Paste your lockfile or dependency manifest and find outdated, abandoned, and risky dependencies before they break production. Covers npm, PyPI, Go, Rust, Maven, and CVE databases. No signup, no install.
JavaScript & Node.js
npm Package Health Checker
Finds deprecated packages (with author’s deprecation message), abandoned packages (no update in 2y+), single-maintainer risk, and weekly download trends.
Dependency Vulnerability Scanner
Full CVE report from OSV.dev. Shows severity, CVSS score, affected versions, and fix versions. Supports package-lock.json and requirements.txt.
Python
Go
Rust
Java & JVM
Related tools
- → Infrastructure Security Scanners — Terraform, K8s YAML, Docker Compose, GitHub Actions
- → EOL Timeline — see when your entire stack hits end-of-life
- → Health badges — embed A–F dependency health grades in your README
- PHP Composer Package Health Checker — PHP (Packagist) — check any Composer package for abandonment status and latest version.
- NuGet Package Health Checker — .NET (NuGet) — check any NuGet package for deprecation and active maintenance.
- Ruby Gems Health Checker — Ruby (RubyGems) — check any gem for latest version and download activity.
- package.json Batch Health — paste your entire package.json and get health grades for all npm dependencies at once.
- requirements.txt Batch Health — paste your entire requirements.txt and get health grades for all Python packages at once.
- Maven pom.xml Batch Health — paste your pom.xml dependencies block and get health grades for all Maven dependencies at once.
- Cargo.toml Batch Health — paste your Cargo.toml dependencies and get health grades for all Rust crates at once.
- go.mod Batch Health — paste your go.mod and get health grades for all Go modules at once via the Go proxy.
- Gemfile Batch Health — paste your Gemfile.lock and get health grades for all Ruby gems at once via RubyGems.org.
- composer.json Batch Health — paste your composer.json and get health grades for all PHP packages at once via Packagist.
- pyproject.toml Batch Health — paste pyproject.toml and get health grades for all Python deps. Supports PEP 517 and Poetry formats.
- .csproj NuGet Batch Health — paste your .csproj XML and get health grades for all NuGet packages at once via NuGet.org.
- Gradle build.gradle Health — paste your build.gradle (Groovy or Kotlin DSL) and get health grades for all Java dependencies via Maven Central.
Also see: Security Scanners · Developer Utilities · All 84 free tools →
Also explore: 195+ Reference Guides
What Is Dependency Health and Why Does It Matter?
Every software project depends on third-party libraries. Over time, those libraries evolve: maintainers retire, security vulnerabilities are discovered, breaking changes are introduced, and package registries flag packages as deprecated. When you stop tracking the health of your dependencies, technical debt accumulates silently — until a CVE advisory drops, a deprecated package fails a CI build, or a breaking change hits production.
Dependency health is the practice of continuously evaluating whether your pinned dependencies are current, maintained, and free of known vulnerabilities. It sits alongside code review and automated testing as a core part of a mature software development lifecycle. The checkers on this page make that practice easy: paste your manifest, get a grade per package, and know exactly where the risk is.
The Four Dimensions of Dependency Risk
1. Version Currency
How far behind is your pinned version from the latest release? A package one patch behind is low risk. A package two major versions behind may have accumulated dozens of breaking API changes, unpatched CVEs, and deprecated APIs that are now actively removed. Tracking version currency lets you prioritise upgrade work before the gap becomes painful.
2. Maintenance Status
A package that hasn't received a commit or release in 18–24 months is a risk signal even if it has no known CVEs. Unmaintained packages accumulate technical debt that nobody is paying down. They often have open bug reports with no fixes, fail silently on new language runtimes, and disappear from registries without warning. The checkers on this page flag packages where maintenance signals suggest high abandonment risk.
3. Known Vulnerabilities
CVEs against your direct and transitive dependencies are the most acute dependency risk. They have deadlines: once a vulnerability is public, attackers have working exploits within hours or days. Our Dependency Vulnerability Scanner pulls from OSV.dev — the same database Google uses — and maps CVEs to affected version ranges so you know exactly which packages to patch and what version fixes the issue.
4. End-of-Life Runtime Versions
Your dependencies only matter in the context of the runtime that executes them. A Node.js 16 codebase with all green dependencies is still a security risk if Node 16 itself is past its EOL date and receiving no security patches. The Node.js release tracker and the wider ReleaseRun hub pages surface EOL dates for all major runtimes so you can plan upgrades before the window closes.
