarn/lib/dependabot/npm_and_yarn/package_manager.rb	452	def runnable_package_manager_name(name)	CODE
LOW	…nd_yarn/lib/dependabot/npm_and_yarn/package_manager.rb	464	def reset_npm_version_selector(name)	CODE
LOW	…nd_yarn/lib/dependabot/npm_and_yarn/package_manager.rb	494	def recover_from_failed_install(name, version)	CODE
LOW	…nd_yarn/lib/dependabot/npm_and_yarn/package_manager.rb	529	def ensure_valid_package_manager(name)	CODE
LOW	…nd_yarn/lib/dependabot/npm_and_yarn/package_manager.rb	573	def shrinkwrap_compatible_version(name, version)	CODE
LOW	npm_and_yarn/lib/dependabot/npm_and_yarn/requirement.rb	124	def convert_js_constraint_to_ruby_constraint(req_string)	CODE
LOW	…nd_yarn/lib/dependabot/npm_and_yarn/registry_helper.rb	259	def parse_npm_from_npm_or_yarn_rc(file, separator = "=")	CODE
LOW	…nd_yarn/lib/dependabot/npm_and_yarn/registry_helper.rb	271	def parse_registry_from_npmrc_yarnrc(file, separator = "=", scope = nil)	CODE
LOW⚡	…nd_yarn/lib/dependabot/npm_and_yarn/registry_helper.rb	309	def parse_npm_from_yarnrc_yml(file)	CODE
LOW	…yarn/lib/dependabot/npm_and_yarn/dependency_grapher.rb	170	def inject_ephemeral_lockfile(ephemeral_lockfile)	CODE
LOW	…/npm_and_yarn/dependency_grapher/lockfile_generator.rb	259	def extract_network_error_host(message)	CODE
LOW	…t/npm_and_yarn/file_fetcher/path_dependency_builder.rb	124	def replace_yarn_lockfile_paths(dependencies_hash)	CODE
LOW	…bot/npm_and_yarn/file_updater/yarn_lockfile_updater.rb	65	def updated_yarn_lock_content(yarn_lock)	CODE
LOW	…bot/npm_and_yarn/file_updater/yarn_lockfile_updater.rb	228	def run_yarn_berry_top_level_updater(top_level_dependency_updates:, yarn_lock:)	CODE
LOW	…bot/npm_and_yarn/file_updater/yarn_lockfile_updater.rb	276	def pin_berry_versions_if_needed(top_level_dependency_updates, yarn_lock)	CODE
LOW	…bot/npm_and_yarn/file_updater/yarn_lockfile_updater.rb	292	def pin_berry_version_if_needed(dep, yarn_lock, parsed_lockfile)	CODE
1121 more matches not shown…

