Vibgrate Evidence

Answer the exposure question with signed evidence.

When a vulnerability lands, someone asks: are we affected? With a spreadsheet, the answer arrives days later. Vibgrate Evidence tells you which shipped products contain it — at which versions, in which markets, still in support — in seconds, as reproducible evidence you can verify offline.

Try it in 60 seconds EU Cyber Resilience Act →

See Vibgrate Evidence in the CLI

Pick a command — register a product and report CRA readiness, or freeze a shipped release from BuildKit outputs. These are real recorded CLI runs against our test repository.

Replay

demo@vibgrate — bash

❯ npx @vibgrate/cli scan

╭──────────────────────────────────────────╮

│ Vibgrate Drift Report │

╰──────────────────────────────────────────╯

── node-turborepo (node) .

Runtime: >=18.0.0 (6 majors behind)

Frameworks:

Turbo: 1.13.4 → 2.11.9 (1 behind)

TypeScript: 5.9.3 → 7.0.2 (2 behind)

Dependencies:

1 current 1 1-behind 3 2+ behind 1 unknown

── @repo/admin (node) apps/admin

Frameworks:

TanStack Query: 5.104.5 → 5.104.5 (current)

React: 18.3.1 → 19.3.1 (1 behind)

React DOM: 18.3.1 → 19.3.1 (1 behind)

TypeScript: 5.9.3 → 7.0.2 (2 behind)

Vite: 5.4.21 → 8.3.4 (3 behind)

Dependencies:

3 current 9 1-behind 3 2+ behind 4 unknown

── @repo/api (node) apps/api

Frameworks:

Express: 4.22.3 → 5.3.0 (1 behind)

TypeScript: 5.9.3 → 7.0.2 (2 behind)

Vitest: 1.6.1 → 5.0.5 (4 behind)

Dependencies:

7 current 4 1-behind 4 2+ behind 4 unknown

── @repo/web (node) apps/web

Frameworks:

Next.js: 14.2.35 → 16.4.2 (2 behind)

React: 18.3.1 → 19.3.1 (1 behind)

React DOM: 18.3.1 → 19.3.1 (1 behind)

TypeScript: 5.9.3 → 7.0.2 (2 behind)

Dependencies:

2 current 6 1-behind 3 2+ behind 5 unknown

── @repo/config (node) packages/config

Frameworks:

TypeScript: 5.9.3 → 7.0.2 (2 behind)

Dependencies:

2 current 2 1-behind 5 2+ behind 0 unknown

── @repo/database (node) packages/database

Frameworks:

Prisma: 5.22.0 → 7.10.1 (2 behind)

TypeScript: 5.9.3 → 7.0.2 (2 behind)

Dependencies:

1 current 0 1-behind 3 2+ behind 1 unknown

── @repo/types (node) packages/types

Frameworks:

TypeScript: 5.9.3 → 7.0.2 (2 behind)

Dependencies:

0 current 0 1-behind 1 2+ behind 1 unknown

── @repo/ui (node) packages/ui

Frameworks:

React: 18.3.1 → 19.3.1 (1 behind)

TypeScript: 5.9.3 → 7.0.2 (2 behind)

React: 18.3.1 → 19.3.1 (1 behind)

Dependencies:

1 current 4 1-behind 1 2+ behind 1 unknown

── @repo/utils (node) packages/utils

Frameworks:

TypeScript: 5.9.3 → 7.0.2 (2 behind)

Vitest: 1.6.1 → 5.0.5 (4 behind)

Dependencies:

0 current 1 1-behind 2 2+ behind 1 unknown

Tech Stack

Frontend: React, React DOM

Meta-frameworks: Next.js

Bundlers: tsx, Turbo, Vite

CSS / UI: Autoprefixer, PostCSS, Tailwind CSS

Backend: Express

ORM / Database: Prisma, Prisma Client

Testing: Vitest

Lint & Format: ESLint, ESLint Prettier, ESLint React, Prettier, typescript-eslint

