dep-doctor

README

dep-doctor

dep-doctor is a tool to diagnose whether your software dependency packages are maintained.

Today, most software relies heavily on external packages. Vulnerabilities in those packages can be detected by vulnerability scanners (dependabot, trivy, Grype, etc) if they are publicly available.

However, some packages have archived their source code repositories or have had their development stopped, although not explicitly. dep-doctor will notify you of those packages in the dependencies files.

Support dependencies files

language	package manager	file (e.g.)	status
Ruby	bundler	Gemfile.lock	✔
JavaScript	yarn	yarn.lock	✔
JavaScript	npm	package-lock.json	✔
Python	pip	requirements.txt	✔
Python	poetry	poetry.lock	(later)
Python	pipenv	Pipfile.lock	(later)
PHP	composer	composer.lock	✔
Go	golang	go.mod	✔
Rust	cargo	Cargo.lock	(later)

Support repository hosting services

Only GitHub.com

Install

Homebrew (macOS and Linux)

$ brew tap kyoshidajp/dep-doctor
$ brew install kyoshidajp/dep-doctor/dep-doctor

Binary packages

Releases

How to use

GITHUB_TOKEN must be set as an environment variable before execution.

Usage:
  dep-doctor diagnose [flags]

Flags:
  -h, --help               help for diagnose
  -i, --ignores string     ignore dependencies (separated by a space)
  -f, --lock_file string   lock file path (default "Gemfile.lock")
  -p, --package string     package manager (default "bundler")
  -y, --year int           max years of inactivity (default 5)

For example:

$ dep-doctor diagnose -p bundler -f /path/to/Gemfile.lock
concurrent-ruby
dotenv
faker
i18n
method_source
paperclip
......
[error] paperclip (archived): https://github.com/thoughtbot/paperclip
Diagnosis completed! 6 dependencies.
1 error, 0 warn (0 unknown), 0 info (0 ignored)

Report level

level	e.g.
error	Source code repository is already archived.
warn	Source code repository is not active or unknown.
info	Other reasons. (specified to be ignored)

How works

Author

Katsuhiko YOSHIDA