GAnalytics

The idea

Most analytics products decide up front what a "dataset" is, then make you bend your data to fit. GAnalytics turns that around. Each ecosystem dataset arrives as a module.

What it actually measures

The first module is CVE Analytics, and it is live. It computes how the CVE programme behaves rather than what any single record says: how fast CNAs move from reservation to disclosure, how complete their records are, where scoring diverges between sources, and how long information takes to propagate downstream.

It is computed from the full git history of cvelistV5, plus NVD, OSV, GHSA, EPSS, KEV and the CNA partner list. The git history matters. A record's current state tells you what a CNA concluded. The history tells you how long it took them and what they changed their mind about.

Reproducibility is the product

Every published figure is pinned to a snapshot date and a transform version, and carries a provenance flag.

This is the constraint everything else is built around. Upstream records get revised, withdrawn and rescored constantly. An analytics page that quietly changes its numbers when that happens is not measurement, it is a moving target with a chart on it. Pinning means a number published in March still resolves in September, and still resolves to the same thing.

The other modules

Seven more are specified and ship as public teaser pages: Package Analytics, Patch Adoption Half-Life, Deprecation Reality, Fork Dynamics, Corporate Concentration, Spec Adoption Curves, and AI-Assisted Contribution.

They are teasers on purpose. The module boundary has to hold before anything built on top of it is worth writing, and eight half-built pipelines would prove nothing about the boundary.

One exception runs already, and only its collection half. Patch Adoption Half-Life collects npm data now, because that module alone cannot be backfilled: npm serves per-version download counts for a trailing week and nothing else, so a day not collected is a day gone for good. Collecting is not the same as analysing, and its pages stay teasers until there is something worth showing.

Principles it is built to

UI parity is absolute. Everything available through the API is available through the UI, including operations and admin. Nothing ships as API-only or CLI-only.

That costs more up front, every time. It is also the difference between a tool the maintainers can run and a tool anyone can run.

Stack

A pnpm and Turborepo monorepo. Separate API, web and worker apps. Temporal for the pipelines, with the connectors, transforms and metrics split into their own packages behind a module SDK, so a new module is a package rather than a fork of the pipeline.

A Playwright smoke suite gates deploys.

Status

In progress. The module boundary has to be right before anything built on top of it is worth writing, so that's where the work is.