Services & Integrations

Auth: JWT 9.0.3

Databases: Prisma 5.22.0

TypeScript

v5.3.3 · strict ✔ · MIXED · target: ES2022

Build & Deploy

Package Managers: pnpm

Monorepo: npm-workspaces, pnpm-workspaces, turbo

Product Purpose Signals

Frameworks: react, nextjs

Evidence: 177

Top Signals:

- [heading] Dashboard (apps/admin/src/pages/Dashboard.tsx)

- [title] Revenue Overview (apps/admin/src/pages/Dashboard.tsx)

- [copy] workspace:* (packages/ui/package.json)

- [copy] ./dist (packages/ui/tsconfig.json)

- [copy] ./src/index.ts (packages/ui/package.json)

- [copy] @repo/config/tsconfig-base.json (packages/ui/tsconfig.json)

- [copy] @repo/ui (packages/ui/package.json)

- [copy] #3b82f6 (apps/admin/src/pages/Dashboard.tsx)

Unknowns:

- No pricing or billing evidence found.

- No integrations/connectors evidence found.

- No route structure evidence found.

Security Posture

Lockfile ✖ · .env ✔ · node_modules ✔

Platform

Native modules: turbo

Code Quality

Files: 36 · Functions: 183 · Avg complexity: 2.62 · Avg length: 21.13 lines

Max nesting: 2 · Circular deps: 0 · Dead code: 0%

God files: apps/admin/src/pages/Products (448 lines)

Database Schema

postgresql · 8 models · 1 enum

Models: Address, CartItem, Category, Order, OrderItem (+3 more)

Findings (16 errors, 11 warnings)

✖ @types/node is 6 major versions behind (spec: ^20.11.0, latest: 26.6.5).

vibgrate/dependency-major-lag in .

✖ 60% of dependencies are 2+ major versions behind in node-turborepo.

vibgrate/dependency-rot in .

✖ Node.js runtime ">=18.0.0" reached end-of-life on 2025-04-30 (latest: 24.0.0).

vibgrate/runtime-eol in .

✖ vite is 3 major versions behind (spec: ^5.0.12, latest: 8.3.4).

vibgrate/dependency-major-lag in apps/admin

✖ Vite is 3 major versions behind (current: 5.4.21, latest: 8.3.4).

vibgrate/framework-major-lag in apps/admin

✖ @types/node is 6 major versions behind (spec: ^20.11.0, latest: 26.6.5).

vibgrate/dependency-major-lag in apps/api

✖ vitest is 4 major versions behind (spec: ^1.2.1, latest: 5.0.5).

vibgrate/dependency-major-lag in apps/api

✖ Vitest is 4 major versions behind (current: 1.6.1, latest: 5.0.5).

vibgrate/framework-major-lag in apps/api

✖ @types/node is 6 major versions behind (spec: ^20.11.0, latest: 26.6.5).

vibgrate/dependency-major-lag in apps/web

✖ eslint-plugin-react-hooks is 3 major versions behind (spec: ^4.6.0, latest: 7.1.1).

vibgrate/dependency-major-lag in packages/config

✖ 56% of dependencies are 2+ major versions behind in @repo/config.

vibgrate/dependency-rot in packages/config

✖ 75% of dependencies are 2+ major versions behind in @repo/database.

vibgrate/dependency-rot in packages/database

✖ 100% of dependencies are 2+ major versions behind in @repo/types.

vibgrate/dependency-rot in packages/types

✖ vitest is 4 major versions behind (spec: ^1.2.1, latest: 5.0.5).

vibgrate/dependency-major-lag in packages/utils

✖ 67% of dependencies are 2+ major versions behind in @repo/utils.

vibgrate/dependency-rot in packages/utils

✖ Vitest is 4 major versions behind (current: 1.6.1, latest: 5.0.5).

vibgrate/framework-major-lag in packages/utils

⚠ TypeScript is 2 major versions behind (current: 5.9.3, latest: 7.0.2).

vibgrate/framework-major-lag in .

