Library and Framework Usage¶

from dataclasses import dataclass
from typing import Dict, List
import requests

@dataclass
class EvaluationResult:
    scores: Dict[str, float]
    weighted_score: float
    recommendation: str
    rationale: str

class DependencyEvaluator:
    WEIGHTS = {
        'maintenance': 0.8,
        'documentation': 0.8,
        'community': 0.5,
        'security': 0.9,
        'performance': 0.6,
        'features': 0.8,
        'license': 1.0
    }

    def __init__(self, package_registry):
        self.registry = package_registry

    def evaluate(self, package_name: str, requirements: Dict) -> EvaluationResult:
        """Evaluate a package against project requirements."""
        metadata = self.registry.fetch_metadata(package_name)

        scores = {
            'maintenance': self._evaluate_maintenance(metadata),
            'documentation': self._evaluate_documentation(metadata),
            'community': self._evaluate_community(metadata),
            'security': self._evaluate_security(metadata),
            'performance': self._evaluate_performance(metadata, requirements),
            'features': self._evaluate_features(metadata, requirements),
            'license': self._evaluate_license(metadata)
        }

        weighted_score = sum(
            scores[k] * self.WEIGHTS[k] for k in scores
        ) / sum(self.WEIGHTS.values())

        recommendation = self._generate_recommendation(scores, weighted_score)
        rationale = self._generate_rationale(scores, metadata, requirements)

        return EvaluationResult(scores, weighted_score, recommendation, rationale)

    def _evaluate_maintenance(self, metadata: Dict) -> float:
        """Score based on maintenance activity."""
        # Check release frequency
        releases = metadata.get('releases', [])
        recent_releases = [r for r in releases if self._is_recent(r['date'], months=6)]

        # Check issue resolution
        issues = metadata.get('issues', {})
        resolution_time = issues.get('avg_resolution_days', 999)

        score = 0.0
        score += 3.0 if len(recent_releases) >= 3 else len(recent_releases)
        score += 4.0 if resolution_time < 30 else 2.0 if resolution_time < 90 else 0.0
        score += 3.0 if issues.get('open_count', 999) < 50 else 1.0

        return min(10.0, score)

    def _evaluate_documentation(self, metadata: Dict) -> float:
        """Score documentation quality."""
        docs = metadata.get('documentation', {})

        score = 0.0
        score += 3.0 if docs.get('has_api_reference') else 0.0
        score += 3.0 if docs.get('has_examples') else 0.0
        score += 2.0 if docs.get('has_tutorials') else 0.0
        score += 2.0 if docs.get('has_migration_guides') else 0.0

        return score

    def _evaluate_security(self, metadata: Dict) -> float:
        """Score security posture."""
        security = metadata.get('security', {})
        vulns = security.get('vulnerabilities', [])

        # Critical failure for unpatched high/critical vulnerabilities
        critical_vulns = [v for v in vulns if v['severity'] in ['HIGH', 'CRITICAL'] and not v.get('patched')]
        if critical_vulns:
            return 0.0

        score = 10.0
        score -= len([v for v in vulns if not v.get('patched')]) * 2.0
        score += 2.0 if security.get('has_security_policy') else 0.0

        return max(0.0, score)

    def _generate_recommendation(self, scores: Dict, weighted_score: float) -> str:
        """Generate recommendation based on scores."""
        if scores['license'] < 0.5:
            return "REJECT - License incompatible"
        if scores['security'] < 6.0:
            return "CAUTION - Security concerns"
        if weighted_score >= 7.5:
            return "APPROVED"
        if weighted_score >= 6.0:
            return "ACCEPTABLE - Monitor closely"
        return "REQUIRES REVIEW"

class DependencyEvaluator {
    constructor(packageRegistry) {
        this.registry = packageRegistry;
        this.weights = {
            maintenance: 0.8,
            documentation: 0.8,
            community: 0.5,
            security: 0.9,
            performance: 0.6,
            features: 0.8,
            license: 1.0
        };
    }

    async evaluate(packageName, requirements) {
        const metadata = await this.registry.fetchMetadata(packageName);

        const scores = {
            maintenance: this.evaluateMaintenance(metadata),
            documentation: this.evaluateDocumentation(metadata),
            community: this.evaluateCommunity(metadata),
            security: await this.evaluateSecurity(metadata),
            performance: this.evaluatePerformance(metadata, requirements),
            features: this.evaluateFeatures(metadata, requirements),
            license: this.evaluateLicense(metadata.license)
        };

