depquiet

Cut through vulnerability alert noise. Surface the signal.

depquiet triages your npm audit / pip-audit / trivy / grype / Dependabot / Snyk alerts and tells you which CVEs actually matter — in seconds, not hours.

$ depquiet

depquiet scan — npm (847 packages)

✅ FILTERED: 89 alerts (92%)
   ├─ 34 unreachable — vulnerable function never imported
   ├─ 28 devDependency only — never reaches production
   ├─ 19 EPSS < 10% — no known exploits in the wild
   └─  8 community template — confirmed false positive

⚠️  REVIEW: 5 alerts
   CVE-2024-48930       lodash                    moderate   EPSS 3%
   CVE-2024-21538       semver                    moderate   EPSS 1%
   ...

🔴 ACTION REQUIRED: 3 alerts
   • CVE-2024-4068  braces  EPSS 67%  FIX: update to 3.0.3
     → src/config/parser.ts
     → src/utils/glob.ts
     Uncontrolled resource consumption in braces

Total: 97 alerts — 3 actionable | 5 review | 89 filtered
You just saved ~178 minutes of triage time.

The problem

Developers spend 3.5 hours per week triaging vulnerability alerts that are mostly noise:

• 60-80% of CVEs are unreachable — the vulnerable function is never called
• npm audit is "broken by design" — 80% false positive rate (Dan Abramov)
• Dependabot is a "noise machine" — Filippo Valsorda recommends disabling it entirely

The result? Alert fatigue. Teams either waste hours triaging noise, or ignore alerts entirely and miss the real threats.

How it works

depquiet applies four deterministic filters to separate signal from noise:

Zero false negatives by design

depquiet is conservative: it would rather let a false positive through than dismiss a real vulnerability. Python reachability uses AST parsing (immune to false positives from comments, docstrings, and strings); JS/TS uses string matching. Both only filter when there are zero real references to the package in your source code.

Install

pip install depquiet

Usage

# Auto-detect package manager and scan
depquiet

# Scan a specific directory
depquiet --path ./my-app

# Pipe in existing audit output
npm audit --json | depquiet --stdin
pip-audit --format json | depquiet --stdin
trivy fs --format json . | depquiet --stdin
grype dir:. -o json | depquiet --stdin
snyk test --json | depquiet --stdin
gh api /repos/OWNER/REPO/dependabot/alerts --paginate | depquiet --stdin

# Fully offline (skip EPSS API)
depquiet --offline

# SARIF output for GitHub Code Scanning
depquiet --sarif results.sarif

# JSON output for scripting
depquiet --json

# Custom EPSS threshold
depquiet --epss-threshold 0.05

# Use a custom config file
depquiet --config ./ci-config.yaml

CI Integration

Exit codes

• 0 — No ACTION items (safe to pass)
• 1 — ACTION items found (fail the build)

GitHub Actions (Marketplace)

- name: Triage vulnerabilities
  uses: samuelrojas-dev/depquiet@v0
  with:
    sarif: results.sarif
    epss-threshold: "0.1"

The action installs depquiet, runs it, uploads SARIF to GitHub Code Scanning, and fails the build if ACTION items are found.

GitHub Actions (manual)

- name: Triage vulnerabilities
  run: |
    pip install depquiet
    depquiet --sarif results.sarif

- name: Upload SARIF
  uses: github/codeql-action/upload-sarif@v3
  with:
    sarif_file: results.sarif

Community templates

depquiet ships with 21 built-in templates and uses nuclei-style YAML to encode community knowledge about known false positives:

id: prototype-pollution-lodash
reason: "Only defaultsDeep/merge are affected. Other lodash functions are safe."
cves:
  - CVE-2020-8203
  - CVE-2019-10744
not-imported: ["lodash.defaultsDeep", "lodash.merge"]

Contributing a template

1. Create a YAML file in templates/dismiss/
2. Add the CVE, affected package, and dismiss conditions
3. Open a PR — the community reviews and merges

Templates are the growth engine: each contribution helps every depquiet user.

Configuration

Create .depquiet.yaml in your project root (or pass --config path/to/config.yaml):

# EPSS threshold (default: 0.1 = 10%)
epss_threshold: 0.05

# Extra template directories
template_dirs:
  - ./my-templates

# Packages to always flag (never filter)
always_flag:
  - lodash
  - express

# Skip EPSS API (fully offline)
offline: false

CLI flags override config values. template_dirs from both sources are merged.

Benchmarks

Tested against realistic audit output from popular project types (offline mode, all filters active):

89% noise reduction — from 38 alerts down to 4 that actually matter. All scans complete in under 10ms.

Run the benchmarks yourself: python -I benchmarks/run_benchmark.py

Compared to

License

MIT

Contributing

depquiet is designed to grow through community templates. Every template you contribute helps thousands of developers skip a false positive.

See CONTRIBUTING.md for guidelines.