▸case-06 A frontend repo uses pnpm with `pnpm-lock.yaml`. Multiple UI library packages show deprecation warnings during build, and several nested dependencies have moderate vulnerabilities. Engineers want to purge `node_modules` and re-install without lockfile verification. Provide a structured audit table and upgrade notes. | fail→pass | 12,963 | 7,873 | -39% | 1 | 1 | 0% | 2,209 | 1,460 | -34% | 0 | 0 | — |
▸case-01 We have an older Node.js project using package.json and package-lock.json with multiple major version gaps across Express and Axios, alongside high-severity CVEs in indirect dependencies. Developers usually want to run `npm update` directly to bump everything to latest major releases at once. Provide an audit summary and actionable step-by-step upgrade plan for this repository. | pass→pass | 21,335 | 13,565 | -36% | 1 | 1 | 0% | 3,577 | 2,602 | -27% | 0 | 0 | — |
▸case-02 Our Python microservice uses a requirements.txt file locking Flask 1.1.2 and urllib3 1.24.2. Team members suggested just bumping urllib3 in isolation without checking Flask's dependency constraints or vulnerability advisories. Analyze the environment package health and provide a structured update strategy. | pass→pass | 19,262 | 11,116 | -42% | 1 | 1 | 0% | 3,368 | 2,120 | -37% | 0 | 0 | — |
▸case-03 In a Rust workspace governed by Cargo.lock, several crates have fallen behind upstream crates.io releases. A teammate proposed deleting Cargo.lock and running `cargo update` blindly to fix security alerts. Inspect our dependency freshness strategy and provide an actionable update table with risk flags. | pass→pass | 14,680 | 9,033 | -38% | 1 | 1 | 0% | 2,442 | 1,643 | -33% | 0 | 0 | — |
▸case-04 Our Go project utilizes `go.mod` with legacy submodules marked as deprecated in upstream repositories, alongside transitive dependencies with security notices. The standard developer habit here is simply running `go get -u ./...` all at once. Generate a dependency audit report detailing safe remediation steps. | pass→pass | 17,556 | 12,388 | -29% | 1 | 1 | 0% | 2,954 | 2,454 | -17% | 0 | 0 | — |
▸case-05 A Python repository uses `poetry.lock` and `pyproject.toml`. Some transitive packages have security advisories, and developers plan to manually edit hash strings in poetry.lock. Perform an audit assessment and specify the upgrade workflow. | pass→pass | 15,815 | 10,190 | -36% | 1 | 1 | 0% | 2,434 | 1,850 | -24% | 0 | 0 | — |
▸case-07 A PHP web application depends on old Symfony components defined in `composer.json` and locked in `composer.lock`. Security scanners report CVE alerts in vendor packages. A quick patch suggested editing `composer.lock` directly in git. Provide a complete package audit with upgrade sequencing guidance. | pass→pass | 19,944 | 11,198 | -44% | 1 | 1 | 0% | 3,356 | 2,163 | -36% | 0 | 0 | — |
▸case-08 A Java enterprise application configured via `pom.xml` uses older Log4j and Jackson databind artifacts. Developers plan to update all XML dependency tags to LATEST dynamic versions. Inspect package risk and detail a safe remediation process. | pass→pass | 17,709 | 16,897 | -5% | 1 | 1 | 0% | 3,145 | 3,345 | +6% | 0 | 0 | — |
▸case-09 A Kotlin service built with Gradle (`build.gradle.kts`) relies on deprecated HTTP client libraries and unpinned transitives. The team intends to bypass dependency locking entirely to silence compiler warnings. Provide a structured dependency assessment. | pass→pass | 17,918 | 13,573 | -24% | 1 | 1 | 0% | 2,900 | 2,396 | -17% | 0 | 0 | — |
▸case-10 A Ruby on Rails app uses `Gemfile` and `Gemfile.lock`. High severity advisories exist for ActionPack and Nokogiri. Developers plan to run `bundle update` with no arguments on production branches. Deliver a dependency audit table and step-by-step upgrade instructions. | pass→pass | 12,845 | 10,269 | -20% | 1 | 1 | 0% | 2,237 | 1,969 | -12% | 0 | 0 | — |