Self-Referential Comments114 hits · 334 pts

Severity	File	Line	Snippet	Context
MEDIUM	…npm_and_yarn/file_updater/npm_lockfile_updater_spec.rb	1341	# Create an updater with the correct optional dependency	COMMENT
MEDIUM	…npm_and_yarn/file_updater/npm_lockfile_updater_spec.rb	1780	# Create a simple updater instance to test the private method	COMMENT
MEDIUM	…nd_yarn/lib/dependabot/npm_and_yarn/package_manager.rb	59	# Define a type alias for the expected class interface	COMMENT
MEDIUM⚡	…t/npm_and_yarn/update_checker/latest_version_finder.rb	103	# This method is for latest_version_from_registry	COMMENT
MEDIUM	…pec/dependabot/python/pip_compile_file_matcher_spec.rb	50	# This file is autogenerated by pip-compile	COMMENT
MEDIUM	…thon/spec/dependabot/python/dependency_grapher_spec.rb	44	# This file is autogenerated by pip-compile	COMMENT
MEDIUM	…thon/spec/dependabot/python/dependency_grapher_spec.rb	508	# This file is autogenerated by pip-compile	COMMENT
MEDIUM	…thon/spec/dependabot/python/dependency_grapher_spec.rb	987	# This file is autogenerated by pip-compile	COMMENT
MEDIUM	…thon/spec/dependabot/python/dependency_grapher_spec.rb	1007	# This file is autogenerated by pip-compile	COMMENT
MEDIUM	…thon/spec/dependabot/python/dependency_grapher_spec.rb	1027	# This file is autogenerated by pip-compile	COMMENT
MEDIUM	…t/python/file_updater/pip_compile_file_updater_spec.rb	596	# This file is autogenerated by pip-compile	COMMENT
MEDIUM	…t/python/file_updater/pip_compile_file_updater_spec.rb	606	# This file is autogenerated by pip-compile	COMMENT
MEDIUM	…t/python/file_updater/pip_compile_file_updater_spec.rb	626	# This file is autogenerated by pip-compile	COMMENT
MEDIUM	…t/python/file_updater/pip_compile_file_updater_spec.rb	636	# This file is autogenerated by pip-compile	COMMENT
MEDIUM	…t/python/file_updater/pip_compile_file_updater_spec.rb	656	# This file is autogenerated by pip-compile	COMMENT
MEDIUM	…t/python/file_updater/pip_compile_file_updater_spec.rb	666	# This file is autogenerated by pip-compile	COMMENT
MEDIUM	…t/python/file_updater/pip_compile_file_updater_spec.rb	685	# This file is autogenerated by pip-compile	COMMENT
MEDIUM	…t/python/file_updater/pip_compile_file_updater_spec.rb	695	# This file is autogenerated by pip-compile	COMMENT
MEDIUM	…t/python/file_updater/pip_compile_file_updater_spec.rb	855	# This file is autogenerated by pip-compile	COMMENT
MEDIUM	…t/python/file_updater/pip_compile_file_updater_spec.rb	866	# This file is autogenerated by pip-compile	COMMENT
MEDIUM	…t/python/file_updater/pip_compile_file_updater_spec.rb	904	# This file is autogenerated by pip-compile	COMMENT
MEDIUM	…t/python/file_updater/pip_compile_file_updater_spec.rb	915	# This file is autogenerated by pip-compile	COMMENT
MEDIUM	…t/python/file_updater/pip_compile_file_updater_spec.rb	945	# This file is autogenerated by pip-compile	COMMENT
MEDIUM	…t/python/file_updater/pip_compile_file_updater_spec.rb	975	# This file is autogenerated by pip-compile	COMMENT
MEDIUM	…t/python/file_updater/pip_compile_file_updater_spec.rb	85	expect(updated_files.first.content).to include("# This file is autogen")	CODE
MEDIUM	…t/python/file_updater/pip_compile_file_updater_spec.rb	103	expect(updated_files.first.content).to include("# This file is autogen")	CODE
MEDIUM	…t/python/file_updater/pip_compile_file_updater_spec.rb	130	expect(file.content).to include("# This file is autogen")	CODE
MEDIUM	…t/python/file_updater/pip_compile_file_updater_spec.rb	169	.not_to include("# This file is autogen")	CODE
MEDIUM	…t/python/file_updater/pip_compile_file_updater_spec.rb	182	.to include("# This file is autogen")	CODE
MEDIUM	…t/python/file_updater/pip_compile_file_updater_spec.rb	265	expect(updated_files.first.content).to include("# This file is autogen")	CODE
MEDIUM	…t/python/file_updater/pip_compile_file_updater_spec.rb	350	expect(updated_files.first.content).to include("# This file is autogen")	CODE
MEDIUM	…ndabot/python/file_parser/python_requirement_parser.rb	97	marker = /^# This file is autogenerated by pip-compile with [pP]ython (?<version>\d+.\d+)$/m	CODE
MEDIUM	…/dependabot/python/file_parser/pipfile_files_parser.rb	79	# Create a DependencySet where each element has no requirement. Any	COMMENT
MEDIUM	…ependabot/python/file_parser/pyproject_files_parser.rb	267	# Create a DependencySet where each element has no requirement. Any	COMMENT
MEDIUM	…ependabot/python/file_parser/pyproject_files_parser.rb	372	# Create a hash with type and url from the source definition	COMMENT
MEDIUM	cargo/spec/dependabot/cargo/update_checker_spec.rb	899	# Create a mock VersionResolver instance	COMMENT
MEDIUM	cargo/spec/dependabot/cargo/update_checker_spec.rb	919	# Create a mock VersionResolver instance	COMMENT
MEDIUM	cargo/spec/dependabot/cargo/update_checker_spec.rb	938	# Create a mock VersionResolver instance	COMMENT
MEDIUM	…pendabot/cargo/update_checker/version_resolver_spec.rb	810	# Create a new resolver instance to avoid stubbing the subject	COMMENT
MEDIUM	…pendabot/cargo/update_checker/version_resolver_spec.rb	851	# Create a temporary directory to test file writing	COMMENT
MEDIUM	…ib/dependabot/cargo/update_checker/version_resolver.rb	51	# Initialize instance variables with proper T.let declarations	COMMENT
MEDIUM	…pec/dependabot/maven/shared/shared_requirement_spec.rb	14	# Define a concrete subclass inside the describe block to avoid superclass mismatch	COMMENT
MEDIUM	maven/lib/dependabot/maven/file_updater.rb	241	# Create the dependency element with the required fields, adding the appropriate indentation as text nodes	COMMENT
MEDIUM	…ependabot/maven/file_parser/maven_dependency_parser.rb	40	# Create a directory structure that maintains relative relationships	COMMENT
MEDIUM	…ependabot/maven/file_parser/maven_dependency_parser.rb	120	# Create the base directory structure with the required depth	COMMENT
MEDIUM	…dependabot/composer/update_checker/version_resolver.rb	85	# Initialize instance variables with T.let for strict typing	COMMENT
MEDIUM	updater/spec/support/dummy_pkg_helpers.rb	7	# This module provides some shortcuts for working with our two mock RubyGems packages:	COMMENT
MEDIUM	…ter/spec/dependabot/updater/update_type_helper_spec.rb	9	# Create a test class that includes the module	COMMENT
MEDIUM	…/spec/dependabot/updater/group_update_creation_spec.rb	17	# Create a test class that includes the module to test it	COMMENT
MEDIUM	updater/lib/github_api/dependency_submission.rb	8	# This class provides a data object that can be submitted to a repository's dependency submission	COMMENT
MEDIUM	updater/lib/dependabot/dependency_change_builder.rb	16	# This class is responsible for generating a DependencyChange for a given	COMMENT
MEDIUM	updater/lib/dependabot/update_graph_processor.rb	17	# This class is responsible for iterating the list of directories within a repository that the job specifies	COMMENT
MEDIUM	updater/lib/dependabot/dependency_snapshot.rb	16	# This class is the input for a Dependabot::Updater process with Dependabot::DependencyChange	COMMENT
MEDIUM	updater/lib/dependabot/dependency_group_engine.rb	9	# This class implements our strategy for keeping track of and matching dependency	COMMENT
MEDIUM	updater/lib/dependabot/dependency_change.rb	15	# This class provides methods for presenting the change set which can be used	COMMENT
MEDIUM	updater/lib/dependabot/notices_helpers.rb	30	# Create a deprecation notice if the version manager is deprecated	COMMENT
MEDIUM	updater/lib/dependabot/service.rb	16	# This class provides an output adapter for the Dependabot Service which manages	COMMENT
MEDIUM	updater/lib/dependabot/updater/error_handler.rb	10	# This class is responsible for determining how to present a Dependabot::Error	COMMENT
MEDIUM	updater/lib/dependabot/updater/error_handler.rb	15	# This class is a coarse abstraction of some shared logic that has several flags	COMMENT
MEDIUM	updater/lib/dependabot/updater/error_handler.rb	72	# This method handles errors where there is a dependency in the current	COMMENT
54 more matches not shown…

