{"id":21181649,"url":"https://github.com/ominestre/rotten-deps","last_synced_at":"2025-07-04T00:05:13.950Z","repository":{"id":39581577,"uuid":"275271761","full_name":"ominestre/rotten-deps","owner":"ominestre","description":"Rotten Deps builds upon tools like yarn outdated and npm outdated to provide more than just a pass or fail state to outdated dependencies. You can configure a global or per dependency compliance period which will trigger a warn instead of a fail. This provides more breathing room for updating without blocking your builds.","archived":false,"fork":false,"pushed_at":"2023-09-27T21:08:41.000Z","size":842,"stargazers_count":4,"open_issues_count":7,"forks_count":1,"subscribers_count":2,"default_branch":"main","last_synced_at":"2025-05-22T20:39:48.850Z","etag":null,"topics":["cli","grace-period","rotten-deps"],"latest_commit_sha":null,"homepage":"","language":"TypeScript","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/ominestre.png","metadata":{"files":{"readme":"README.md","changelog":"CHANGELOG.md","contributing":"CONTRIBUTING.md","funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null}},"created_at":"2020-06-27T00:26:50.000Z","updated_at":"2023-02-15T15:53:12.000Z","dependencies_parsed_at":"2023-02-08T00:30:59.627Z","dependency_job_id":null,"html_url":"https://github.com/ominestre/rotten-deps","commit_stats":null,"previous_names":[],"tags_count":34,"template":false,"template_full_name":null,"purl":"pkg:github/ominestre/rotten-deps","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ominestre%2Frotten-deps","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ominestre%2Frotten-deps/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ominestre%2Frotten-deps/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ominestre%2Frotten-deps/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/ominestre","download_url":"https://codeload.github.com/ominestre/rotten-deps/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ominestre%2Frotten-deps/sbom","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":262382300,"owners_count":23302259,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["cli","grace-period","rotten-deps"],"created_at":"2024-11-20T17:51:53.488Z","updated_at":"2025-07-04T00:05:13.893Z","avatar_url":"https://github.com/ominestre.png","language":"TypeScript","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Rotten Deps\n\n![Node.js CI](https://github.com/ominestre/rotten-deps/workflows/Node.js%20CI/badge.svg)\n\n## What is Rotten Deps?\n\nRotten Deps builds upon tools like `yarn outdated` and `npm outdated` to provide more than just a pass or fail state to outdated dependencies. You can configure a global or per dependency compliance period which will trigger a warn instead of a fail. This provides more breathing room for updating without blocking your builds.\n\n## Why and when should I use this?\n\n### Ignoring dependencies\n\nSometimes cases arise where due to some tech debt or other concern you're unable to update a specific dependency. If you have `npm outdated` or `yarn outdated` in your CI flow this job will constantly fail either blocking your builds or getting the team into the habit of ignoring the output.\n\n### Dependency specific compliance periods\n\nAssuming you've decided that 14 days is an acceptable compliance periods for updates but you have one critical dependency that you like to keep patched. The inverse scenario also applies where maybe you're not that worried about a specific dev dependency falling out of date.\n\n### Global compliance period\n\nThis is good for setting organization base rules if you are working in an organization that has patching compliance windows.\n\n## How is days outdated determined?\n\nWe use your current version of a dependency as it is installed in your `node_modules`. Then based off a list of\nversions we determine the next semver version which is not a pre-release and use that as our comparison point. Days outdated is\nthen calculated as the delta between the UTC seconds now versus the UTC seconds of next version's publish date. The delta is\nthen converted and rounded to days and used in the report.\n\nThere is a special case where if you forget to install your project first using `yarn install` or `npm install` you won't have\na `node_modules/` so the wanted version is used instead which is determined based on how you pinned a version in your `package.json`.\n\n## How do I use this?\n\n### Prerequisites\n\n1. NodeJS\n    - Must be `v14.x` or newer\n    - Test strategy currently covers `v14`, `v16`, and `v18` LTS versions\n\n### Installation\n\n`npm i -g rotten-deps` or `yarn global add rotten-deps` to install this utility globally\n\n- OR -\n\n`npm i --save-dev rotten-deps` or `yarn add --dev rotten-deps` to install it locally in your project.\n\n### Usage\n\nYou can find more in-depth documentation hosted on our [GitHub pages](https://ominestre.github.io/rotten-deps/).\n\n#### CLI\n\nTo see details on command usage and options use `rotten-deps --help`, or if you installed it locally `node ./node_modules/.bin/rotten-deps --help`.\n\n#### API\n\nAt this time the API isn't officially supported but you can probably figure it out based on the reference docs hosted on our [GitHub Pages](https://ominestre.github.io/rotten-deps/)\n\n#### Exit codes and meanings\n\n- `0` indicates that no dependencies are stale or outdated\n- `1` indicates that you have outdated dependencies\n- `2` indicates that you have stale dependencies but no outdated\n\n## Contributing\n\nFor instructions on contributing to this project please see [CONTRIBUTING.md](./CONTRIBUTING.md).\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fominestre%2Frotten-deps","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fominestre%2Frotten-deps","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fominestre%2Frotten-deps/lists"}