        const weightedScore = Object.keys(scores).reduce(
            (sum, key) => sum + (scores[key] * this.weights[key]),
            0
        ) / Object.values(this.weights).reduce((sum, w) => sum + w, 0);

        return {
            scores,
            weightedScore,
            recommendation: this.generateRecommendation(scores, weightedScore),
            rationale: this.generateRationale(scores, metadata, requirements)
        };
    }

    evaluateMaintenance(metadata) {
        const { releases = [], issues = {} } = metadata;
        const recentReleases = releases.filter(r => this.isRecent(r.date, 6));
        const { avgResolutionDays = 999, openCount = 999 } = issues;

        let score = 0;
        score += Math.min(3, recentReleases.length);
        score += avgResolutionDays < 30 ? 4 : avgResolutionDays < 90 ? 2 : 0;
        score += openCount < 50 ? 3 : 1;

        return Math.min(10, score);
    }

    evaluateSecurity(metadata) {
        const { security = {} } = metadata;
        const { vulnerabilities = [], hasSecurityPolicy = false } = security;

        // Critical failure for unpatched vulnerabilities
        const criticalVulns = vulnerabilities.filter(v =>
            ['HIGH', 'CRITICAL'].includes(v.severity) && !v.patched
        );

        if (criticalVulns.length > 0) return 0;

        let score = 10;
        score -= vulnerabilities.filter(v => !v.patched).length * 2;
        score += hasSecurityPolicy ? 2 : 0;

        return Math.max(0, score);
    }

    generateRecommendation(scores, weightedScore) {
        if (scores.license < 0.5) return "REJECT - License incompatible";
        if (scores.security < 6) return "CAUTION - Security concerns";
        if (weightedScore >= 7.5) return "APPROVED";
        if (weightedScore >= 6) return "ACCEPTABLE - Monitor closely";
        return "REQUIRES REVIEW";
    }
}

public class DependencyEvaluator {
    private final PackageRegistry registry;
    private final Map<EvaluationCriteria, Double> weights;

    public DependencyEvaluator(PackageRegistry registry) {
        this.registry = registry;
        this.weights = initializeWeights();
    }

    public EvaluationResult evaluate(String packageName, ProjectRequirements requirements) {
        LibraryMetadata metadata = registry.fetchMetadata(packageName);

        Map<EvaluationCriteria, Double> scores = new EnumMap<>(EvaluationCriteria.class);
        scores.put(MAINTENANCE, evaluateMaintenance(metadata));
        scores.put(DOCUMENTATION, evaluateDocumentation(metadata));
        scores.put(COMMUNITY, evaluateCommunity(metadata));
        scores.put(SECURITY, evaluateSecurity(metadata));
        scores.put(PERFORMANCE, evaluatePerformance(metadata, requirements));
        scores.put(FEATURES, evaluateFeatures(metadata, requirements));
        scores.put(LICENSE, evaluateLicense(metadata.getLicense()));

        double weightedScore = calculateWeightedScore(scores);
        Recommendation recommendation = generateRecommendation(scores, weightedScore);
        String rationale = generateRationale(scores, metadata, requirements);

        return new EvaluationResult(scores, weightedScore, recommendation, rationale);
    }

    private double evaluateMaintenance(LibraryMetadata metadata) {
        List<Release> recentReleases = metadata.getReleases().stream()
            .filter(r -> isRecent(r.getDate(), 6))
            .collect(Collectors.toList());

        int avgResolutionDays = metadata.getIssues().getAvgResolutionDays();
        int openCount = metadata.getIssues().getOpenCount();

        double score = 0.0;
        score += Math.min(3.0, recentReleases.size());
        score += avgResolutionDays < 30 ? 4.0 : avgResolutionDays < 90 ? 2.0 : 0.0;
        score += openCount < 50 ? 3.0 : 1.0;

        return Math.min(10.0, score);
    }

    private Recommendation generateRecommendation(Map<EvaluationCriteria, Double> scores, 
                                                  double weightedScore) {
        if (scores.get(LICENSE) < 0.5) {
            return Recommendation.REJECT_LICENSE;
        }
        if (scores.get(SECURITY) < 6.0) {
            return Recommendation.CAUTION_SECURITY;
        }
        if (weightedScore >= 7.5) {
            return Recommendation.APPROVED;
        }
        if (weightedScore >= 6.0) {
            return Recommendation.ACCEPTABLE;
        }
        return Recommendation.REQUIRES_REVIEW;
    }
}