Cross-File Repetition40 hits · 200 pts

Severity	File	Snippet	Context
HIGH	…etUpdater/NuGetUpdater.Cli.Test/EntryPointTests.Run.cs	<project> <propertygroup> <managepackageversionscentrally>false</managepackageversionscentrally> </propertygroup> </proj	STRING
HIGH	…Updater/NuGetUpdater.Cli.Test/EntryPointTests.Graph.cs	<project> <propertygroup> <managepackageversionscentrally>false</managepackageversionscentrally> </propertygroup> </proj	STRING
HIGH	…etUpdater/NuGetUpdater.Core.Test/TemporaryDirectory.cs	<project> <propertygroup> <managepackageversionscentrally>false</managepackageversionscentrally> </propertygroup> </proj	STRING
HIGH	…uGetUpdater.Core.Test/Discover/DiscoveryWorkerTests.cs	<project> <propertygroup> <managepackageversionscentrally>false</managepackageversionscentrally> </propertygroup> </proj	STRING
HIGH	…ter.Core.Test/Discover/DiscoveryWorkerTests.Project.cs	<project> <propertygroup> <managepackageversionscentrally>false</managepackageversionscentrally> </propertygroup> </proj	STRING
HIGH	…pdater.Core.Test/Run/EndToEndTests.InsecureHttpFeed.cs	<project> <propertygroup> <managepackageversionscentrally>false</managepackageversionscentrally> </propertygroup> </proj	STRING
HIGH	…GetUpdater/NuGetUpdater.Core.Test/Run/EndToEndTests.cs	<project> <propertygroup> <managepackageversionscentrally>false</managepackageversionscentrally> </propertygroup> </proj	STRING
HIGH	…etUpdater/NuGetUpdater.Cli.Test/EntryPointTests.Run.cs	<project sdk="microsoft.net.sdk"> <propertygroup> <targetframework>net8.0</targetframework> </propertygroup> <itemgroup>	STRING
HIGH	…Updater/NuGetUpdater.Cli.Test/EntryPointTests.Graph.cs	<project sdk="microsoft.net.sdk"> <propertygroup> <targetframework>net8.0</targetframework> </propertygroup> <itemgroup>	STRING
HIGH	…uGetUpdater.Core.Test/Discover/DiscoveryWorkerTests.cs	<project sdk="microsoft.net.sdk"> <propertygroup> <targetframework>net8.0</targetframework> </propertygroup> <itemgroup>	STRING
HIGH	…Updater.Core.Test/Discover/SdkProjectDiscoveryTests.cs	<project sdk="microsoft.net.sdk"> <propertygroup> <targetframework>net8.0</targetframework> </propertygroup> <itemgroup>	STRING
HIGH	…GetUpdater/NuGetUpdater.Core.Test/Run/EndToEndTests.cs	<project sdk="microsoft.net.sdk"> <propertygroup> <targetframework>net8.0</targetframework> </propertygroup> <itemgroup>	STRING
HIGH	…ter.Core.Test/Discover/DiscoveryWorkerTests.Project.cs	<project sdk="microsoft.net.sdk"> <propertygroup> <targetframework>net8.0</targetframework> </propertygroup> <itemgroup>	STRING
HIGH	…etUpdater/NuGetUpdater.Cli.Test/EntryPointTests.Run.cs	{ "version": "3.0.0", "resources": [ { "@id": "{{baseurl}}/download", "@type": "packagebaseaddress/3.0.0" }, { "@id": "{	STRING
HIGH	…/NuGetUpdater/NuGetUpdater.Core.Test/TestHttpServer.cs	{ "version": "3.0.0", "resources": [ { "@id": "{{baseurl}}/download", "@type": "packagebaseaddress/3.0.0" }, { "@id": "{	STRING
HIGH	…uGetUpdater.Core.Test/Discover/DiscoveryWorkerTests.cs	{ "version": "3.0.0", "resources": [ { "@id": "{{baseurl}}/download", "@type": "packagebaseaddress/3.0.0" }, { "@id": "{	STRING
HIGH	…Updater.Core.Test/Update/PackagesConfigUpdaterTests.cs	{ "version": "3.0.0", "resources": [ { "@id": "{{baseurl}}/download", "@type": "packagebaseaddress/3.0.0" }, { "@id": "{	STRING
HIGH	…r/NuGetUpdater.Core.Test/Analyze/AnalyzeWorkerTests.cs	{ "version": "3.0.0", "resources": [ { "@id": "{{baseurl}}/download", "@type": "packagebaseaddress/3.0.0" }, { "@id": "{	STRING
HIGH	…r/NuGetUpdater.Core.Test/Analyze/VersionFinderTests.cs	{ "version": "3.0.0", "resources": [ { "@id": "{{baseurl}}/download", "@type": "packagebaseaddress/3.0.0" }, { "@id": "{	STRING
HIGH	…etUpdater/NuGetUpdater.Cli.Test/EntryPointTests.Run.cs	<configuration> <packagesources> <clear /> <add key="private_feed" value="{feedurl}" allowinsecureconnections="true" />	STRING
HIGH	…r/NuGetUpdater.Core.Test/Analyze/AnalyzeWorkerTests.cs	<configuration> <packagesources> <clear /> <add key="private_feed" value="{feedurl}" allowinsecureconnections="true" />	STRING
HIGH	…r/NuGetUpdater.Core.Test/Analyze/VersionFinderTests.cs	<configuration> <packagesources> <clear /> <add key="private_feed" value="{feedurl}" allowinsecureconnections="true" />	STRING
HIGH	…uGetUpdater.Core.Test/Discover/DiscoveryWorkerTests.cs	<project toolsversion="15.0" defaulttargets="build" xmlns="http://schemas.microsoft.com/developer/msbuild/2003"> <import	STRING
HIGH	…Updater.Core.Test/Update/PackagesConfigUpdaterTests.cs	<project toolsversion="15.0" defaulttargets="build" xmlns="http://schemas.microsoft.com/developer/msbuild/2003"> <import	STRING
HIGH	…GetUpdater/NuGetUpdater.Core.Test/Run/EndToEndTests.cs	<project toolsversion="15.0" defaulttargets="build" xmlns="http://schemas.microsoft.com/developer/msbuild/2003"> <import	STRING
HIGH	…uGetUpdater.Core.Test/Discover/DiscoveryWorkerTests.cs	{ "version": 1, "isroot": true, "tools": { "microsoft.botsay": { // some comment "version": "1.1.0", "commands": [ "bots	STRING
HIGH	…dater.Core.Test/Files/DotNetToolsJsonBuildFileTests.cs	{ "version": 1, "isroot": true, "tools": { "microsoft.botsay": { // some comment "version": "1.1.0", "commands": [ "bots	STRING
HIGH	…er/NuGetUpdater.Core.Test/Utilities/JsonHelperTests.cs	{ "version": 1, "isroot": true, "tools": { "microsoft.botsay": { // some comment "version": "1.1.0", "commands": [ "bots	STRING
HIGH	…uGetUpdater.Core.Test/Discover/DiscoveryWorkerTests.cs	<configuration> <packagesources> <clear /> <add key="private_feed" value="{http.baseurl.trimend('/')}/index.json" allowi	STRING
HIGH	…Updater.Core.Test/Update/PackagesConfigUpdaterTests.cs	<configuration> <packagesources> <clear /> <add key="private_feed" value="{http.baseurl.trimend('/')}/index.json" allowi	STRING
HIGH	…r/NuGetUpdater.Core.Test/Analyze/AnalyzeWorkerTests.cs	<configuration> <packagesources> <clear /> <add key="private_feed" value="{http.baseurl.trimend('/')}/index.json" allowi	STRING
HIGH	…uGetUpdater.Core.Test/Discover/DiscoveryWorkerTests.cs	<project sdk="microsoft.net.sdk"> <propertygroup> <targetframework>net9.0</targetframework> </propertygroup> <itemgroup>	STRING
HIGH	…GetUpdater/NuGetUpdater.Core.Test/Run/EndToEndTests.cs	<project sdk="microsoft.net.sdk"> <propertygroup> <targetframework>net9.0</targetframework> </propertygroup> <itemgroup>	STRING
HIGH	…ter.Core.Test/Discover/DiscoveryWorkerTests.Project.cs	<project sdk="microsoft.net.sdk"> <propertygroup> <targetframework>net9.0</targetframework> </propertygroup> <itemgroup>	STRING
HIGH	…ter.Core.Test/Discover/DiscoveryWorkerTests.Project.cs	<project sdk="microsoft.net.sdk"> <propertygroup> <targetframework>net8.0</targetframework> <managepackageversionscentra	STRING
HIGH	…Updater.Core.Test/Discover/SdkProjectDiscoveryTests.cs	<project sdk="microsoft.net.sdk"> <propertygroup> <targetframework>net8.0</targetframework> <managepackageversionscentra	STRING
HIGH	…NuGetUpdater.Core.Test/Utilities/MSBuildHelperTests.cs	<project sdk="microsoft.net.sdk"> <propertygroup> <targetframework>net8.0</targetframework> <managepackageversionscentra	STRING
HIGH	…r/NuGetUpdater.Core.Test/Analyze/AnalyzeWorkerTests.cs	<configuration> <packagesources> <clear /> <add key="test" value="https://example.com/v3/index.json" /> </packagesources	STRING
HIGH	…r/NuGetUpdater.Core.Test/Analyze/VersionFinderTests.cs	<configuration> <packagesources> <clear /> <add key="test" value="https://example.com/v3/index.json" /> </packagesources	STRING
HIGH	…Updater.Core.Test/Analyze/CompatibilityCheckerTests.cs	<configuration> <packagesources> <clear /> <add key="test" value="https://example.com/v3/index.json" /> </packagesources	STRING

