feat(enrichment): dependency-diff (added/removed deps) surface analyzer

[bohdansolovie]

Summary

Fixes #2020

• Add DependencyDiffFinding and a local dependencyDiff analyzer that reports direct dependency add, remove, and version-change deltas from manifest patches (package.json, requirements.txt, go.mod)
• Reuse the existing manifest line parsers via a shared collectManifestDependencyEntries helper in dependency-scan.ts — no OSV/registry calls, distinct from the CVE dependency analyzer
• Register the analyzer in the REES registry with render/docs/metadata; sync src/review/enrichment-analyzer-names.ts with the enrichment registry (dependencyDiff, hardcodedUrl, debugLeftover)
• Add review-enrichment/test/dependency-diff.test.ts covering npm add/remove/change, PyPI change, cap, and brief rendering

Test plan

• cd review-enrichment && npm run build && npm run metadata && node --test test/dependency-diff.test.ts test/analyzer-registry.test.ts
• CI validate-code

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.

[loopover-orb]

Warning

🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨🟨

⏸️ Gittensory review result - manual review recommended

_{Review updated: 2026-07-05 13:54:24 UTC}

12 files · 1 AI reviewer · no blockers · readiness 62/100 · CI green · clean

⏸️ Suggested Action - Manual Review

Review summary
This PR cleanly adds a local dependency-diff analyzer, wires it into the enrichment registry/render path, and keeps the existing CVE dependency scan behavior intact by sharing only the manifest parsing helper. The linked issue is present, the tests exercise the real parser path for add/remove/change cases, and I do not see a reachable correctness defect in the visible diff. The main gap is usability: the new analyzer keys by file internally but drops the manifest path from the finding, which makes monorepo output ambiguous.

Nits — 6 non-blocking

• nit: review-enrichment/src/analyzers/dependency-scan.ts:151 preserves per-file identity internally with `keyByFile`, but `DependencyInventoryChange` drops the file path, so two identical dependency deltas in different manifests render indistinguishably.
• nit: review-enrichment/src/analyzers/dependency-diff.ts:10 duplicates the same limit values that are also declared in the registry metadata at review-enrichment/src/analyzers/registry.ts:63, so future limit changes can drift unless one source owns them.
• nit: review-enrichment/src/analyzers/dependency-diff.ts:21 only checks `signal.aborted` before the synchronous scan; that is fine for today’s bounded local work, but the analyzer contract would be stronger if long scans had a cancellation check inside the file loop.
• Add an optional `path`/`manifestPath` field to `DependencyDiffFinding` in review-enrichment/src/types.ts and populate it from `collectManifestDependencyEntries` so rendered dependency-diff output is actionable in monorepos.
• Move the dependency-diff limits into one exported constant near review-enrichment/src/analyzers/dependency-diff.ts and reuse it from the registry descriptor to avoid metadata/runtime drift.
• Readiness score is below the configured threshold — Use the readiness panel as advisory maintainer context; the score does not block this PR.

Signal	Result	Evidence
Code review	✅ No blockers	1 reviewer
Linked issue	✅ Linked	#2020
Related work	⚠️ 3 scoped overlaps	Top overlaps are listed below; lower-confidence bulk is hidden.
Change scope	❌ 8/20	High review scope from cached public metadata (1 linked issue).
Validation posture	❌ 5/25	Preflight is holding this PR: the review lane is unavailable, so it is not ready for automated review.
Contributor workload	✅ 10/10	Author activity: 312 registered-repo PR(s), 185 merged, 9 issue(s).
Contributor context	✅ Confirmed Gittensor contributor	bohdansolovie; Gittensor profile; 312 PR(s), 9 issue(s).
Gate result	✅ Passing	No configured blocker found.

Review context

• Author: bohdansolovie
• Role context: outside_contributor
• Public audience mode: oss maintainer
• Lane context: Repository registration is not available in the local Gittensory cache.
• Public profile languages: not available
• Official Gittensor activity: 312 PR(s), 9 issue(s).
• Related work: Titles/paths share 8 meaningful terms. (issue #2029, issue #2026)
• Related work: Titles/paths share 7 meaningful terms. (issue #2023, issue #2026)
• Related work: Titles/paths share 7 meaningful terms. (issue #2033, issue #2026)
• Additional title-only matches omitted; title-only overlap does not block.

Contributor next steps

• Review top overlaps.
• Add a concise scope and risk note.
• Await review-lane availability.
• Refresh registry data or choose a registered active repo.
• Check active issues and PRs before submitting.

Signal definitions

• Related work = same linked issue, overlapping active PRs, or title/path similarity.
• Change scope = cached public metadata such as size labels, draft state, and review-burden hints.
• Validation posture = whether the PR provides enough public validation/test evidence for maintainer review.
• Contributor workload = public contributor activity and cleanup pressure, not a repo-wide quality failure.
• Contributor context = public GitHub/Gittensor identity context; non-Gittensor status is not a blocker.

_{🟩 Safe / merged · 🟦 Advisory · 🟨 Held for review · 🟥 Blocked / closed}

---

💰 Earn for open-source contributions like this. Gittensor lets GitHub contributors earn for the work they already do — register to start earning →.

Checked by Gittensory, a quiet PR intelligence layer for OSS maintainers.

• Re-run Gittensory review

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 93.06%. Comparing base (850c767) to head (2717b69).
⚠️ Report is 1 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #3500   +/-   ##
=======================================
  Coverage   93.06%   93.06%           
=======================================
  Files         300      300           
  Lines       31336    31336           
  Branches    11435    11435           
=======================================
  Hits        29164    29164           
  Misses       1517     1517           
  Partials      655      655           

Files with missing lines	Coverage Δ
src/review/enrichment-analyzer-names.ts	100.00% <ø> (ø)

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[loopover-orb]

Gittensory approves — the gate is satisfied and CI is green.