dep-age 1.0.0

Cross-language dependency age analyzer — scan lock files for staleness, CVEs, and update urgency

dep-age

Cross-language dependency age analyzer — scan lock files & manifests for staleness, CVEs, and update urgency.

One command to answer: "How old and risky are my dependencies?"

---

Features

• 6 ecosystems: npm · pip · gem · go · cargo · composer
• Lock files + manifests: scans both resolved lock files and project manifests (package.json, pyproject.toml, Cargo.toml, go.mod, composer.json)
• Async parallel registry lookups with local caching
• CVE checking via OSV.dev API
• Age classification: Fresh / Aging / Stale
• Urgency scoring: None → Critical
• Health score: 0–100
• Multiple outputs: Rich terminal, JSON, Markdown, CSV, SVG badge
• CI gating: --max-age and --max-cves flags exit non-zero on violations

Installation

pip install dep-age

Quick Start

# Auto-detect lock files in current directory
dep-age scan

# Scan specific file
dep-age scan package-lock.json

# JSON output
dep-age scan --format json --output deps.json

# CI gating: fail if any dep > 2 years or has CVEs
dep-age scan --max-age "2 years" --max-cves 0

# Generate freshness badge
dep-age badge --output dep-badge.svg

CLI Reference

dep-age scan [PATH...] [OPTIONS]

Arguments:
  PATH    Lock file(s) or directory to scan (default: current directory)

Options:
  -f, --format TEXT     Output: terminal, json, markdown, csv
  -o, --output TEXT     Write output to file
  --outdated            Show only outdated dependencies
  --cves-only           Show only dependencies with CVEs
  --older-than TEXT     Filter by age (e.g. "1 year", "6 months")
  --max-age TEXT        CI gate: exit 1 if any dep exceeds this age
  --max-cves INT        CI gate: exit 1 if total CVEs exceed this
  --ignore TEXT         Comma-separated packages to skip
  --offline             Use cached data only, no network requests
  -V, --version         Show version

Supported Files

Ecosystem	Lock Files	Manifest / Config
npm	package-lock.json, yarn.lock, pnpm-lock.yaml	package.json
Python	requirements.txt, Pipfile.lock, poetry.lock	pyproject.toml
Ruby	Gemfile.lock	—
Go	go.sum	go.mod
Rust	Cargo.lock	Cargo.toml
PHP	composer.lock	composer.json

CI Integration

# GitHub Actions
- name: Dependency audit
  run: |
    pip install dep-age
    dep-age scan --max-age "2 years" --max-cves 0

Development

git clone https://github.com/dep-age/dep-age.git
cd dep-age
pip install -e ".[dev]"
ruff check src/ tests/
pytest --cov=dep_age --cov-fail-under=95

License

MIT