Over-Commented Block135 hits · 132 pts

Severity	File	Line	Snippet	Context
LOW	…aform/lib/dependabot/terraform/requirements_updater.rb	21	# A requirements hash is a basic description of a dependency at a certain	COMMENT
LOW	…aform/lib/dependabot/terraform/requirements_updater.rb	41	# requirement: nil,	COMMENT
LOW	terraform/lib/dependabot/terraform/file_updater.rb	61	# Example (for simplicity other parameters are skipped):	COMMENT
LOW	terraform/lib/dependabot/terraform/file_parser.rb	361	# {	COMMENT
LOW	npm_and_yarn/lib/dependabot/npm_and_yarn/helpers.rb	121		COMMENT
LOW	…_yarn/lib/dependabot/npm_and_yarn/constraint_helper.rb	341	# rubocop:disable Metrics/CyclomaticComplexity	COMMENT
LOW	…m_and_yarn/lib/dependabot/npm_and_yarn/file_updater.rb	441	def updated_pnpm_lock_content(pnpm_lock)	COMMENT
LOW	…m_and_yarn/lib/dependabot/npm_and_yarn/file_updater.rb	461	# update or a hung resolver (dependabot/dependabot-core#15937). The gate is	COMMENT
LOW	…nd_yarn/lib/dependabot/npm_and_yarn/registry_helper.rb	61	end	COMMENT
LOW	…yarn/lib/dependabot/npm_and_yarn/pnpm_error_message.rb	1	# typed: strong	COMMENT
LOW	…bot/npm_and_yarn/file_updater/yarn_lockfile_updater.rb	381	# Security updates set it to 0 so a release-age gate never blocks a fix	COMMENT
LOW	…bot/npm_and_yarn/file_updater/yarn_lockfile_updater.rb	521		COMMENT
LOW	…bot/npm_and_yarn/file_updater/pnpm_lockfile_updater.rb	341	fingerprint = "update <dependency_updates> --lockfile-only --no-save -r"	COMMENT
LOW	…bot/npm_and_yarn/file_updater/pnpm_lockfile_updater.rb	541	# configured for regular updates), the dependabot.yml cooldown floor for	COMMENT
LOW	…abot/npm_and_yarn/file_updater/npm_lockfile_updater.rb	441		COMMENT
LOW	…abot/npm_and_yarn/file_updater/npm_lockfile_updater.rb	641	# case where a new version (e.g. @angular-devkit/build-angular) relies	COMMENT
LOW	…m_and_yarn/helpers/lib/npm6/peer-dependency-checker.ts	61	const dryRun = true;	COMMENT
LOW	npm_and_yarn/helpers/lib/yarn/helpers.ts	1	// eslint-disable-next-line @typescript-eslint/no-require-imports	COMMENT
LOW	npm_and_yarn/helpers/lib/yarn/helpers.ts	21	// link, run lifecycle scripts, cleanup, then save new manifest (package.json).	COMMENT
LOW	npm_and_yarn/helpers/lib/yarn/lockfile-parser.ts	61		COMMENT
LOW	deno/lib/dependabot/deno.rb	21	# Deno's import map has no dev/prod distinction (no devDependencies equivalent),	COMMENT
LOW	…pendabot/docker/update_checker_digest_cooldown_spec.rb	1	# typed: false	COMMENT
LOW	docker/lib/dependabot/docker/update_checker.rb	1441	candidate_digests = fetch_platform_digests(candidate_tag.name)	COMMENT
LOW	…/lib/dependabot/nix/package/package_details_fetcher.rb	81	#	COMMENT
LOW	apm/lib/dependabot/apm.rb	21	"apm",	COMMENT
LOW	apm/lib/dependabot/apm/git_commit_checker.rb	1	# typed: strong	COMMENT
LOW	apm/lib/dependabot/apm/git_commit_checker.rb	21	#	COMMENT
LOW	apm/lib/dependabot/apm/git_commit_checker.rb	41	# `max_by { version_from_tag(...) }` would keep whichever the remote	COMMENT
LOW	apm/lib/dependabot/apm/update_checker.rb	121	return super unless sha_pinned?	COMMENT
LOW	apm/lib/dependabot/apm/update_checker.rb	321	consider_version_branches_pinned: false,	COMMENT
LOW	apm/lib/dependabot/apm/file_parser.rb	81		COMMENT
LOW	apm/lib/dependabot/apm/file_parser.rb	121	T.nilable(Dependabot::Ecosystem)	COMMENT
LOW	apm/lib/dependabot/apm/file_parser.rb	261	# Encodes a scalar node's exact source span as	COMMENT
LOW	apm/lib/dependabot/apm/package_specifier.rb	1	# typed: strong	COMMENT
LOW	apm/lib/dependabot/apm/package_specifier.rb	21	# HTTPS and SSH clone URLs both resolve to an `https://host[:port]/owner/repo`	COMMENT
LOW	apm/lib/dependabot/apm/package_specifier.rb	41	# so a URL with segments beyond `owner/repo` on a GitHub-family host	COMMENT
LOW	apm/lib/dependabot/apm/package_specifier.rb	61	ABBREVIATED_SHA_REGEX = /\A[0-9a-f]{7,39}\z/i	COMMENT
LOW	apm/lib/dependabot/apm/package_specifier.rb	181	# Other hosts (e.g. GitLab) allow repositories nested at arbitrary subgroup	COMMENT
LOW	apm/lib/dependabot/apm/package_specifier.rb	221	# `git_url` and `name` keep, but it must not change which family a URL	COMMENT
LOW	apm/lib/dependabot/apm/package_specifier.rb	281	# `github.com` and must stay that way. The implicit `:443` is	COMMENT
LOW	apm/lib/dependabot/apm/package_specifier.rb	341	# identity. Repositories on the manifest's default host -- the configured	COMMENT
LOW	apm/lib/dependabot/apm/package_specifier.rb	361	def name	COMMENT
LOW	apm/lib/dependabot/apm/version.rb	1	# typed: strong	COMMENT
LOW	apm/lib/dependabot/apm/package_manager.rb	41	# raw content rather than by parsing the YAML: the lockfile is a support	COMMENT
LOW	bin/dry-run.rb	1	#!/usr/bin/env ruby	COMMENT
LOW	bin/dry-run.rb	21	# Package managers:	COMMENT
LOW	python/lib/dependabot/python/dependency_grapher.rb	81	end	COMMENT
LOW	…dabot/python/dependency_grapher/requirements_layers.rb	21	# directory collapsing onto the first `.txt` alphabetically.	COMMENT
LOW	…b/dependabot/python/package/package_details_fetcher.rb	121	).parse(response.body)	COMMENT
LOW	…b/dependabot/python/package/package_details_fetcher.rb	141	# {	COMMENT
LOW	…b/dependabot/python/package/package_details_fetcher.rb	161	# "yanked": false,	COMMENT
LOW	…b/dependabot/python/package/package_details_fetcher.rb	201	end	COMMENT
LOW	conda/lib/dependabot/conda/version.rb	1	# typed: strict	COMMENT
LOW	…/lib/dependabot/cargo/file_updater/lockfile_updater.rb	121		COMMENT
LOW	…/lib/dependabot/cargo/file_updater/lockfile_updater.rb	801	end.sort	COMMENT
LOW	…n/lib/dependabot/maven/shared/shared_version_finder.rb	141	#	COMMENT
LOW	…n/lib/dependabot/maven/shared/shared_version_finder.rb	181	return true if contains_date?(current_suffix) \|\| contains_date?(candidate_suffix)	COMMENT
LOW	…n/lib/dependabot/maven/shared/shared_version_finder.rb	201	# git_sha?("ghijklm") # => false (invalid hex characters)	COMMENT
LOW	…n/lib/dependabot/maven/shared/shared_version_finder.rb	221	# contains_git_sha?("v1.2_a1b2c3d") # => true (SHA after underscore)	COMMENT
LOW	…n/lib/dependabot/maven/shared/shared_version_finder.rb	241	# Determines whether a version string contains a date.	COMMENT
75 more matches not shown…

