---
title: "Dependency health"
description: "Flags deprecated packages and releases (npm, Go), yanked releases (PyPI, Cargo, RubyGems), dependencies whose source repository is archived (OpenSSF Scorecard), and direct dependencies with no release in settings[\"code.dependency-health\"].staleYears years (default 3, 0 turns it off). Pinned versions from the lockfiles code.dependencies reads are looked up on deps.dev (Google's Open Source Insights) with one batch request per 100 dependencies and per 100 repositories, plus a package history only where it changes a finding, capped at settings[\"code.dependency-health\"].maxRequests (default 200). Opt-in, because it sends every pinned package name and version to another third party and relies on deps.dev's v3alpha batch API, which has no stability guarantee. Packagist is not covered."
url: https://openaudit.se/auditors/code.dependency-health/
---

# Dependency health

`code.dependency-health`

Flags deprecated packages and releases (npm, Go), yanked releases (PyPI, Cargo, RubyGems), dependencies whose source repository is archived (OpenSSF Scorecard), and direct dependencies with no release in settings["code.dependency-health"].staleYears years (default 3, 0 turns it off). Pinned versions from the lockfiles code.dependencies reads are looked up on deps.dev (Google's Open Source Insights) with one batch request per 100 dependencies and per 100 repositories, plus a package history only where it changes a finding, capped at settings["code.dependency-health"].maxRequests (default 200). Opt-in, because it sends every pinned package name and version to another third party and relies on deps.dev's v3alpha batch API, which has no stability guarantee. Packagist is not covered.

- **Engine:** Built-in
- **Targets:** Codebase
- **Areas:** Supply chain
- **Runs:** Opt-in: only when selected with --only
- **Network:** Contacts services beyond the target

## Run only this auditor

```sh
bunx @openaudit/cli . --only code.dependency-health
```

Built into openaudit; nothing to install.

## More supply chain auditors

- [Vulnerable dependencies](https://openaudit.se/auditors/code.dependencies/) (`code.dependencies`)
- [Lockfile integrity and install scripts](https://openaudit.se/auditors/code.lockfiles/) (`code.lockfiles`)
- [osv-scanner dependency scan](https://openaudit.se/auditors/code.osv-scanner/) (`code.osv-scanner`)
- [govulncheck (Go vulnerabilities)](https://openaudit.se/auditors/code.govulncheck/) (`code.govulncheck`)
- [pip-audit (Python vulnerabilities)](https://openaudit.se/auditors/code.pip-audit/) (`code.pip-audit`)
- [cargo-audit (Rust advisories)](https://openaudit.se/auditors/code.cargo-audit/) (`code.cargo-audit`)
- [npm audit](https://openaudit.se/auditors/code.npm-audit/) (`code.npm-audit`)
- [pnpm audit](https://openaudit.se/auditors/code.pnpm-audit/) (`code.pnpm-audit`)