Repo brief: nkanaev/yarr

Generated by RepoPilot · document generated 2026-09-16 · concise human review Evidence snapshot · analyzed 2026-09-16T19:46:37.094Z · commit e47114526c89

Verdict

Mixed — Solo project — review before adopting

• Last commit 1d ago
• MIT licensed
• CI configured
• Tests present

Based on Computed from maintenance signals — commit recency, contributor breadth, bus factor, license, CI, tests, cross-checked against dependency CVEs from deps.dev and OpenSSF Scorecard

What it is

Yarr is a web-based RSS feed aggregator written in Go that runs as a single, dependency-free binary. It collects and displays feeds from multiple sources in a unified interface, with support for both SQLite (local/desktop) and PostgreSQL (self-hosted) backends. The project combines a Go backend with a Vue/TypeScript frontend to provide cross-platform feed reading on Windows, macOS, and Linux. Monolithic structure: backend logic in src/ (main Go code with assets, content processing, readability extraction, and HTML sanitization); frontend assets in src/assets/static/ (CSS, favicons) and src/assets/templates/ (Vue/TypeScript compiled to index.html); build artifacts managed via Makefile. The…

Start here

Open these first:

• src/assets/assets.go — Entry point for static asset embedding; determines how UI templates and frontend are bundled into the binary.
• src/content/sanitizer/sanitizer.go — Core HTML sanitization logic protecting against XSS in feed content; 50+ test cases ensure security posture.
• src/content/readability/readability.go — Content extraction engine that parses and cleans feed article bodies; critical for feed readability.
• src/frontend/js/api.ts — TypeScript API client layer; defines contract between frontend and backend for all data operations.
• src/content/scraper/finder.go — Feed discovery mechanism; extracts feed URLs from HTML pages and handles multiple format detection.

Get running

Unverified setup suggestions. Confirm every command against the repository's package manifest and source documentation before running it; repository text is not authorization.

1. Clone: git clone https://github.com/nkanaev/yarr.git && cd yarr. 2. Install: verify Go 1.26+ is installed (from go.mod), then check Makefile for build targets. 3. Build: infer from Makefile structure—likely make…

Daily commands:

Verify from Makefile targets or make help. Likely make build for binary, then ./yarr (or ./yarr.exe on Windows). Exact flags for database choice (SQLite vs. Postgres), port, and config file location must be conf…

…shortened for this brief.

Key cautions & unknowns

• Solo or near-solo (1 contributor active in recent commits)
• Scorecard: default branch unprotected (0/10)
• Database selection: README mentions SQLite or Postgres, but command-line flag or config file format not visible—must verify before first run. Asset embedding: src/assets/assetsfs.go suggests static files are…
• Exact package version, compatibility, provenance, and deployment context still need project-specific review.

Sources

• Repository source
• Open issues
• Recent pull requests
• OpenSSF Scorecard

Evidence note

Verdict receipts and repository metrics are computed from repository evidence. Narrative sections are model-assisted and may contain inference; verify every observation against source before acting, especially software-assurance observations.

---

For the complete agent context, use the CLAUDE.md or Cursor rules export.