dependency-aging-advisor - Orbit Edition

Inspiration

Dependency triage is the quietest, most universal time sink in software. Tools like Dependabot and Renovate are great at telling you what changed, but they flood you with version bumps ranked by recency, not by risk to your system. An outdated crypto library on your login path and an outdated logger used by one test show up identically. So teams either chase everything or ignore everything — both are wrong.

We had already built a stdlib-only "Dependency Aging Advisor" that scored packages by CVE severity, version lag, and a guessed usage depth from file-name regexes. The guess was always the weak link. GitLab Orbit removes the guess: it already models ImportedSymbol → IMPORTS → Definition across the whole codebase. That's blast radius, as ground truth.

What it does

• Reads a project's dependency manifests (npm, PyPI, RubyGems, Go, Rust, Maven, PHP, NuGet).
• For each dependency, calls Orbit's query_graph to measure blast radius: which files and definitions import it, and how central they are.
• Combines that with vulnerability severity (GitLab security findings in the Flow; OSV in the engine) into a single risk score, bucketed into Act this week / Act this month / Track / Ignore.
• Files one prioritized advisory issue — an action, not a chat — where every line cites the Orbit-found importing files, so the advice is explainable.

The punchline, verified live (advisory issue #2 filed by @ai-dependency-aging-advisor-gitlab-ai-hackathon):

• axios v0.21.1 → CORE (7 import sites, CVE-2021-3749 CVSS 7.5) → Act this month
• bcrypt v5.0.1 → CRITICAL (src/auth/password.js, login path, blast radius 10) → Act this month
• lodash → PERIPHERAL (declared but unused per Orbit) → Track / remove
• debug → PERIPHERAL (one test file) → Ignore

Same outdated packages. Opposite urgencies. Orbit made that call.

Live advisory: https://gitlab.com/gitlab-ai-hackathon/transcend/20182084/-/work_items/2

How we built it

Three layers, all open-source under MIT:

1. The Flow (the published AI Catalog artifact). A custom Duo Agent Platform flow (environment: ambient, flow-registry v1). A read-only analyst component calls query_graph / get_graph_schema plus GitLab repository and security tools, ranks the dependencies, and emits strict JSON. A write-only advisor component renders the advisory and calls create_issue. The reader/writer split is the recommended security pattern — only one agent can write.
2. The engine (the portable product). A stdlib-only Python engine with orbit_client.py, which runs the same blast-radius queries over the Orbit REST DSL (POST /api/v4/orbit/query), scopes them to the current project via traversal_path, and gracefully falls back to a local code scan if Orbit is unavailable. Runs from a scheduled .gitlab-ci.yml.
3. The skill. dependency-blast-radius — a reusable skill that answers "what's the blast radius of dependency X?" in Duo Chat / Claude Code, using the same Orbit query templates.

Orbit usage is load-bearing: blast radius is the ranking function. Remove Orbit and the product is just another flat scanner.

Challenges we ran into

• Reaching Orbit from a server-side flow. Flows can't make arbitrary HTTP calls, so OSV/registry enrichment had to stay in the engine; the Flow is intentionally all-GitLab-native (Orbit + GitLab security findings), which the sandbox allowlist permits.
• Response envelope & auth. Live testing caught two real bugs before they shipped: the actual query_graph response nests rows under result.nodes / result.rows[].def.properties, and OAuth sessions need Authorization: Bearer while CI tokens use PRIVATE-TOKEN — the client now handles both.
• Scoping without timeouts. A bare ImportedSymbol match spans every readable project (185 lodash importers globally). The File → Branch → Project join times out (504). Solution: ImportedSymbol.traversal_path starts_with — fast (~0.9 s) and correctly isolated.

Accomplishments that we're proud of

• Replacing a heuristic with a real graph query — and proving it end-to-end on live Orbit, not in theory.
• A genuinely polished, Apple-inspired HTML risk report (system typography, light/dark, a blast-radius risk map) that makes the ranking legible at a glance.
• It degrades gracefully: Orbit when available, a local scan otherwise — so it's useful in any repo today.

What we learned

Orbit turns "where is this used?" from a fuzzy text search into a precise, permission-aware graph traversal — and that single capability is enough to reorder an entire class of developer busywork from noise into priority.

What's next for Dependency Aging Advisor — Orbit Edition

• Open version-bump remediation MRs for the top "act this week" items (closing the loop).
• A verifier component that checks whether last week's criticals were actually fixed.
• Richer Orbit signals: deployment path and code owners (CALLS, DEFINES, deploy edges) in the "why."

Built With

• agent
• api
• ci/cd
• duo
• gitlab
• glab
• graph
• html/canvas
• knowledge
• orbit
• platform
• python
• query-graph
• rest