depexpira

Dependency freshness auditor — days-since-last-release for every dependency, with policy-based flags for abandoned packages.

Zero runtime dependencies · Node 18+ · Open-core (MIT)

---

The problem

npm audit tells you about known vulnerabilities. It says nothing about the slowest failure mode in the JavaScript ecosystem: quiet abandonment. A package can be vulnerability-free and still be dead — last published four years ago, unmaintained when the next CVE or Node breaking change lands, and sitting in your package.json anyway.

Most teams only discover this during an incident. Depexpira makes it a number you can see on every audit: how many days since each of your dependencies last released, checked against thresholds you control.

Install

npm install --global depexpira

Requires Node 18+. No other dependencies — the tool itself can't rot.

30-second quickstart

cd your-project
depexpira audit

That's it. Depexpira reads your package.json (and resolved versions from your lockfile), queries the npm registry, and prints a freshness report:

• Auditing 5 dependencies against https://registry.npmjs.org
Depexpira freshness report — 5 dependencies · 2026-08-22T08:02:21.822Z

    package    dep   wanted  latest  age    status
--  ---------  ----  ------  ------  -----  ---------
☠   left-pad   prod  ^1.3.0  1.3.0   3057d  abandoned
☠   ms         prod  ^2.1.3  2.1.3   2082d  abandoned
☠   node-uuid  dev   ^1.4.8  1.4.8   3440d  abandoned
ok  chalk      prod  ^5.3.0  6.0.0   26d    fresh
ok  semver     prod  ^7.6.0  7.8.5   63d    fresh

summary: 2 fresh · 0 aging · 0 stale · 3 abandoned · 0 unknown
• worst status: abandoned

Gate CI on it:

depexpira audit --fail-on stale && npm publish

Or write a commit-friendly report:

depexpira audit --format md --write   # → DEP-FRESHNESS.md

Commands

Command	What it does
depexpira audit	Freshness report for every dependency (default command)
depexpira init	Create a depexpira.config.json with default policy
depexpira policy	Print the effective policy thresholds as JSON

Options

--format <f>        table | md | json          (default: table)
--write             write the report to disk (DEP-FRESHNESS.md / .json)
--out <file>        custom output path with --write
--fail-on <status>  warn | stale | abandoned — exit non-zero on violation
--no-dev            skip devDependencies
--ignore <pkg>      skip a package (repeat the flag or comma-separate;
                    adds to the config ignore list)
--registry <url>    registry base URL override
--cwd <dir>         audit a different project directory

Config

Run depexpira init, then tune depexpira.config.json:

{
  "registry": "https://registry.npmjs.org",
  "includeDevDependencies": true,
  "policy": {
    "warnDays": 365,
    "staleDays": 730,
    "abandonedDays": 1095
  },
  "ignore": ["pinned-internally"],
  "report": { "file": "DEP-FRESHNESS.md", "format": "md" },
  "concurrency": 8
}

How statuses work

Status	Meaning	Default threshold
fresh	Released within the warn window	< 365 days
aging	No release in a while — worth watching	≥ 365 days
stale	Likely unmaintained; plan a replacement	≥ 730 days
abandoned	Almost certainly dead; treat as risk	≥ 1095 days
unknown	Registry unreachable or package unpublished	—

Thresholds are yours to move: a fast-moving monorepo might flag at 90/180/365; a stable enterprise codebase might use 730/1095/1825.

Honest limits

• Freshness is a proxy, not proof: some healthy packages release rarely by design ("done" is a valid state). That's what the ignore list is for.
• The audit reflects registry publish times, not git activity or maintainer responsiveness.
• One flag, one signal: depexpira won't replace npm audit, license scanning, or lockfile diffing — it complements them.

Pro

For teams that want this continuous instead of on-demand: Depexpira Pro ($9/month) adds scheduled audits across many repositories with a consolidated dashboard-ready JSON feed, Slack/webhook alerts when a dependency crosses a policy line, and policy-as-code review for org-wide thresholds. License via Gumroad — link placeholder.

The CLI itself is MIT-licensed open source and always will be. Pro pays for hosting the scheduler, alert delivery, and multi-repo history.

Development

git clone https://github.com/stealth-alpha/depexpira
cd depexpira
npm test

Tests run fully offline against fixtures (node --test, no network needed).

License

MIT — see LICENSE.

---

Part of the stealth-alpha toolkit — eight zero-dependency CLIs for release automation, agent security, and repo hygiene.