Redundant / Tautological Comments81 hits · 127 pts

Severity	File	Line	Snippet	Context
LOW	…toolchain/lib/dependabot/rust_toolchain/requirement.rb	101	# Check if version satisfies exact requirement	COMMENT
LOW	…toolchain/lib/dependabot/rust_toolchain/requirement.rb	113	# Check if version satisfies >= requirement	COMMENT
LOW	…toolchain/lib/dependabot/rust_toolchain/requirement.rb	141	# Check if version satisfies > requirement	COMMENT
LOW	…toolchain/lib/dependabot/rust_toolchain/requirement.rb	166	# Check if version satisfies <= requirement	COMMENT
LOW	…toolchain/lib/dependabot/rust_toolchain/requirement.rb	191	# Check if version satisfies < requirement	COMMENT
LOW	…rust_toolchain/update_checker/latest_version_finder.rb	129	# Check if a version string is in major.minor format (e.g., "1.72" vs "1.72.0")	COMMENT
LOW	terraform/lib/dependabot/terraform/file_updater.rb	238	# Check if the architecture is present in the original lockfile	COMMENT
LOW	…ot/terraform/update_checker/latest_version_resolver.rb	98	# Check if the release is within the cooldown period	COMMENT
LOW	…ependabot/terraform/package/package_details_fetcher.rb	62	# Check if releases is an array and not empty	COMMENT
LOW	npm_and_yarn/lib/dependabot/npm_and_yarn.rb	425	# Check if sub dependency is using local path and raise a resolvability error	COMMENT
LOW	npm_and_yarn/lib/dependabot/npm_and_yarn/version.rb	81	# Check if version is a string before attempting to match	COMMENT
LOW	…bot/npm_and_yarn/file_updater/yarn_lockfile_updater.rb	936	# Check if the error message contains any group patterns and raise the corresponding error class	COMMENT
LOW	…bot/npm_and_yarn/file_updater/yarn_lockfile_updater.rb	939	# Check if defined yarn error codes contained in the error message	COMMENT
LOW	…/dependabot/npm_and_yarn/file_updater/npmrc_builder.rb	217	# Check if this registry has already been defined in .npmrc as a scoped registry	COMMENT
LOW	…ndabot/npm_and_yarn/update_checker/library_detector.rb	63	# Check if the project is listed on npm. If it is, it's a library	COMMENT
LOW	…c/dependabot/hex/file_updater/lockfile_updater_spec.rb	425	# Check if private registry is reachable (may be down with 503)	COMMENT
LOW	conda/lib/dependabot/conda/file_fetcher.rb	75	# Check if all packages are fully qualified (no manageable packages)	COMMENT
LOW	conda/lib/dependabot/conda/file_fetcher.rb	93	# Check if there are any manageable packages (simple specs or pip)	COMMENT
LOW	conda/lib/dependabot/conda/file_parser.rb	97	# Check if environment has fully qualified packages (Tier 2)	COMMENT
LOW	conda/lib/dependabot/conda/conda_registry_client.rb	58	# Check if a specific version exists for a package	COMMENT
LOW	conda/lib/dependabot/conda/version.rb	178	# Check if segment contains an embedded pre-release marker	COMMENT
LOW⚡	conda/lib/dependabot/conda/version.rb	242	# Check if segment is dev pre-release	COMMENT
LOW⚡	conda/lib/dependabot/conda/version.rb	248	# Check if segment is alpha pre-release	COMMENT
LOW⚡	conda/lib/dependabot/conda/version.rb	254	# Check if segment is beta pre-release	COMMENT
LOW⚡	conda/lib/dependabot/conda/version.rb	260	# Check if segment is rc pre-release	COMMENT
LOW⚡	conda/lib/dependabot/conda/version.rb	266	# Check if segment is post-release	COMMENT
LOW	…ependabot/conda/update_checker/requirements_updater.rb	223	# Check if version is too high (unfixable)	COMMENT
LOW	…ependabot/conda/update_checker/requirements_updater.rb	327	# Check if lower bound is too high (unfixable)	COMMENT
LOW	…ependabot/conda/update_checker/requirements_updater.rb	375	# Check if this individual constraint is satisfied by new version	COMMENT
LOW	cargo/lib/dependabot/cargo/file_fetcher.rb	248	# Check if this Cargo manifest uses workspace dependencies	COMMENT
LOW	…n/lib/dependabot/maven/shared/shared_version_finder.rb	235	# Check if any delimiter-separated part is a SHA	COMMENT
LOW	…n/lib/dependabot/maven/shared/shared_version_finder.rb	237	# Check if removing delimiters reveals a SHA (e.g., "va_b_018a_a_6b_0d3")	COMMENT
LOW	pre_commit/lib/dependabot/pre_commit/file_updater.rb	200	# Check if this line contains the dependency in additional_dependencies context	COMMENT
LOW	composer/lib/dependabot/composer/helpers.rb	63	# Check if the composer name does not follow the Composer V2 naming conventions.	COMMENT
LOW	composer/lib/dependabot/composer/helpers.rb	71	# Check if the composer.json file contains "require" entries that don't follow	COMMENT
LOW	rakelib/support/ecosystem_scaffolder.rb	177	# Check if file exists and handle based on overwrite mode	COMMENT
LOW	…ort/infrastructure_updaters/github_workflow_updater.rb	34	# Check if ecosystem already exists	COMMENT
LOW	…ort/infrastructure_updaters/github_workflow_updater.rb	49	# Check if this is a key line (not indented, ends with colon)	COMMENT
LOW	…ort/infrastructure_updaters/github_workflow_updater.rb	75	# Check if ecosystem already exists	COMMENT
LOW	…ort/infrastructure_updaters/github_workflow_updater.rb	91	# Check if this is a key line (not indented, ends with colon)	COMMENT
LOW	updater/spec/support/dummy_pkg_helpers.rb	88	# Check if the version is not supported	COMMENT
LOW	updater/lib/dependabot/update_graph_command.rb	72	# Check if the error is a known "run halting" state we should handle	COMMENT
LOW	updater/lib/dependabot/update_files_command.rb	108	# Check if the error is a known "run halting" state we should handle	COMMENT
LOW	updater/lib/dependabot/job.rb	389	# Check if the dependency was vulnerable in its previous version	COMMENT
LOW	updater/lib/dependabot/updater/group_update_creation.rb	360	# Check if dependency has already been handled	COMMENT
LOW	updater/lib/dependabot/updater/group_update_creation.rb	363	# Check if the job is refreshing this specific group	COMMENT
LOW	updater/lib/dependabot/updater/group_update_creation.rb	492	# Check if this up-to-date dependency has security advisories but no fix	COMMENT
LOW	updater/lib/dependabot/updater/group_update_creation.rb	505	# Check if this is a security update with vulnerability audit explanation	COMMENT
LOW	bun/lib/dependabot/bun.rb	181	# Check if sub dependency is using local path and raise a resolvability error	COMMENT
LOW	bun/lib/dependabot/bun/version.rb	81	# Check if version is a string before attempting to match	COMMENT
LOW	bun/lib/dependabot/bun/file_updater/npmrc_builder.rb	93	# Check if this registry has already been defined in .npmrc as a scoped registry	COMMENT
LOW	…/lib/dependabot/bun/update_checker/library_detector.rb	63	# Check if the project is listed on npm. If it is, it's a library	COMMENT
LOW	vcpkg/lib/dependabot/vcpkg/metadata_finder.rb	32	# Check if this is a Git dependency with a specific source	COMMENT
LOW	uv/lib/dependabot/uv/file_updater/lock_file_updater.rb	247	# Check if reference has escaped newlines like "\n" +	COMMENT
LOW	common/spec/dependabot/file_fetchers/base_spec.rb	1652	# Write file with UTF-8 BOM prefix	COMMENT
LOW	common/lib/dependabot/command_helpers.rb	310	# Check if the process is still alive	COMMENT
LOW	common/lib/dependabot/command_helpers.rb	316	Process.kill(0, pid) # Check if the process exists	CODE
LOW⚡	common/lib/dependabot/git_commit_checker.rb	375	# Check if the current ref matches any Git tag (handling version tag prefixes)	COMMENT
LOW	common/lib/dependabot/git_commit_checker.rb	465	# Check if behind, excluding the case where it's identical, because	COMMENT
LOW	common/lib/dependabot/git_commit_checker.rb	740	# Check if the tag is marked as a pre-release on GitHub	COMMENT
21 more matches not shown…