# Production dependencies - exact versions
fastapi==0.104.1
pydantic==2.5.0
sqlalchemy==2.0.23

# Security-critical - exact versions
cryptography==41.0.7
pyjwt==2.8.0

# Development only (dev-requirements.txt)
pytest~=7.4.0
black~=23.11.0

{
  "dependencies": {
    "express": "4.18.2",
    "react": "18.2.0",
    "axios": "1.6.2"
  },
  "devDependencies": {
    "jest": "~29.7.0",
    "eslint": "~8.54.0"
  }
}

<dependencies>
    <!-- Production - exact versions -->
    <dependency>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-web</artifactId>
        <version>3.2.0</version>
    </dependency>

    <!-- Test - range versions acceptable -->
    <dependency>
        <groupId>org.junit.jupiter</groupId>
        <artifactId>junit-jupiter</artifactId>
        <version>[5.10.0,5.11.0)</version>
        <scope>test</scope>
    </dependency>
</dependencies>

# BAD: Direct library usage scattered across codebase
import requests

def get_user_data(user_id):
    response = requests.get(f"https://api.example.com/users/{user_id}")
    if response.status_code == 200:
        return response.json()
    raise Exception(f"Failed: {response.status_code}")

def create_user(user_data):
    response = requests.post("https://api.example.com/users", json=user_data)
    if response.status_code == 201:
        return response.json()
    raise Exception(f"Failed: {response.status_code}")

# GOOD: Abstracted behind interface
from abc import ABC, abstractmethod
import requests

class UserServiceError(Exception):
    """Domain-specific exception."""
    pass

class UserServiceClient(ABC):
    """Abstract interface for user service interactions."""

    @abstractmethod
    def get_user(self, user_id: str) -> dict:
        """Fetch user by ID."""
        pass

    @abstractmethod
    def create_user(self, user_data: dict) -> dict:
        """Create a new user."""
        pass

class HttpUserServiceClient(UserServiceClient):
    """HTTP implementation using requests library."""

    def __init__(self, base_url: str, auth_token: str = None, timeout: int = 10):
        self.base_url = base_url
        self.timeout = timeout
        self.session = requests.Session()
        if auth_token:
            self.session.headers.update({
                "Authorization": f"Bearer {auth_token}"
            })

    def get_user(self, user_id: str) -> dict:
        try:
            response = self.session.get(
                f"{self.base_url}/users/{user_id}",
                timeout=self.timeout
            )
            response.raise_for_status()
            return response.json()
        except requests.RequestException as e:
            raise UserServiceError(f"Failed to fetch user {user_id}: {str(e)}")

    def create_user(self, user_data: dict) -> dict:
        try:
            response = self.session.post(
                f"{self.base_url}/users",
                json=user_data,
                timeout=self.timeout
            )
            response.raise_for_status()
            return response.json()
        except requests.RequestException as e:
            raise UserServiceError(f"Failed to create user: {str(e)}")

# Usage with dependency injection
def process_user_workflow(user_client: UserServiceClient):
    """Business logic depends on abstraction, not implementation."""
    user = user_client.get_user("123")
    # ... business logic
    return user

# Easy to test with mock
class MockUserServiceClient(UserServiceClient):
    def get_user(self, user_id: str) -> dict:
        return {"id": user_id, "name": "Test User"}

    def create_user(self, user_data: dict) -> dict:
        return {"id": "new_id", **user_data}

# AWS SDK is powerful but verbose
import boto3

s3 = boto3.client('s3')

# Upload requires many parameters
s3.put_object(
    Bucket='my-bucket',
    Key='path/to/file.txt',
    Body=file_content,
    ContentType='text/plain',
    ServerSideEncryption='AES256',
    StorageClass='STANDARD_IA'
)

class StorageService:
    """Simplified facade for cloud storage operations."""

    def __init__(self, bucket: str, region: str = 'us-east-1'):
        self.bucket = bucket
        self._s3 = boto3.client('s3', region_name=region)

    def upload_file(self, content: bytes, path: str, 
                   content_type: str = 'application/octet-stream') -> str:
        """Upload file with sensible defaults."""
        self._s3.put_object(
            Bucket=self.bucket,
            Key=path,
            Body=content,
            ContentType=content_type,
            ServerSideEncryption='AES256',
            StorageClass='STANDARD_IA'  # Cost-optimized default
        )
        return f"s3://{self.bucket}/{path}"

    def download_file(self, path: str) -> bytes:
        """Download file content."""
        response = self._s3.get_object(Bucket=self.bucket, Key=path)
        return response['Body'].read()

    def delete_file(self, path: str) -> bool:
        """Delete file."""
        self._s3.delete_object(Bucket=self.bucket, Key=path)
        return True

    def list_files(self, prefix: str = '') -> list[str]:
        """List files with optional prefix filter."""
        response = self._s3.list_objects_v2(
            Bucket=self.bucket,
            Prefix=prefix
        )
        return [obj['Key'] for obj in response.get('Contents', [])]

