Blog posts from 2025 covering dependency drift, security, and DevOps.
Vibgrate works out of the box with sensible defaults, but every team has different risk tolerances. Learn how to customise thresholds, enable or disable extended scanners, and tailor the configuration to match your organization's upgrade policies.
Peter ChapmanDifferent consumers need different formats. Developers want terminal output. CI systems want SARIF. Managers want Markdown. Automation pipelines want JSON. Vibgrate supports all four — here's when to use each and how to generate them.
Luke GeavesA single scan tells you where you are. A baseline tells you where you started — and whether you are getting better or worse. Learn how to use vibgrate baseline to establish your starting point and track drift trends over weeks and months.
Peter ChapmanMost real-world codebases are not single-language. A typical organization has Node frontends, .NET or Java backends, Python data pipelines, and shared infrastructure. Vibgrate scans all of them in a single pass — here is how it works and what it detects.
Luke GeavesAI coding assistants have evolved from autocomplete tools into autonomous agents capable of multi-file refactoring and cross-language migration. We examine the state of agent-driven code migration in late 2025 and what it means for teams managing large legacy codebases.
Luke GeavesYou ran your first scan — now what? This guide walks through every section of the Vibgrate report output, explains what each finding means, and shows how to turn the Priority Actions list into concrete backlog items.
Peter ChapmanVibgrate reduces your entire codebase's upgrade health to a single number. But how is that number calculated, what does each component measure, and how should you interpret it? This post breaks down the Upgrade Drift Score in detail.
Peter ChapmanYou do not need to install anything, create an account, or configure a single file. One command gives you a complete picture of your codebase's upgrade health. Here is how to run your first Vibgrate scan and what the output means.
Luke GeavesEvery codebase ages. Dependencies fall behind, runtimes approach end-of-life, and frameworks ship breaking changes that nobody applies. This silent accumulation of upgrade debt — what we call upgrade drift — is one of the most underestimated risks in modern engineering. Here's what it is, why it matters, and how to measure it.
Peter ChapmanOWASP's refreshed guidance on software supply chain security puts outdated components and transitive dependency risks front and centre. Here is what engineering teams need to know — and do — to stay ahead of the curve heading into 2026.
Luke GeavesDependency drift — the growing gap between the versions you run and the versions you should run — is silently accumulating technical debt across the industry. New research shows the average enterprise project is 18 months behind on critical dependencies, and the cost of catching up is rising fast.
Peter Chapman