Decorative Section Separators24 hits · 96 pts

Severity	File	Line	Snippet	Context
MEDIUM⚡	python/helpers/test/test_parser.py	25	# ---------------------------------------------------------------------------	COMMENT
MEDIUM⚡	python/helpers/test/test_parser.py	27	# ---------------------------------------------------------------------------	COMMENT
MEDIUM⚡	python/helpers/test/test_parser.py	71	# ---------------------------------------------------------------------------	COMMENT
MEDIUM⚡	python/helpers/test/test_parser.py	73	# ---------------------------------------------------------------------------	COMMENT
MEDIUM⚡	python/helpers/test/test_parser.py	87	# ---------------------------------------------------------------------------	COMMENT
MEDIUM⚡	python/helpers/test/test_parser.py	89	# ---------------------------------------------------------------------------	COMMENT
MEDIUM⚡	python/helpers/test/test_parser.py	120	# ---------------------------------------------------------------------------	COMMENT
MEDIUM⚡	python/helpers/test/test_parser.py	122	# ---------------------------------------------------------------------------	COMMENT
MEDIUM⚡	python/helpers/test/test_parser.py	136	# ---------------------------------------------------------------------------	COMMENT
MEDIUM⚡	python/helpers/test/test_parser.py	138	# ---------------------------------------------------------------------------	COMMENT
MEDIUM⚡	python/helpers/test/test_parser.py	187	# ---------------------------------------------------------------------------	COMMENT
MEDIUM⚡	python/helpers/test/test_parser.py	189	# ---------------------------------------------------------------------------	COMMENT
MEDIUM⚡	python/helpers/test/test_parse_setup.py	24	# ---------------------------------------------------------------------------	COMMENT
MEDIUM⚡	python/helpers/test/test_parse_setup.py	26	# ---------------------------------------------------------------------------	COMMENT
MEDIUM⚡	python/helpers/test/test_parse_setup.py	83	# ---------------------------------------------------------------------------	COMMENT
MEDIUM⚡	python/helpers/test/test_parse_setup.py	85	# ---------------------------------------------------------------------------	COMMENT
MEDIUM	…ependabot/pull_request_creator/branch_name_template.rb	20	# ---------------------------------------------------------------	COMMENT
MEDIUM	…ependabot/pull_request_creator/branch_name_template.rb	24	# ---------------------------------------------------------------	COMMENT
MEDIUM	…ependabot/pull_request_creator/branch_name_template.rb	66	# ---------------------------------------------------------------	COMMENT
MEDIUM	…ependabot/pull_request_creator/branch_name_template.rb	69	# ---------------------------------------------------------------	COMMENT
MEDIUM	…ependabot/pull_request_creator/branch_name_template.rb	91	# ---------------------------------------------------------------	COMMENT
MEDIUM	…ependabot/pull_request_creator/branch_name_template.rb	95	# ---------------------------------------------------------------	COMMENT
MEDIUM	julia/lib/dependabot/julia/registry_client.rb	276	# ============================================================================	COMMENT
MEDIUM	julia/lib/dependabot/julia/registry_client.rb	278	# ============================================================================	COMMENT

