Dependency Risk Note Analyzer

How Dependency Risk Note Analyzer works

Press Load model once: your browser downloads Gemma 4 E2B instruction-tuned (web build) (2.0 GB) from this site and keeps it in its cache. Then add your text and press Analyze locally. The model runs on this device using your graphics card, so nothing you enter is sent to a server. Until the model is loaded, or if your device cannot run it, the tool falls back to a simple keyword check and labels the result as the fallback.

Gemma 4 E2B instruction-tuned (web build) is a small open language model from Google. The tool sends it the instruction below plus your text, asks for a JSON answer with fixed fields, and shows each field as a card. It runs at temperature 0, so the same input gives the same answer on the same device, though different graphics cards can word it slightly differently.

Inputs longer than 6,000 characters are cut to that length before they reach the model, and the result says so. The model only sees what you paste: it does not look anything up.

The instruction the model gets

You read dependency notes (audit output, Dependabot alerts, upgrade notes, package lists) and turn them into an action list. For each package mentioned, note the risk type (known vulnerability, unmaintained or abandoned, outdated major version, end-of-life runtime, licence concern, breaking upgrade) and whether a fixed version is named. Copy package names, versions, CVE IDs and severities exactly as written; never invent CVE numbers, versions or advisories.

What it returns

• Risk by package: One entry per package, written as 'package version → risk type: what the note says'.
• Fix first: The single item to handle first and why, based on the severities and facts in the note.
• Upgrade actions: Upgrades or replacements the note supports, with the versions it names.
• Still to check: What the note does not say that you would need to check (whether the vulnerable code path is used, test coverage, breaking changes).

Worked example

The model's output for the built-in sample, recorded on a desktop browser. Your run may word things slightly differently.

Dependency note: express 4.18.2 transitive cookie package flagged high severity, patch available in express 4.19.2. Service also pins node 18 and uses abandoned request package.

Risk by package

express 4.18.2 → known vulnerability: patch available in express 4.19.2 request → unmaintained or abandoned

Fix first

Upgrade express from 4.18.2 to 4.19.2 to address a high-severity vulnerability.

Upgrade actions

Upgrade express to 4.19.2

Still to check

Whether the vulnerable code path in express is used Impact of upgrading express on other dependencies

The model

The files are served from this site, versioned so a cached copy is never stale. Nothing is fetched from a third party while you use the tool.

Limitations

• Small language models make mistakes: they can miss an item, merge two, or state something more confidently than the text supports. Check the result against your input before you rely on it.
• It needs WebGPU and about 8 GB of memory, so it is offered on desktops and laptops, not on phones and tablets. Devices that cannot run it get the keyword fallback, clearly labelled.
• Results describe the input you gave, not the real-world situation behind it. Review them yourself before acting.

Good uses

• Triage developer workflow notes before deeper review
• Prepare consistent labels for repeat workflows
• Reduce manual sorting on small batches
• Keep sensitive drafts in the browser preview