⚠ TypeScript is 2 major versions behind (current: 5.9.3, latest: 7.0.2).

vibgrate/framework-major-lag in apps/admin

⚠ TypeScript is 2 major versions behind (current: 5.9.3, latest: 7.0.2).

vibgrate/framework-major-lag in apps/api

⚠ Next.js is 2 major versions behind (current: 14.2.35, latest: 16.4.2).

vibgrate/framework-major-lag in apps/web

⚠ TypeScript is 2 major versions behind (current: 5.9.3, latest: 7.0.2).

vibgrate/framework-major-lag in apps/web

⚠ TypeScript is 2 major versions behind (current: 5.9.3, latest: 7.0.2).

vibgrate/framework-major-lag in packages/config

⚠ Prisma is 2 major versions behind (current: 5.22.0, latest: 7.10.1).

vibgrate/framework-major-lag in packages/database

⚠ TypeScript is 2 major versions behind (current: 5.9.3, latest: 7.0.2).

vibgrate/framework-major-lag in packages/database

⚠ TypeScript is 2 major versions behind (current: 5.9.3, latest: 7.0.2).

vibgrate/framework-major-lag in packages/types

⚠ TypeScript is 2 major versions behind (current: 5.9.3, latest: 7.0.2).

vibgrate/framework-major-lag in packages/ui

⚠ TypeScript is 2 major versions behind (current: 5.9.3, latest: 7.0.2).

vibgrate/framework-major-lag in packages/utils

╭──────────────────────────────────────────╮

│ Top Priority Actions │

╰──────────────────────────────────────────╯

1. Upgrade EOL runtime in node-turborepo

End-of-life runtimes no longer receive security patches and block ecosystem upgrades.

./.

>=18.0.0 → 24.0.0 (6 majors behind)

Impact: −10 drift points (runtime & EOL)

2. Fix security posture: no lockfile found

Without a lockfile, installs are non-deterministic. Run the install command to generate one and commit it.

Missing: package-lock.json, pnpm-lock.yaml, or yarn.lock

3. Upgrade Vitest 1.6.1 → 5.0.5 in @repo/api (+2 more)

4 major versions behind. Major framework drift increases breaking change risk and blocks access to security fixes and performance improvements.

./apps/api

Vitest: 1.6.1 → 5.0.5 (4 majors behind)

./packages/utils

Vitest: 1.6.1 → 5.0.5 (4 majors behind)

./apps/admin

Vite: 5.4.21 → 8.3.4 (3 majors behind)

Impact: −5–15 drift points

4. Reduce dependency rot in @repo/types (100% severely outdated)

1 of 1 dependencies are 2+ majors behind. Run `npm outdated` and prioritise packages with known CVEs or breaking API changes.

./packages/types

typescript: 5.9.3 → 7.0.2 (2 majors behind)

Impact: −5–10 drift points

5. Reduce dependency rot in @repo/database (75% severely outdated)

3 of 4 dependencies are 2+ majors behind. Run `npm outdated` and prioritise packages with known CVEs or breaking API changes.

./packages/database

@prisma/client: 5.22.0 → 7.10.1 (2 majors behind)

prisma: 5.22.0 → 7.10.1 (2 majors behind)

typescript: 5.9.3 → 7.0.2 (2 majors behind)

Impact: −5–10 drift points

╭──────────────────────────────────────────╮

│ Architecture Layers │

╰──────────────────────────────────────────╯

Archetype: nextjs (80% confidence)

Files classified: 24 (11 unclassified)