Structural Annotation Overuse24 hits · 50 pts

Severity	File	Line	Snippet	Context
LOW	NEW_ECOSYSTEMS.md	63	# Step 1: Generate the ecosystem structure	COMMENT
LOW	NEW_ECOSYSTEMS.md	66	# Step 2: Update supporting infrastructure	COMMENT
LOW⚡	…nd_yarn/lib/dependabot/npm_and_yarn/registry_helper.rb	195	# Step 1: Check dependabot.yml configuration	COMMENT
LOW⚡	…nd_yarn/lib/dependabot/npm_and_yarn/registry_helper.rb	199	# Step 2: Check .npmrc	COMMENT
LOW⚡	…nd_yarn/lib/dependabot/npm_and_yarn/registry_helper.rb	205	# Step 3: Check .yarnrc	COMMENT
LOW⚡	…nd_yarn/lib/dependabot/npm_and_yarn/registry_helper.rb	210	# Step 4: Check yarnrc.yml	COMMENT
LOW⚡	…nd_yarn/lib/dependabot/npm_and_yarn/registry_helper.rb	316	# Step 1: Extract global registry and auth token	COMMENT
LOW⚡	…nd_yarn/lib/dependabot/npm_and_yarn/registry_helper.rb	320	# Step 2: Fallback to any scoped registry and auth token if global is missing	COMMENT
LOW	docker/lib/dependabot/docker/tag.rb	195	# NOTE: This method only checks for the presence of an 8-digit date-like segment in the version part.	COMMENT
LOW⚡	conda/lib/dependabot/conda/version.rb	86	# Step 1: Compare epochs (numerically)	COMMENT
LOW⚡	conda/lib/dependabot/conda/version.rb	90	# Step 2: Compare version parts (segment by segment with fillvalue)	COMMENT
LOW⚡	conda/lib/dependabot/conda/version.rb	94	# Step 3: Compare local parts (if present)	COMMENT
LOW⚡	…ependabot/conda/update_checker/requirements_updater.rb	94	# Step 1: Check for equality match first (e.g., "==1.21.0" or bare "1.21.0")	COMMENT
LOW⚡	…ependabot/conda/update_checker/requirements_updater.rb	97	# Step 2: Handle range requirements (e.g., ">=3.10,<3.12")	COMMENT
LOW⚡	…ependabot/conda/update_checker/requirements_updater.rb	100	# Step 3: Handle single constraint (e.g., ">=3.10")	COMMENT
LOW	…mit/python_additional_dependencies_integration_spec.rb	303	# Step 1: Parse dependencies	COMMENT
LOW	…mit/python_additional_dependencies_integration_spec.rb	317	# Step 2: Check for updates (mocked)	COMMENT
LOW	…mit/python_additional_dependencies_integration_spec.rb	338	# Step 3: Update the file	COMMENT
LOW⚡	bun/lib/dependabot/bun/registry_helper.rb	37	# Step 1: Check dependabot.yml configuration	COMMENT
LOW⚡	bun/lib/dependabot/bun/registry_helper.rb	41	# Step 2: Check .npmrc	COMMENT
LOW⚡	bun/lib/dependabot/bun/registry_helper.rb	47	# Step 3: Check .yarnrc	COMMENT
LOW⚡	bun/lib/dependabot/bun/registry_helper.rb	52	# Step 4: Check yarnrc.yml	COMMENT
LOW⚡	bun/lib/dependabot/bun/registry_helper.rb	144	# Step 1: Extract global registry and auth token	COMMENT
LOW⚡	bun/lib/dependabot/bun/registry_helper.rb	148	# Step 2: Fallback to any scoped registry and auth token if global is missing	COMMENT

Verbosity Indicators22 hits · 46 pts

Severity	File	Line	Snippet	Context
LOW	npm_and_yarn/lib/dependabot/npm_and_yarn/helpers.rb	559	# For conversion reading properly from npm 6 lockfile we need to check if detected version is npm 6	COMMENT
LOW⚡	…nd_yarn/lib/dependabot/npm_and_yarn/registry_helper.rb	195	# Step 1: Check dependabot.yml configuration	COMMENT
LOW⚡	…nd_yarn/lib/dependabot/npm_and_yarn/registry_helper.rb	199	# Step 2: Check .npmrc	COMMENT
LOW⚡	…nd_yarn/lib/dependabot/npm_and_yarn/registry_helper.rb	205	# Step 3: Check .yarnrc	COMMENT
LOW⚡	…nd_yarn/lib/dependabot/npm_and_yarn/registry_helper.rb	210	# Step 4: Check yarnrc.yml	COMMENT
LOW⚡	…nd_yarn/lib/dependabot/npm_and_yarn/registry_helper.rb	316	# Step 1: Extract global registry and auth token	COMMENT
LOW⚡	…nd_yarn/lib/dependabot/npm_and_yarn/registry_helper.rb	320	# Step 2: Fallback to any scoped registry and auth token if global is missing	COMMENT
LOW⚡	conda/lib/dependabot/conda/version.rb	86	# Step 1: Compare epochs (numerically)	COMMENT
LOW⚡	conda/lib/dependabot/conda/version.rb	90	# Step 2: Compare version parts (segment by segment with fillvalue)	COMMENT
LOW⚡	conda/lib/dependabot/conda/version.rb	94	# Step 3: Compare local parts (if present)	COMMENT
LOW⚡	…ependabot/conda/update_checker/requirements_updater.rb	94	# Step 1: Check for equality match first (e.g., "==1.21.0" or bare "1.21.0")	COMMENT
LOW⚡	…ependabot/conda/update_checker/requirements_updater.rb	97	# Step 2: Handle range requirements (e.g., ">=3.10,<3.12")	COMMENT
LOW⚡	…ependabot/conda/update_checker/requirements_updater.rb	100	# Step 3: Handle single constraint (e.g., ">=3.10")	COMMENT
LOW	…mit/python_additional_dependencies_integration_spec.rb	303	# Step 1: Parse dependencies	COMMENT
LOW	…mit/python_additional_dependencies_integration_spec.rb	317	# Step 2: Check for updates (mocked)	COMMENT
LOW	…mit/python_additional_dependencies_integration_spec.rb	338	# Step 3: Update the file	COMMENT
LOW⚡	bun/lib/dependabot/bun/registry_helper.rb	37	# Step 1: Check dependabot.yml configuration	COMMENT
LOW⚡	bun/lib/dependabot/bun/registry_helper.rb	41	# Step 2: Check .npmrc	COMMENT
LOW⚡	bun/lib/dependabot/bun/registry_helper.rb	47	# Step 3: Check .yarnrc	COMMENT
LOW⚡	bun/lib/dependabot/bun/registry_helper.rb	52	# Step 4: Check yarnrc.yml	COMMENT
LOW⚡	bun/lib/dependabot/bun/registry_helper.rb	144	# Step 1: Extract global registry and auth token	COMMENT
LOW⚡	bun/lib/dependabot/bun/registry_helper.rb	148	# Step 2: Fallback to any scoped registry and auth token if global is missing	COMMENT

AI Slop Vocabulary23 hits · 40 pts

Severity	File	Line	Snippet	Context
LOW	terraform/lib/dependabot/terraform/update_checker.rb	29	# Other sources (mercurial, path dependencies) just return `nil`	COMMENT
MEDIUM	npm_and_yarn/lib/dependabot/npm_and_yarn/version.rb	28	"canary", # Canary version, often used for cutting-edge builds	CODE
LOW	…cker/lib/dependabot/shared/utils/credentials_finder.rb	68	# If credentials have been generated from AWS we can just return them	COMMENT
LOW	hex/lib/dependabot/hex/file_fetcher.rb	105	# used. We can just return an empty array of subapp files.	COMMENT
LOW⚡	…ependabot/cargo/update_checker/requirements_updater.rb	112	# If there's an exact version, just return that	COMMENT
LOW⚡	…ependabot/cargo/update_checker/requirements_updater.rb	117	# If a ~, ^, or * range needs to be updated, just return that	COMMENT
LOW	…ependabot/cargo/update_checker/requirements_updater.rb	143	# For pre-release versions, just use the full version string	COMMENT
LOW	maven/lib/dependabot/maven/update_checker.rb	106	# never going to take any action as a result, though, we just return	COMMENT
LOW	…dabot/composer/file_fetcher/path_dependency_builder.rb	30	# Current we just return `nil` if a path dependency can't be built.	COMMENT
LOW	…ndabot/composer/update_checker/requirements_updater.rb	134	# how to update it, so we just return the existing requirement.	COMMENT
MEDIUM	…er/lib/dependabot/updater/group_dependency_selector.rb	25	# - Provides comprehensive observability for debugging	COMMENT
MEDIUM	bun/lib/dependabot/bun/version.rb	28	"canary", # Canary version, often used for cutting-edge builds	CODE
LOW	gradle/lib/dependabot/gradle/update_checker.rb	30	# The above is hard. Currently we just return the latest version and	COMMENT
LOW	gradle/lib/dependabot/gradle/update_checker.rb	60	# never going to take any action as a result, though, we just return	COMMENT
LOW	common/lib/dependabot/registry_client.rb	10	# This is not used to support full response caching currently, we just use it to ensure we detect unreachable	COMMENT
MEDIUM	…ib/dependabot/pull_request_creator/pr_name_prefixer.rb	235	# Definitely not using Angular commits if < 30% match angular commits	COMMENT
MEDIUM	…c/dependabot/bazel/file_parser/starlark_parser_spec.rb	618	# The parser should be robust enough to not crash	COMMENT
LOW	go_modules/lib/dependabot/go_modules/requirement.rb	114	# Before we hit a wildcard we just return the existing part	COMMENT
LOW	opentofu/lib/dependabot/opentofu/update_checker.rb	30	# Other sources (mercurial, path dependencies) just return `nil`	COMMENT
LOW	…bundler/file_updater/gemspec_dependency_name_finder.rb	34	nil # If we can't evaluate the expression just return nil	CODE
LOW	…ib/dependabot/bundler/file_updater/lockfile_updater.rb	320	# Instead, we just return the default-ordered content just	COMMENT
LOW	…ndabot/bundler/file_updater/ruby_requirement_setter.rb	98	nil # If we can't evaluate the expression just return nil	CODE
LOW	…ndabot/bundler/update_checker/latest_version_finder.rb	86	# In that case, skip cooldown and just return all versions.	COMMENT