# Usage is much simpler
storage = StorageService('my-bucket')
storage.upload_file(content, 'path/to/file.txt', 'text/plain')
files = storage.list_files('path/to/')

from abc import ABC, abstractmethod
from typing import List, Optional

class UserRepository(ABC):
    """Domain-agnostic data access interface."""

    @abstractmethod
    def find_by_id(self, user_id: str) -> Optional[User]:
        pass

    @abstractmethod
    def find_by_email(self, email: str) -> Optional[User]:
        pass

    @abstractmethod
    def find_all(self, limit: int = 100, offset: int = 0) -> List[User]:
        pass

    @abstractmethod
    def save(self, user: User) -> User:
        pass

    @abstractmethod
    def delete(self, user_id: str) -> bool:
        pass

from sqlalchemy.orm import Session

class SqlAlchemyUserRepository(UserRepository):
    """SQLAlchemy implementation of UserRepository."""

    def __init__(self, session: Session):
        self.session = session

    def find_by_id(self, user_id: str) -> Optional[User]:
        db_user = self.session.query(UserModel).filter(
            UserModel.id == user_id
        ).first()
        return self._to_domain(db_user) if db_user else None

    def find_by_email(self, email: str) -> Optional[User]:
        db_user = self.session.query(UserModel).filter(
            UserModel.email == email
        ).first()
        return self._to_domain(db_user) if db_user else None

    def save(self, user: User) -> User:
        db_user = self._to_model(user)
        self.session.add(db_user)
        self.session.commit()
        self.session.refresh(db_user)
        return self._to_domain(db_user)

    def _to_domain(self, model: UserModel) -> User:
        """Convert ORM model to domain object."""
        return User(
            id=model.id,
            email=model.email,
            name=model.name,
            created_at=model.created_at
        )

    def _to_model(self, user: User) -> UserModel:
        """Convert domain object to ORM model."""
        return UserModel(
            id=user.id,
            email=user.email,
            name=user.name
        )

from pymongo import MongoClient

class MongoUserRepository(UserRepository):
    """MongoDB implementation of UserRepository."""

    def __init__(self, client: MongoClient, database: str):
        self.db = client[database]
        self.users = self.db.users

    def find_by_id(self, user_id: str) -> Optional[User]:
        doc = self.users.find_one({"_id": user_id})
        return self._to_domain(doc) if doc else None

    def find_by_email(self, email: str) -> Optional[User]:
        doc = self.users.find_one({"email": email})
        return self._to_domain(doc) if doc else None

    def save(self, user: User) -> User:
        doc = self._to_document(user)
        self.users.replace_one(
            {"_id": user.id},
            doc,
            upsert=True
        )
        return user

    def _to_domain(self, doc: dict) -> User:
        """Convert MongoDB document to domain object."""
        return User(
            id=doc['_id'],
            email=doc['email'],
            name=doc['name'],
            created_at=doc['created_at']
        )

    def _to_document(self, user: User) -> dict:
        """Convert domain object to MongoDB document."""
        return {
            '_id': user.id,
            'email': user.email,
            'name': user.name,
            'created_at': user.created_at
        }

# dependency_updater.py
import subprocess
import json
from typing import List, Dict

class DependencyUpdater:
    def __init__(self):
        self.updates_by_type = {
            'patch': [],
            'minor': [],
            'major': []
        }

    def check_updates(self) -> Dict[str, List]:
        """Check for available updates and categorize by type."""
        result = subprocess.run(
            ['pip', 'list', '--outdated', '--format=json'],
            capture_output=True,
            text=True
        )

        outdated = json.loads(result.stdout)

        for pkg in outdated:
            update_type = self._determine_update_type(
                pkg['version'],
                pkg['latest_version']
            )
            self.updates_by_type[update_type].append(pkg)

        return self.updates_by_type

    def apply_patch_updates(self) -> bool:
        """Automatically apply low-risk patch updates."""
        if not self.updates_by_type['patch']:
            print("No patch updates available")
            return True