Folders classified: 8

apps/admin/src presentation 100% 4 files

apps/admin/src/pages presentation 100% 2 files

apps/api/src/middleware middleware 100% 2 files

apps/api/src/routes routing 100% 2 files

apps/web/src/app presentation 100% 4 files

apps/web/src/app/products presentation 100% 2 files

apps/web/src/app/products/[id] presentation 100% 1 file

packages/ui/src presentation 100% 6 files

Unclassified source (sample): 11

presentation 15 files drift ████████████████████ 100 risk high

routing 4 files drift ████████████████████ 100 risk high

middleware 2 files drift ███████▍░░░░░░░░░░░░ 37 risk moderate

config 2 files drift ░░░░░░░░░░░░░░░░░░░░ 0 risk none

shared 1 file drift ████████████████████ 100 risk high

╭──────────────────────────────────────────╮

│ DriftScore Summary │

╰──────────────────────────────────────────╯

DriftScore: 70/100

Risk Level: HIGH

Projects: 9

Classified: 8 nano · 1 micro · 0 small · 0 standard

Billable: 0.42 · 9 detected → 0.42 billable projects (micro-project pricing)

0.1 micro · 0.32 nano

These fractions add up across repositories, then round down to whole billable projects.

Score Breakdown

Runtime: ████████████████████ 100

Frameworks: ███████████▊░░░░░░░░ 59

Dependencies: ██████▌░░░░░░░░░░░░░ 33

EOL Risk: ████████████████████ 100

Scanned at 2026-10-20T09:13:55.988Z · 5.4s · 286 files scanned · 56 workspace files · 27 dirs

❯

Press Run to start.

Live replay of real @vibgrate/cli runs against our test repositories — nothing is executed in your browser.

Read the vg evidence command reference.

One question, one command

Register your products, freeze each shipped release into an immutable component manifest, then ask the one question that matters at hour 23.

vg evidence exposure — example data

$ vg evidence exposure CVE-2026-48282 --regime cra --offline --advisory advisory.json

  EXPOSURE FOUND — 3 products · 3 shipped releases

  Product           Shipped versions   Markets        Support
  ─────────────────────────────────────────────────────────────
  SentinelGate 4.x  4.2.0              DE FR NL BE    in support
  SentinelGate 3.x  3.9.4              DE FR          in support
  EdgeRelay         2.1.3              ES IT PT       in support

  Coordinator     NCSC-NL
  Filing person   Jordan Alvarez · authority: yes
  Advisory        CVE-2026-48282  (advisory.json)

  Evidence  EXWPGM15D3KP4N5G2075QCNRDJ   deterministic · kernel evidence-1
            data-pack none · timestamp local-clock

  Next →  vg evidence pack CVE-2026-48282 --regime cra --stage=early-warning

Real CLI output on example data. Exit codes are CI-usable: 0 no exposure · 2 exposure · 3 undetermined · 1 error.

See the CLI in action — the full vg evidence reference

Container releases

Freeze the release the build actually produced

A frozen manifest is only as good as the facts in it. If you ship container images, BuildKit — the engine behind docker build — already wrote them: the image digest, a provenance attestation naming the source commit and base images, and often an SBOM. vg evidence release reads those instead of asking someone to type them in, so the manifest is tied to the artefact that shipped.

# at build time — BuildKit writes the facts
docker buildx build --push --provenance=true --sbom=true \
  --metadata-file build-metadata.json -t ghcr.io/acme/edge-gateway:4.2.0 .

# at release time — freeze from the image and its attestations
vg evidence release acme-edge-gateway 4.2.0 --image ghcr.io/acme/edge-gateway:4.2.0

# or from the files, with no Docker daemon
vg evidence release acme-edge-gateway 4.2.0 --from sbom.spdx.json \
  --buildkit-metadata build-metadata.json --provenance provenance.intoto.json

Digest, commit, base images, SBOM

Read from the metadata file, the SLSA provenance attestation, and the SPDX SBOM the build attached — recorded under build in the frozen manifest.

Never a silent preference

A typed digest that disagrees with what the build wrote is an error. Signatures on attestations are recorded as unverified: Vibgrate has no registry trust root, so it says so and points you at cosign.