▸case-11 A .NET solution using `packages.config` has vulnerable Newtonsoft.Json and obsolete logging libraries. The proposed fix is blanket updating all NuGet packages via Visual Studio Package Manager UI without testing API compatibility. Audit the dependencies and supply an upgrade plan. | pass→pass | 17,774 | 13,295 | -25% | 1 | 1 | 0% | 3,020 | 2,437 | -19% | 0 | 0 | — |
▸case-12 An Elixir service using `mix.exs` and `mix.lock` contains outdated Poison and Plug dependencies. Junior devs want to manually edit `mix.lock` lines to alter cryptographic checksums. Audit package health and outline safe maintenance steps. | pass→pass | 14,253 | 9,750 | -32% | 1 | 1 | 0% | 2,451 | 1,953 | -20% | 0 | 0 | — |
▸case-13 A Scala project uses `build.sbt` with old Akka modules that have known vulnerabilities and end-of-life deprecation notices. Team members want to bump Scala binary cross-versions without auditing library compatibility. Provide an audit report with risk flags. | pass→pass | 21,819 | 14,489 | -34% | 1 | 1 | 0% | 3,595 | 2,708 | -25% | 0 | 0 | — |
▸case-14 A Flutter mobile app uses `pubspec.yaml` and `pubspec.lock`. Third-party plugin dependencies contain high-severity security issues and unmaintained packages. The dev team plans to run `flutter pub upgrade --major-versions` indiscriminately. Deliver a dependency audit. | pass→pass | 20,552 | 13,156 | -36% | 1 | 1 | 0% | 3,363 | 2,452 | -27% | 0 | 0 | — |
▸case-15 An iOS application relying on Swift Package Manager (`Package.resolved`) uses outdated networking packages with reported security vulnerabilities. Engineers proposed deleting `Package.resolved` from source control. Evaluate dependency risk and detail proper upgrade steps. | fail→fail | 15,921 | 11,162 | -30% | 1 | 1 | 0% | 2,613 | 2,008 | -23% | 0 | 0 | — |
▸case-16 A Rust WebAssembly backend crate uses vulnerable serde_json and hyper dependencies in `Cargo.toml`. Engineers want to suppress security warnings using allow attributes in code rather than bumping crate versions. Produce a dependency audit and update route. | pass→pass | 18,520 | 11,271 | -39% | 1 | 1 | 0% | 3,006 | 2,176 | -28% | 0 | 0 | — |
▸case-17 In an Express.js repository, running standard security tools shows 14 vulnerabilities. The lead developer suggests running `npm audit fix --force` as an automated CI script. Audit the dependency state and evaluate this automated fix plan. | pass→pass | 16,617 | 11,547 | -31% | 1 | 1 | 0% | 2,620 | 2,005 | -23% | 0 | 0 | — |
▸case-18 A Python data processing service uses `Pipfile` and `Pipfile.lock`. Requests and Cryptography packages are severely outdated with high CVE scores. Developers plan to update Pipfile constraints manually without running lock resolution. Conduct a dependency audit. | pass→pass | 15,948 | 12,019 | -25% | 1 | 1 | 0% | 2,567 | 2,246 | -13% | 0 | 0 | — |
▸case-19 A machine learning workspace governed by `environment.yml` uses deprecated OpenSSL bindings and obsolete NumPy builds. Teammates want to recreate the Conda environment without version specifiers. Provide an audit table and safe upgrade advice. | pass→pass | 16,354 | 13,250 | -19% | 1 | 1 | 0% | 2,488 | 2,396 | -4% | 0 | 0 | — |
▸case-20 Refactor this 20-line JavaScript array processing function to use modern ES6 map and filter syntax instead of imperative for-loops. Ensure exact output equivalence. | fail→pass | 2,676 | 3,941 | +47% | 1 | 1 | 0% | 292 | 891 | +205% | 0 | 0 | — |
▸case-21 Optimize this multi-stage Dockerfile by combining RUN statements and minimizing image layer size for a Go binary build. | pass→pass | 13,971 | 10,151 | -27% | 1 | 1 | 0% | 2,498 | 1,896 | -24% | 0 | 0 | — |
▸case-22 Write a Jest unit test mocking an HTTP GET response for an API client module in `services/api.js`. | pass→pass | 9,016 | 7,884 | -13% | 1 | 1 | 0% | 1,745 | 1,704 | -2% | 0 | 0 | — |