depexpira audits days-since-last-release for every package you depend on and flags abandoned ones against a policy you control — before they become an incident.
$ depexpira audit Depexpira freshness report — 12 dependencies · 2026-08-21 ☠ left-pad prod ^1.3.0 1.3.0 3800d abandoned XX old-util prod ~2.1.0 2.1.4 812d stale !! semi-active dev ^5.0.0 5.2.0 402d aging ok busy-pkg prod ^9.0.0 9.4.1 2d fresh summary: 9 fresh · 1 aging · 1 stale · 1 abandoned
Known CVEs get tooling. Quiet abandonment doesn't. Depexpira fixes that in one command.
Every dependency gets a concrete age: days since its last registry release. Resolved versions come straight from your lockfile.
Set warn / stale / abandoned thresholds to match your risk appetite. Ignore the "done by design" packages explicitly.
depexpira audit --fail-on stale exits non-zero when anything crosses the line. Wire it into publish flows.
The freshness auditor cannot itself go stale: no runtime dependencies, Node 18+ built-ins only, offline test suite.
Three thresholds. Move them in depexpira.config.json.
| Status | Meaning | Threshold |
|---|---|---|
| fresh | Released recently — nothing to do | < 365 days |
| aging | Worth watching at your next upgrade pass | ≥ 365 days |
| stale | Likely unmaintained — plan a replacement | ≥ 730 days |
| abandoned | Treat as supply-chain risk | ≥ 1095 days |
No config required. Run it inside any project with a package.json.
$ npm install --global depexpira $ cd your-project $ depexpira audit # commit-friendly report → DEP-FRESHNESS.md $ depexpira audit --format md --write # CI gate $ depexpira audit --fail-on stale && npm publish
Scheduled audits across all your repositories, alerting when a dependency crosses a policy line, org-wide policy-as-code, and dashboard-ready JSON history.
License via Gumroad — link placeholder.
Get Pro