Struct Facts 

pub struct Facts {

    pub analyzed_version: Option<String>,
    pub latest_published: Option<DateTime<Utc>>,
    pub releases_last_year: Option<u32>,
    pub total_versions: Option<u32>,
    pub deprecated: bool,
    pub deprecated_reason: Option<String>,
    pub archived: bool,
    pub licenses: Vec<String>,
    pub vulns: Vec<Vuln>,
    pub repo: Option<String>,
    pub stars: Option<u64>,
    pub open_issues: Option<u64>,
    pub scorecard_maintained: Option<f64>,
    pub scorecard_overall: Option<f64>,
    pub top_contributor_share: Option<f64>,
    pub maintainers: Vec<String>,
    pub has_install_script: bool,
}

Everything deprot learned about one dependency. Populated by the collector from public data sources; all fields are optional so the engine degrades gracefully when a source is unavailable (e.g. no auth, offline, or the package has no linked repository).

Fields

analyzed_version: Option<String>

The concrete version these facts describe (the version deprot chose to analyze).

latest_published: Option<DateTime<Utc>>

When the most recent release was published (drives the staleness signal).

releases_last_year: Option<u32>

Number of releases published in the trailing 12 months (drives the cadence signal).

total_versions: Option<u32>

Total number of published versions ever.

deprecated: bool

The registry has marked this version (or package) deprecated.

deprecated_reason: Option<String>

Reason string attached to the deprecation, if any.

archived: bool

The source repository is archived (read-only / abandoned upstream).

licenses: Vec<String>

SPDX-ish license identifiers reported for the analyzed version.

vulns: Vec<Vuln>

Known vulnerabilities affecting the analyzed version.

repo: Option<String>

Canonical source repository (e.g. github.com/lodash/lodash), if known.

stars: Option<u64>

Repository star count, if known.

open_issues: Option<u64>

Open issue count, if known.

scorecard_maintained: Option<f64>

OpenSSF Scorecard “Maintained” check (0–10), if available.

scorecard_overall: Option<f64>

OpenSSF Scorecard aggregate score (0–10), if available.

top_contributor_share: Option<f64>

Fraction (0.0–1.0) of recent commits authored by the single most active contributor. High concentration = high bus-factor / capture risk. Optional (needs a GitHub token).

maintainers: Vec<String>

Registry maintainer/owner identities (email or login). Populated only in --deep mode.

has_install_script: bool

The package runs an install/pre/post-install script (npm) — a code-execution vector.

Implementations

impl Facts

pub fn is_unresolved(&self) -> bool

Whether the collector obtained no registry data for this package — an unknown or typosquatted name, a registry 404, or a failed/offline lookup. The collector always sets total_versions (and usually latest_published) the moment it reaches the registry, so both being absent means we never got a usable response.

Scoring uses this to avoid presenting an unassessed package as healthy: absence of data is not absence of risk.

Trait Implementations

impl Clone for Facts

fn clone(&self) -> Facts

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for Facts

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for Facts

fn default() -> Facts

Returns the “default value” for a type.

impl<'de> Deserialize<'de> for Facts

fn deserialize<__D>(__deserializer: __D) -> Result<Self, __D::Error>

where __D: Deserializer<'de>,

Deserialize this value from the given Serde deserializer.

impl Serialize for Facts

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.