https://github.com/raiderrobert/shelflife
Check your dependencies and runtimes for end-of-life risk
https://github.com/raiderrobert/shelflife
Last synced: 3 months ago
JSON representation
Check your dependencies and runtimes for end-of-life risk
- Host: GitHub
- URL: https://github.com/raiderrobert/shelflife
- Owner: raiderrobert
- License: other
- Created: 2026-03-20T14:08:16.000Z (4 months ago)
- Default Branch: main
- Last Pushed: 2026-03-20T14:19:55.000Z (4 months ago)
- Last Synced: 2026-03-21T06:32:10.342Z (4 months ago)
- Language: Rust
- Homepage:
- Size: 71.3 KB
- Stars: 0
- Watchers: 0
- Forks: 0
- Open Issues: 10
-
Metadata Files:
- Readme: README.md
- License: LICENSE
Awesome Lists containing this project
README
# shelflife
Check your dependencies and runtimes for end-of-life risk.
- **npm dependency scanning.** Checks every package in your lockfile against the npm registry for deprecation, staleness, and version drift.
- **Runtime EOL detection.** Finds your Node.js, Python, and Java versions from config files and checks their end-of-life status.
- **Zero config.** Point it at a directory and go. Optional `.shelflife.toml` for team-wide settings.
- **CI-ready.** `--fail-on critical` exits non-zero only on deprecated packages or expired runtimes. `--json` for machine-readable output.
- **Fast.** Single binary, concurrent registry lookups, no runtime dependencies.
## Install
Build from source:
```bash
cargo install --path .
```
Or grab a binary from [GitHub Releases](https://github.com/raiderrobert/shelflife/releases).
## Quick Start
```bash
shelflife
```
That's it. Shelflife scans the current directory, checks your lockfile and runtime config files, and prints a summary:
```
Runtime EOL
[CRITICAL] nodejs 18.19.0 (EOL 2025-04-30 (expired 324 days ago))
[WARNING] python 3.9.18 (EOL 2025-10-05 (200 days left))
npm Dependencies
[OK] lodash@4.17.21 → 4.17.21
[WARNING] express@4.18.2 → 5.1.0 (1 major version(s) behind)
[CRITICAL] request@2.88.2 → 2.88.2 (package is deprecated)
Summary: 49 total, 2 critical, 1 warning, 46 ok
```
## Usage
```
shelflife [OPTIONS] [PATH]
Arguments:
[PATH] Directory to scan (default: .)
Options:
-c, --config Config file path (default: .shelflife.toml)
--threshold-days Days before EOL to warn (default: 180)
--stale-months Months without update = stale (default: 18)
--ignore Packages to skip
--json Output JSON instead of table
--fail-on Exit 1 on: any (default), critical, none
-v, --verbose Verbose output
-h, --help
-V, --version
```
## Configuration
Optional `.shelflife.toml` in your project root:
```toml
threshold_days = 180
stale_months = 18
ignore = ["some-internal-pkg"]
fail_on = "any" # any | critical | none
```
CLI flags override the config file.
## What It Checks
**npm packages** (from `package-lock.json`):
- Deprecated packages
- Major/minor versions behind latest
- Stale projects (latest version not published in 18+ months)
**Runtimes** (detected from config files):
| Runtime | Detected from |
|---------|--------------|
| Node.js | `.nvmrc`, `.node-version`, `package.json` `engines.node` |
| Python | `.python-version`, `runtime.txt`, `pyproject.toml` |
| Java | `pom.xml`, `build.gradle` |
## License
[PolyForm Shield 1.0.0](LICENSE)