MergeStat

If you haven't bumped into @mergestat, it's very interesting! It enables you to write SQL queries over your git history to find out lots of useful things, such as: - Versions of langs/libs - Which repos had commits - Which repos use Jenkins for CI/CD mergestat.com

Grafana community spotlight 💫 @patrickdevivo of @mergestat explains how to monitor CVE security vulnerabilities with Grafana, MergeStat, and OSV-Scanner. Today on the blog: grafana.com/blog/2023/05/2…

Today we're live on the @grafana blog! Learn how to manage CVE security vulnerabilities with Grafana, @mergestat, and @Google's OSV-Scanner grafana.com/blog/2023/05/2…

Peter Freiberg wrote a great post, "Finding A Pin in a Docker Stack 🪡" (get it? 🙂), showing how @mergestat can identify common issues in Dockerfiles across an org "finding stale Dockerfiles" is a *type* of question our new UI experience (coming soon) can answer quickly!

Terraform Meets SQL to Secure Cloud Infrastructure ☁️ Use @tfsec_dev + @grafana + @mergestat to understand, explore and report on misconfigurations across @HashiCorp terraform repos! docs.mergestat.com/blog/2023/05/1…

we're putting together a @mergestat demo site that indexes the top 500 public GitHub repos by star count for ~20 languages. Playing with some questions - like how many of those repos use @nextjs? (or rather...how many have a file that looks like a nextjs config)

was very cool to hear of a @mergestat user joining CODEOWNERS content from their repos with vulnerability data from @AquaSecTeam's trivy, to get a report of CRITICALs CVEs *by team* across an org 😎

pinning to specific @Docker images is important for deterministic builds, but can be overlooked when maintaining dependency and security updates - @mergestat can be used to query Dockerfiles across an organization to better understand pinning practices 📍 docs.mergestat.com/blog/2023/04/2…

Today we're thrilled to announce @mergestat v2, a significant improvement to how we extract and sync data from git repos -> SQL! tl;dr we're running @Podman_io containers defined externally to run an analysis on a repo and store the results in postgres docs.mergestat.com/blog/2023/04/2…

I've been using @deno_land again to implement data syncs, in a new approach we've been working on @mergestat - and it's been really slick! top-level await is 👌

We spent some time playing with git blame data, and came up with some interesting queries! We also learned a bit about the @MongoDB source code running these queries docs.mergestat.com/blog/2023/03/3…

until today, @mergestat has pretty much only supported repos on @github (and local repos on disk). Today we're very excited to add support for @Bitbucket and @gitlab as well🎉 docs.mergestat.com/blog/2023/03/1…

Are We Vulnerable? (e.g. Log4Shell) - Identifying Open-Source Library Risk Using @mergestat (Part 2) 🎉 docs.mergestat.com/blog/2023/03/0…

Recently, someone asked how they could use @mergestat to query the contents of their YAML files (across many git repos) to validate configs. We put together an interesting (weird? 😃) solution, using PostgreSQL, plv8, JavaScript, and MergeStat. docs.mergestat.com/blog/2023/03/0…

👀 @mergestat docs.mergestat.com/blog/2023/02/1…

@jaosorior told us about @renovatebot some time ago, and we ended up introducing it into @mergestat repos! Interestingly - querying for the presence of it has been a use case that's popped up several times now (across hundreds or thousands of codebases) docs.mergestat.com/blog/2023/02/1…

put together some example SQL for managing open-source vulnerabilities (CVEs) in @mergestat using @GrypeProject and trivy (@AquaSecTeam). for us, it's been valuable to see this data *across* our codebases and in some cases join it with git activity docs.mergestat.com/blog/2023/02/1…

We're excited to announce that the most recent releases of MergeStat now include basic data visualization capabilities! docs.mergestat.com/blog/2023/01/3…

Spent some time today putting together a CLI that uses @OpenAI codex models for natural language -> SQL: github.com/mergestat/scri… (taking what we learned doing it in @mergestat-lite), but generalizing for any SQL database