Language-by-Language Dependency Health Guide
JavaScript & Node.js (npm)
The npm registry contains over 2.3 million packages — more than any other package registry. This scale brings both opportunity and risk. Packages with a single maintainer, minimal weekly downloads, or no recent commits are common because anyone can publish to npm. The npm Package Health Checker specifically flags single-maintainer risk, download trends, and deprecation messages from the author. For bulk audits, the package.json batch checker processes your entire manifest at once.
npm's semver range system (^, ~, *) means your installed version may differ from what's in package.json. Always check your actual installed versions with npm list --depth=0 alongside this checker.
Python (PyPI)
Python's PyPI ecosystem has no formal deprecation mechanism — a package can stop receiving updates permanently while still being installable and appearing healthy in registry searches. The PyPI Package Health Checker checks maintenance signals from upload history and compares your version against the latest. For projects using requirements.txt, the requirements.txt batch checker audits every pinned dependency in seconds.
The scientific Python stack (NumPy, SciPy, pandas, scikit-learn) went through major API breaks in 2023–2024. Data science and ML projects in particular are likely to have dependency drift that causes hard-to-diagnose failures on fresh installs.
Go (Go Modules)
Go's module system uses major version import paths (e.g., github.com/pkg/v2), making major upgrades more visible but also more labor-intensive. The Go Module Health Checker checks individual packages against proxy.golang.org. For project-level audits, the go.mod batch checker processes your entire go.mod file including indirect dependencies.
Rust (crates.io)
Rust's crates.io registry includes a “yanked” version mechanism — maintainers can retract specific versions that have serious bugs or security issues. Yanked versions remain installable if explicitly pinned but are excluded from resolution. The Cargo Package Health Checker flags yanked versions alongside outdated and abandoned packages. The Cargo.toml batch checker processes your full dependency manifest.
Java (Maven Central)
Maven's dependency system has some of the longest-lived ecosystems in software — Spring Framework has been evolving for over 20 years. The risk profile is different: major frameworks are well-maintained but have long upgrade cycles with extensive migration guides. The Maven Dependency Health Checker surfaces version gaps against Maven Central, and the pom.xml batch checker audits full project manifests.
PHP (Composer) and .NET (NuGet)
PHP projects using Composer and .NET projects using NuGet have their own maintenance patterns. Laravel's LTS policy and Symfony's support lifecycle create hard EOL dates that affect the packages built on top of them. The PHP Composer Health Checker and NuGet Package Health Checker both surface package freshness against their respective registries, with batch versions available for composer.json and .csproj files.
How to Build a Dependency Health Workflow
- Audit now. Start with the batch checkers for your primary language. Get a baseline of how many packages are at D or F grade.
- Prioritise CVEs first. Run the Vulnerability Scanner and patch anything with a high or critical CVE before addressing version drift.
- Group D and F packages by upgrade complexity. Some major version bumps are one-line changes; others require days of refactoring. Estimate before scheduling.
- Update incrementally. One package (or one major upgrade) per PR. This makes rollback easy and keeps review tractable.
- Automate the check. Add a dependency health audit to your CI pipeline. Flag when a new D or F grade appears so it doesn't accumulate silently.
- Track runtime EOL separately. Use the ReleaseRun hub pages to track when your runtime environments (Node.js, Python, Go, Kubernetes) are approaching end-of-life.
Frequently Asked Questions
Are these tools free to use?
Yes, completely free. All checkers run client-side in your browser — no signup, no rate limits, no data sent to our servers. Registry APIs (npm, PyPI, etc.) are queried directly from your browser.
What is the difference between a health check and a security audit?
A health check covers version currency, maintenance status, and abandonment signals. A security audit specifically checks against CVE databases for known vulnerabilities. Use both: a package can be well-maintained with no CVEs but still be two major versions behind with breaking API changes.
How do transitive dependencies affect my health score?
These checkers analyse your direct dependencies (what's in your manifest file). Transitive dependencies — the dependencies of your dependencies — add further risk but require runtime-level tools like npm audit or Snyk to fully evaluate.
My package is pinned to an old version intentionally. Should I still check it?
Yes, especially if it's pinned to avoid a breaking change. The longer you defer an upgrade, the larger the migration surface. Knowing the exact version gap helps you plan when to budget time for the upgrade sprint.
Which registries do the checkers use?
npm registry for JavaScript, PyPI for Python, proxy.golang.org for Go, crates.io for Rust, Maven Central for Java, packagist.org for PHP, and nuget.org for .NET.