Watch a release freeze from BuildKit outputs

Evidence an auditor can accept

Frozen at ship time

Every scanner tells you what is in your repository today. A regulator is asking about the firmware you shipped in 2023. Vibgrate freezes each release manifest at ship time and never regenerates it, so the answer is about what you actually shipped.

Deterministic — no model touches the number

Same repository state, same data pack, byte-identical answer — now and years from now. A language model can help draft the covering narrative for a notification. It never decides whether you shipped the library.

Signed and independently verifiable

Every answer is an evidence bundle with a detached Ed25519 signature. A third party can verify it offline, with no Vibgrate account and no network connection, with honest verified / unverified / failed states.

Works air-gapped

Your incident response cannot depend on our uptime. The whole evidence path runs against a local advisory file with the cable unplugged.

Says "I don't know" when it doesn't know

Where a manifest is missing, Vibgrate returns undetermined with a reason. It never interpolates. A false "not affected" here would be your problem, not our rounding error.

Regimes

One engine, many regimes

Reporting duties are modeled as regimes. The EU Cyber Resilience Act is the first; DORA incident reporting ships alongside it. As other jurisdictions introduce similar duties, each one plugs in as a profile — vg evidence exposure … --regime <id> — not a new command. The command set stays open.

EU Cyber Resilience Act

Regulation (EU) 2024/2847 · 24-hour early warning, 72-hour notification, 14-day final report, filed through the ENISA Single Reporting Platform.

DORA incident reporting

Regulation (EU) 2022/2554 · major ICT-related incident reporting, from the same deterministic engine.

Try it

Install the Vibgrate CLI, then run vg evidence regimes to get started.

npx @vibgrate/cli scan

no install·Nothing is installed globally — ideal for CI or a one-off scan.

vg evidence init --coordinator NCSC-NL --responsible "Jordan Alvarez" --filing-authority
vg evidence product add "Acme Edge Gateway" --markets DE,FR,NL --in-scope --until 2031-01-01
vg evidence release acme-edge-gateway 4.2.0 --from .vibgrate/scan_result.json
vg evidence readiness

What we don’t do

We don’t file for you

We produce the filled pack; your named person submits it through the reporting platform.

We don’t decide “actively exploited”

We surface the KEV listing and the evidence. The determination is yours.

We don’t make you compliant

Compliance is determined by you and, where applicable, a notified body. We produce evidence. We hold to that distinction.

We’re not lawyers

Nothing here is legal advice. Confirm your obligations with counsel.

Run your first drill before you need it

vg evidence drill times a dry run of the determination against a simulated advisory built from a component you actually ship — so the first attempt isn’t the real one.

Get the CLI Are you in CRA scope? →

Keep reading

vg evidence command reference EU Cyber Resilience Act Full CLI reference Vibgrate CLI CRA remediation metrics

Vibgrate Evidence produces evidence to support your obligations under a regime. It does not determine compliance, is not a certification, and is not legal advice.

Vibgrate Evidence

See the CLI in action

A replay of the actual CLI registering a product with digital elements, freezing a shipped-release manifest from BuildKit outputs, and reporting CRA readiness. Nothing executes in your browser.

Replay

demo@vibgrate — bash

❯ npx @vibgrate/cli scan

╭──────────────────────────────────────────╮

│ Vibgrate Drift Report │

╰──────────────────────────────────────────╯

── node-turborepo (node) .