Modern AI Meta-Vocabulary7 hits · 18 pts

Severity	File	Line	Snippet	Context
MEDIUM	rakelib/support/ecosystem_infrastructure_updater.rb	44	puts "Error: Ecosystem '#{@ecosystem_name}' not found. Please scaffold it first."	CODE
MEDIUM	…support/test/ecosystem_infrastructure_updater_tests.rb	22	# First, scaffold a test ecosystem	COMMENT
MEDIUM	…support/test/ecosystem_infrastructure_updater_tests.rb	24	result = run_command("cd #{original_dir} && bundle exec rake ecosystem:scaffold[test_infra_eco,skip]")	CODE
MEDIUM	…support/test/ecosystem_infrastructure_updater_tests.rb	181	# Test combined create task (scaffold + update_infrastructure)	COMMENT
MEDIUM	rakelib/support/test/ecosystem_scaffold_tests.rb	8	# Tests for ecosystem scaffold rake task	COMMENT
MEDIUM	rakelib/support/test/ecosystem_scaffold_tests.rb	25	result = run_command("cd #{original_dir} && bundle exec rake ecosystem:scaffold[test_eco_temp,skip]")	CODE
MEDIUM	common/lib/dependabot/git_commit_checker.rb	192	# #apply_cooldown, so this method stays a thin orchestration step.	COMMENT

Fake / Example Data12 hits · 14 pts

Severity	File	Line	Snippet	Context
LOW	…yarn/spec/dependabot/npm_and_yarn/file_updater_spec.rb	599	"git+https://dummy-token@github.com/jonschlinkert/is-number.git#0c6b15a88bc10cd47f67a09506399dfc9ddc07	CODE
LOW	…yarn/spec/dependabot/npm_and_yarn/file_updater_spec.rb	604	"is-number@https://dummy-token@github.com/" \	CODE
LOW	…yarn/spec/dependabot/npm_and_yarn/file_updater_spec.rb	2318	"git+https://dummy-token@github.com/jonschlinkert/" \	CODE
LOW	npm_and_yarn/helpers/test/yarn/helpers.test.ts	22	"is-number@https://dummy-token@github.com/jonschlinkert/is-number.git#master";	CODE
LOW	npm_and_yarn/helpers/test/yarn/helpers.test.ts	28	"https://dummy-token@github.com/jonschlinkert/is-number.git#master"	CODE
LOW	common/spec/dependabot/shared_helpers_spec.rb	610	"password" => "fake-token"	CODE
LOW	common/spec/dependabot/shared_helpers_spec.rb	628	expect(configured_git_credentials).to eq("https://x-access-token:fake-token@github.com\n")	CODE
LOW⚡	common/spec/dependabot/shared_helpers_spec.rb	639	"password" => "v1.fake-token"	CODE
LOW⚡	common/spec/dependabot/shared_helpers_spec.rb	645	"password" => "fake-token"	CODE
LOW⚡	common/spec/dependabot/shared_helpers_spec.rb	651	expect(configured_git_credentials).to eq("https://x-access-token:fake-token@github.com\n")	CODE
LOW	common/spec/dependabot/shared_helpers_spec.rb	662	"password" => "fake-token"	CODE
LOW	common/spec/dependabot/shared_helpers_spec.rb	684	expect(configured_git_credentials).to eq("https://x-access-token:fake-token@private.com\n")	CODE

Hallucination Indicators1 hit · 10 pts

Severity	File	Line	Snippet	Context
CRITICAL	…ependabot/bundler/file_updater/requirement_replacer.rb	295	nodes.first.loc.begin.begin.join(nodes.last.loc.expression)	CODE

Excessive Try-Catch Wrapping6 hits · 8 pts

Severity	File	Line	Snippet	Context
LOW	python/helpers/lib/parser.py	219	except Exception as e:	CODE
LOW	python/helpers/lib/parser.py	348	except Exception as e:	CODE
MEDIUM	python/helpers/lib/parser.py	59	def parse_requirement(entry, pyproject_path, requirement_type=None):	CODE
LOW	uv/helpers/lib/parser.py	213	except Exception as e:	CODE
LOW	uv/helpers/lib/parser.py	342	except Exception as e:	CODE
MEDIUM	uv/helpers/lib/parser.py	35	def parse_requirement(entry, pyproject_path, requirement_type=None):	CODE

AI Response Leakage1 hit · 8 pts

Severity	File	Line	Snippet	Context
HIGH	…dependabot/hex/update_checker/version_resolver_spec.rb	131	# In this example, updating `credo` would add its sub-dependency,	COMMENT

Empty Error Handlers1 hit · 5 pts

Severity	File	Line	Snippet	Context
HIGH	python/helpers/test/test_hasher.py	84	except URLError:	CODE

Deep Nesting4 hits · 4 pts

Severity	File	Line	Context
LOW	python/helpers/lib/parser.py	174	CODE
LOW	python/helpers/lib/parser.py	226	CODE
LOW	uv/helpers/lib/parser.py	168	CODE
LOW	uv/helpers/lib/parser.py	220	CODE

Example Usage Blocks2 hits · 3 pts

Severity	File	Line	Snippet	Context
LOW	bin/dry-run.rb	12	# Usage:	COMMENT
LOW	…ependabot/pre_commit/additional_dependency_checkers.rb	12	# Usage:	COMMENT

AI Structural Patterns2 hits · 2 pts

Severity	File	Line	Snippet	Context
LOW	python/helpers/test/test_parse_setup.py	17		CODE
LOW	python/helpers/test/test_parse_requirements.py	17		CODE

dependabot/dependabot-core

Open-Source Code Quality, Security and Technical Debt Review