DependTriage

Rank Dependabot noise by real risk for small teams

Problem

Small projects have no private registry or dedicated engineer vetting versions, yet Dependabot opens a dozen PRs a day and CVE counts are overwhelming. Teams either blind-merge everything or tune it all out, and developers are openly asking how a small team should pragmatically decide what to upgrade first and what can safely wait.

Solution

Connect a GitHub repo and pull dependency-update PRs plus security advisories, then score each update by direct vs transitive dependency, runtime exposure, and history of breaking changes. Every item gets a Now / Can Wait / Ignore label, and each week the team receives a 10-minute upgrade brief instead of a wall of PRs.

Users

Teams of 2–15 people, solo open-source maintainers, and early startups without a platform engineering function

MVP

Read-only GitHub App OAuth; parse package-lock, go.mod, and requirements files; rank by direct/transitive status and runtime exposure; weekly digest email plus one-click mute of low-risk PRs; start with JavaScript and Python only

Revenue

Per-repo subscription with one free repo; $19/month for small teams; add a paid upgrade-risk report for compliance-sensitive customers

Why now

Dependency counts and CVE disclosures keep rising while only big companies have platform teams; GitHub APIs and advisory feeds are open enough that one developer can ship the triage logic, where the value is policy, not compute