Runtime: >=18.0.0 (6 majors behind)

Frameworks:

Turbo: 1.13.4 → 2.11.9 (1 behind)

TypeScript: 5.9.3 → 7.0.2 (2 behind)

Dependencies:

1 current 1 1-behind 3 2+ behind 1 unknown

── @repo/admin (node) apps/admin

Frameworks:

TanStack Query: 5.104.5 → 5.104.5 (current)

React: 18.3.1 → 19.3.1 (1 behind)

React DOM: 18.3.1 → 19.3.1 (1 behind)

TypeScript: 5.9.3 → 7.0.2 (2 behind)

Vite: 5.4.21 → 8.3.4 (3 behind)

Dependencies:

3 current 9 1-behind 3 2+ behind 4 unknown

── @repo/api (node) apps/api

Frameworks:

Express: 4.22.3 → 5.3.0 (1 behind)

TypeScript: 5.9.3 → 7.0.2 (2 behind)

Vitest: 1.6.1 → 5.0.5 (4 behind)

Dependencies:

7 current 4 1-behind 4 2+ behind 4 unknown

── @repo/web (node) apps/web

Frameworks:

Next.js: 14.2.35 → 16.4.2 (2 behind)

React: 18.3.1 → 19.3.1 (1 behind)

React DOM: 18.3.1 → 19.3.1 (1 behind)

TypeScript: 5.9.3 → 7.0.2 (2 behind)

Dependencies:

2 current 6 1-behind 3 2+ behind 5 unknown

── @repo/config (node) packages/config

Frameworks:

TypeScript: 5.9.3 → 7.0.2 (2 behind)

Dependencies:

2 current 2 1-behind 5 2+ behind 0 unknown

── @repo/database (node) packages/database

Frameworks:

Prisma: 5.22.0 → 7.10.1 (2 behind)

TypeScript: 5.9.3 → 7.0.2 (2 behind)

Dependencies:

1 current 0 1-behind 3 2+ behind 1 unknown

── @repo/types (node) packages/types

Frameworks:

TypeScript: 5.9.3 → 7.0.2 (2 behind)

Dependencies:

0 current 0 1-behind 1 2+ behind 1 unknown

── @repo/ui (node) packages/ui

Frameworks:

React: 18.3.1 → 19.3.1 (1 behind)

TypeScript: 5.9.3 → 7.0.2 (2 behind)

React: 18.3.1 → 19.3.1 (1 behind)

Dependencies:

1 current 4 1-behind 1 2+ behind 1 unknown

── @repo/utils (node) packages/utils

Frameworks:

TypeScript: 5.9.3 → 7.0.2 (2 behind)

Vitest: 1.6.1 → 5.0.5 (4 behind)

Dependencies:

0 current 1 1-behind 2 2+ behind 1 unknown

Tech Stack

Frontend: React, React DOM

Meta-frameworks: Next.js

Bundlers: tsx, Turbo, Vite

CSS / UI: Autoprefixer, PostCSS, Tailwind CSS

Backend: Express

ORM / Database: Prisma, Prisma Client

Testing: Vitest

Lint & Format: ESLint, ESLint Prettier, ESLint React, Prettier, typescript-eslint

Services & Integrations

Auth: JWT 9.0.3

Databases: Prisma 5.22.0

TypeScript

v5.3.3 · strict ✔ · MIXED · target: ES2022

Build & Deploy

Package Managers: pnpm

Monorepo: npm-workspaces, pnpm-workspaces, turbo

Product Purpose Signals

Frameworks: react, nextjs

Evidence: 177

Top Signals:

- [heading] Dashboard (apps/admin/src/pages/Dashboard.tsx)

- [title] Revenue Overview (apps/admin/src/pages/Dashboard.tsx)

- [copy] workspace:* (packages/ui/package.json)

- [copy] ./dist (packages/ui/tsconfig.json)

- [copy] ./src/index.ts (packages/ui/package.json)

- [copy] @repo/config/tsconfig-base.json (packages/ui/tsconfig.json)

- [copy] @repo/ui (packages/ui/package.json)

- [copy] #3b82f6 (apps/admin/src/pages/Dashboard.tsx)

Unknowns:

- No pricing or billing evidence found.

- No integrations/connectors evidence found.

- No route structure evidence found.