        packages = [pkg['name'] for pkg in self.updates_by_type['patch']]

        try:
            subprocess.run(
                ['pip', 'install', '--upgrade'] + packages,
                check=True
            )
            print(f"Applied {len(packages)} patch updates")
            return True
        except subprocess.CalledProcessError as e:
            print(f"Failed to apply updates: {e}")
            return False

    def generate_minor_update_plan(self) -> str:
        """Generate review plan for minor updates."""
        if not self.updates_by_type['minor']:
            return "No minor updates available"

        plan = ["# Minor Update Plan\n"]
        plan.append("## Packages to Review:\n")

        for pkg in self.updates_by_type['minor']:
            plan.append(f"- **{pkg['name']}**: {pkg['version']} - {pkg['latest_version']}")
            plan.append(f"  - Check changelog at: {self._get_changelog_url(pkg['name'])}")
            plan.append(f"  - Test in development environment")
            plan.append("")

        return "\n".join(plan)

    def generate_major_update_plan(self) -> str:
        """Generate migration plan for major updates."""
        if not self.updates_by_type['major']:
            return "No major updates available"

        plan = ["# Major Update Migration Plan\n"]
        plan.append("**These updates require careful planning**\n")

        for pkg in self.updates_by_type['major']:
            plan.append(f"## {pkg['name']}: {pkg['version']} → {pkg['latest_version']}\n")
            plan.append("### Migration Steps:")
            plan.append("1. Review breaking changes in changelog")
            plan.append("2. Create feature branch for migration")
            plan.append("3. Update code to handle breaking changes")
            plan.append("4. Update tests")
            plan.append("5. Test thoroughly in staging")
            plan.append("6. Document changes")
            plan.append("7. Schedule production deployment\n")

        return "\n".join(plan)

// dependency-updater.js
const { execSync } = require('child_process');
const semver = require('semver');

class DependencyUpdater {
    constructor() {
        this.updatesByType = {
            patch: [],
            minor: [],
            major: []
        };
    }

    checkUpdates() {
        try {
            const output = execSync('npm outdated --json', { encoding: 'utf8' });
            const outdated = JSON.parse(output || '{}');

            Object.entries(outdated).forEach(([name, info]) => {
                const updateType = this.determineUpdateType(
                    info.current,
                    info.latest
                );
                this.updatesByType[updateType].push({ name, ...info });
            });

            return this.updatesByType;
        } catch (error) {
            console.error('Error checking updates:', error.message);
            return this.updatesByType;
        }
    }

    determineUpdateType(current, latest) {
        try {
            if (semver.major(latest) > semver.major(current)) {
                return 'major';
            }
            if (semver.minor(latest) > semver.minor(current)) {
                return 'minor';
            }
            return 'patch';
        } catch {
            return 'unknown';
        }
    }

    applyPatchUpdates() {
        const patches = this.updatesByType.patch;

        if (patches.length === 0) {
            console.log('No patch updates available');
            return true;
        }

        const packages = patches.map(p => `${p.name}@${p.latest}`).join(' ');

        try {
            execSync(`npm install ${packages}`, { stdio: 'inherit' });
            console.log(`Applied ${patches.length} patch updates`);
            return true;
        } catch (error) {
            console.error('Failed to apply updates:', error.message);
            return false;
        }
    }

    generateMinorUpdatePlan() {
        const minors = this.updatesByType.minor;

        if (minors.length === 0) {
            return 'No minor updates available';
        }

        let plan = '# Minor Update Plan\n\n';
        plan += '## Packages to Review:\n\n';

        minors.forEach(pkg => {
            plan += `- **${pkg.name}**: ${pkg.current} → ${pkg.latest}\n`;
            plan += `  - Review changelog\n`;
            plan += `  - Test in development\n\n`;
        });

        return plan;
    }
}

module.exports = DependencyUpdater;

# test_user_client.py
import pytest
from unittest.mock import Mock, patch
from user_client import HttpUserServiceClient, UserServiceError

def test_get_user_success():
    """Test successful user retrieval."""
    # Arrange
    mock_session = Mock()
    mock_response = Mock()
    mock_response.status_code = 200
    mock_response.json.return_value = {'id': '123', 'name': 'Test'}
    mock_session.get.return_value = mock_response

    client = HttpUserServiceClient('http://api.test', 'token')
    client.session = mock_session

