The same scan, as a table
The most depended-on repositories in Prometheus
Riftmap scanned the
prometheus
GitHub organisation between 27 April and 17 May 2026 and parsed the dependency edges its manifests
declare — go.mod requires, Dockerfile FROM lines, Terraform
source blocks, Helm chart dependencies, GitHub Actions uses:
references. Across 51 active repositories (5 archived, excluded), 160 distinct repo-to-repo dependencies survived the confidence floor,
and 17 repositories (33.3%) turned out to be a
dependency of at least one sibling — an edge that is invisible from inside the repository you
are changing. Same method, same bar, and directly comparable to the nine-org scan, where the pooled
figure across 1,297 repositories was 24.7%.
Reading the two columns.Direct dependents counts distinct active sibling
repositories at or above Riftmap's 0.8 confidence floor — the same bar
impact mode applies, and the one every figure in the nine-org scan is computed on. All declared references holds that scope and drops only the floor, so the gap
between the columns isolates exactly one thing: how much of this org's coupling is
declared outright versus inferred. Across the org the floor discards 15 of 175 repo-to-repo pairs. Multiple manifests pointing at the same repository
count once. The graph above additionally draws archived repositories, so a node there can
show more arrows than either column reports.
What the floor throws away here. A repository can look larger in the graph than
it reads in this table, and these are the ones where that gap is worth naming: prometheus/busybox loses 15 (Dockerfile FROM)
. What those references have in common is that they had to be inferred rather
than read: a bare git URL sitting in a shell script or a README is a text signal rather
than a declared dependency, and a bare image name has to be guessed back to the
repository that publishes it. Riftmap scores both below the floor and never counts them.
That is a deliberate choice about what the word "dependency" is allowed to mean, and it
costs this org its highest raw numbers.
Check it rather than trust it. Both columns are recomputable from the scan itself: every parsed reference as CSV — including the ones below the
floor, each flagged — and the repository list with its
archived flags and scan timestamps. Same export the nine-org scan publishes, per org.