Security Posture

Lockfile ✖ · .env ✔ · node_modules ✔

Platform

Native modules: turbo

Code Quality

Files: 36 · Functions: 183 · Avg complexity: 2.62 · Avg length: 21.13 lines

Max nesting: 2 · Circular deps: 0 · Dead code: 0%

God files: apps/admin/src/pages/Products (448 lines)

Database Schema

postgresql · 8 models · 1 enum

Models: Address, CartItem, Category, Order, OrderItem (+3 more)

Findings (16 errors, 11 warnings)

✖ @types/node is 6 major versions behind (spec: ^20.11.0, latest: 26.6.5).

vibgrate/dependency-major-lag in .

✖ 60% of dependencies are 2+ major versions behind in node-turborepo.

vibgrate/dependency-rot in .

✖ Node.js runtime ">=18.0.0" reached end-of-life on 2025-04-30 (latest: 24.0.0).

vibgrate/runtime-eol in .

✖ vite is 3 major versions behind (spec: ^5.0.12, latest: 8.3.4).

vibgrate/dependency-major-lag in apps/admin

✖ Vite is 3 major versions behind (current: 5.4.21, latest: 8.3.4).

vibgrate/framework-major-lag in apps/admin

✖ @types/node is 6 major versions behind (spec: ^20.11.0, latest: 26.6.5).

vibgrate/dependency-major-lag in apps/api

✖ vitest is 4 major versions behind (spec: ^1.2.1, latest: 5.0.5).

vibgrate/dependency-major-lag in apps/api

✖ Vitest is 4 major versions behind (current: 1.6.1, latest: 5.0.5).

vibgrate/framework-major-lag in apps/api

✖ @types/node is 6 major versions behind (spec: ^20.11.0, latest: 26.6.5).

vibgrate/dependency-major-lag in apps/web

✖ eslint-plugin-react-hooks is 3 major versions behind (spec: ^4.6.0, latest: 7.1.1).

vibgrate/dependency-major-lag in packages/config

✖ 56% of dependencies are 2+ major versions behind in @repo/config.

vibgrate/dependency-rot in packages/config

✖ 75% of dependencies are 2+ major versions behind in @repo/database.

vibgrate/dependency-rot in packages/database

✖ 100% of dependencies are 2+ major versions behind in @repo/types.

vibgrate/dependency-rot in packages/types

✖ vitest is 4 major versions behind (spec: ^1.2.1, latest: 5.0.5).

vibgrate/dependency-major-lag in packages/utils

✖ 67% of dependencies are 2+ major versions behind in @repo/utils.

vibgrate/dependency-rot in packages/utils

✖ Vitest is 4 major versions behind (current: 1.6.1, latest: 5.0.5).

vibgrate/framework-major-lag in packages/utils

⚠ TypeScript is 2 major versions behind (current: 5.9.3, latest: 7.0.2).

vibgrate/framework-major-lag in .

⚠ TypeScript is 2 major versions behind (current: 5.9.3, latest: 7.0.2).

vibgrate/framework-major-lag in apps/admin

⚠ TypeScript is 2 major versions behind (current: 5.9.3, latest: 7.0.2).

vibgrate/framework-major-lag in apps/api

⚠ Next.js is 2 major versions behind (current: 14.2.35, latest: 16.4.2).

vibgrate/framework-major-lag in apps/web

⚠ TypeScript is 2 major versions behind (current: 5.9.3, latest: 7.0.2).

vibgrate/framework-major-lag in apps/web

⚠ TypeScript is 2 major versions behind (current: 5.9.3, latest: 7.0.2).

vibgrate/framework-major-lag in packages/config

⚠ Prisma is 2 major versions behind (current: 5.22.0, latest: 7.10.1).

vibgrate/framework-major-lag in packages/database

⚠ TypeScript is 2 major versions behind (current: 5.9.3, latest: 7.0.2).

vibgrate/framework-major-lag in packages/database

⚠ TypeScript is 2 major versions behind (current: 5.9.3, latest: 7.0.2).

vibgrate/framework-major-lag in packages/types

⚠ TypeScript is 2 major versions behind (current: 5.9.3, latest: 7.0.2).

vibgrate/framework-major-lag in packages/ui

⚠ TypeScript is 2 major versions behind (current: 5.9.3, latest: 7.0.2).

vibgrate/framework-major-lag in packages/utils

╭──────────────────────────────────────────╮

│ Top Priority Actions │

╰──────────────────────────────────────────╯

1. Upgrade EOL runtime in node-turborepo

End-of-life runtimes no longer receive security patches and block ecosystem upgrades.