    # Act
    result = client.get_user('123')

    # Assert
    assert result['id'] == '123'
    assert result['name'] == 'Test'
    mock_session.get.assert_called_once()

def test_get_user_not_found():
    """Test handling of 404 response."""
    mock_session = Mock()
    mock_response = Mock()
    mock_response.status_code = 404
    mock_response.raise_for_status.side_effect = requests.HTTPError()
    mock_session.get.return_value = mock_response

    client = HttpUserServiceClient('http://api.test', 'token')
    client.session = mock_session

    with pytest.raises(UserServiceError):
        client.get_user('999')

# test_user_client_integration.py
import pytest
import responses
from user_client import HttpUserServiceClient

@responses.activate
def test_get_user_integration():
    """Test against actual HTTP behavior."""
    # Setup mock HTTP server
    responses.add(
        responses.GET,
        'http://api.test/users/123',
        json={'id': '123', 'name': 'Integration Test'},
        status=200
    )

    # Use real client (it will hit mocked endpoint)
    client = HttpUserServiceClient('http://api.test', 'token')
    result = client.get_user('123')

    assert result['id'] == '123'
    assert result['name'] == 'Integration Test'

    # Verify request was made correctly
    assert len(responses.calls) == 1
    assert responses.calls[0].request.headers['Authorization'] == 'Bearer token'

# test_user_api_contract.py
import pytest
from user_client import HttpUserServiceClient

@pytest.mark.contract
def test_user_response_structure():
    """Verify API response structure hasn't changed."""
    client = HttpUserServiceClient('http://api.test', 'token')
    user = client.get_user('123')

    # Assert contract: response must have these fields
    assert 'id' in user
    assert 'name' in user
    assert 'email' in user
    assert 'created_at' in user

    # Assert types
    assert isinstance(user['id'], str)
    assert isinstance(user['name'], str)
    assert isinstance(user['email'], str)

    # If this test fails after a library update,
    # the API contract may have changed

# Dependency Registry

Last updated: 2025-10-31

## Active Dependencies

### fastapi (v0.104.1)
- **Purpose**: Web framework for REST API
- **Owner**: @backend-team
- **Status**: ACTIVE
- **Adoption Date**: 2024-01-15
- **Last Review**: 2025-10-15
- **Next Review**: 2026-01-15
- **Security Risk**: LOW
- **Alternatives Considered**: Flask, Django REST
- **Rationale**: Modern async support, automatic OpenAPI generation
- **Usage Locations**: 
  - `src/api/`
  - `src/routes/`

### requests (v2.31.0)
- **Purpose**: HTTP client for external API calls
- **Owner**: @integration-team
- **Status**: MAINTAINED
- **Adoption Date**: 2023-06-01
- **Last Review**: 2025-09-01
- **Next Review**: 2026-03-01
- **Security Risk**: LOW
- **Known Issues**: None
- **Usage Locations**:
  - `src/integrations/payment/`
  - `src/integrations/shipping/`

## Deprecated Dependencies

### flask (v2.0.3)
- **Status**: DEPRECATED
- **Deprecation Date**: 2024-12-01
- **Replacement**: fastapi
- **Migration Deadline**: 2025-03-31
- **Migration Owner**: @backend-team
- **Migration Plan**: See docs/migrations/flask-to-fastapi.md

{
  "registry_version": "1.0",
  "last_updated": "2025-10-31",
  "dependencies": {
    "fastapi": {
      "version": "0.104.1",
      "purpose": "Web framework for REST API",
      "owner": "backend-team",
      "owner_email": "backend@company.com",
      "status": "ACTIVE",
      "adoption_date": "2024-01-15",
      "last_review": "2025-10-15",
      "next_review": "2026-01-15",
      "security_risk": "LOW",
      "known_vulnerabilities": [],
      "alternatives": ["Flask", "Django REST Framework"],
      "adoption_rationale": "Modern async support, automatic OpenAPI docs",
      "usage_locations": [
        "src/api/",
        "src/routes/"
      ],
      "tags": ["web", "api", "async"]
    },
    "requests": {
      "version": "2.31.0",
      "purpose": "HTTP client for external APIs",
      "owner": "integration-team",
      "owner_email": "integrations@company.com",
      "status": "MAINTAINED",
      "adoption_date": "2023-06-01",
      "last_review": "2025-09-01",
      "next_review": "2026-03-01",
      "security_risk": "LOW",
      "known_vulnerabilities": [],
      "usage_locations": [
        "src/integrations/payment/",
        "src/integrations/shipping/"
      ],
      "tags": ["http", "integration"]
    }
  }
}