./.

>=18.0.0 → 24.0.0 (6 majors behind)

Impact: −10 drift points (runtime & EOL)

2. Fix security posture: no lockfile found

Without a lockfile, installs are non-deterministic. Run the install command to generate one and commit it.

Missing: package-lock.json, pnpm-lock.yaml, or yarn.lock

3. Upgrade Vitest 1.6.1 → 5.0.5 in @repo/api (+2 more)

4 major versions behind. Major framework drift increases breaking change risk and blocks access to security fixes and performance improvements.

./apps/api

Vitest: 1.6.1 → 5.0.5 (4 majors behind)

./packages/utils

Vitest: 1.6.1 → 5.0.5 (4 majors behind)

./apps/admin

Vite: 5.4.21 → 8.3.4 (3 majors behind)

Impact: −5–15 drift points

4. Reduce dependency rot in @repo/types (100% severely outdated)

1 of 1 dependencies are 2+ majors behind. Run `npm outdated` and prioritise packages with known CVEs or breaking API changes.

./packages/types

typescript: 5.9.3 → 7.0.2 (2 majors behind)

Impact: −5–10 drift points

5. Reduce dependency rot in @repo/database (75% severely outdated)

3 of 4 dependencies are 2+ majors behind. Run `npm outdated` and prioritise packages with known CVEs or breaking API changes.

./packages/database

@prisma/client: 5.22.0 → 7.10.1 (2 majors behind)

prisma: 5.22.0 → 7.10.1 (2 majors behind)

typescript: 5.9.3 → 7.0.2 (2 majors behind)

Impact: −5–10 drift points

╭──────────────────────────────────────────╮

│ Architecture Layers │

╰──────────────────────────────────────────╯

Archetype: nextjs (80% confidence)

Files classified: 24 (11 unclassified)

Folders classified: 8

apps/admin/src presentation 100% 4 files

apps/admin/src/pages presentation 100% 2 files

apps/api/src/middleware middleware 100% 2 files

apps/api/src/routes routing 100% 2 files

apps/web/src/app presentation 100% 4 files

apps/web/src/app/products presentation 100% 2 files

apps/web/src/app/products/[id] presentation 100% 1 file

packages/ui/src presentation 100% 6 files

Unclassified source (sample): 11

presentation 15 files drift ████████████████████ 100 risk high

routing 4 files drift ████████████████████ 100 risk high

middleware 2 files drift ███████▍░░░░░░░░░░░░ 37 risk moderate

config 2 files drift ░░░░░░░░░░░░░░░░░░░░ 0 risk none

shared 1 file drift ████████████████████ 100 risk high

╭──────────────────────────────────────────╮

│ DriftScore Summary │

╰──────────────────────────────────────────╯

DriftScore: 70/100

Risk Level: HIGH

Projects: 9

Classified: 8 nano · 1 micro · 0 small · 0 standard

Billable: 0.42 · 9 detected → 0.42 billable projects (micro-project pricing)

0.1 micro · 0.32 nano

These fractions add up across repositories, then round down to whole billable projects.

Score Breakdown

Runtime: ████████████████████ 100

Frameworks: ███████████▊░░░░░░░░ 59

Dependencies: ██████▌░░░░░░░░░░░░░ 33

EOL Risk: ████████████████████ 100

Scanned at 2026-10-20T09:13:55.988Z · 5.4s · 286 files scanned · 56 workspace files · 27 dirs

❯

Press Run to start.

Read the vg evidence docs