https://github.com/seanlf/still_active

Cross-ecosystem dependency maintenance auditor: flags unmaintained, archived, stale, and below-the-fix deps across the full transitive graph. Ruby gems natively; npm/pypi/cargo/go/maven/nuget via CycloneDX SBOM. Signals: activity, OpenSSF Scorecard, OSV advisories, libyear, poison-pill, runtime-ceiling. Outputs SARIF/JSON/CycloneDX with CI gates.

bundler ci-cd cyclonedx dependency-checker dependency-health devops gem-maintenance libyear openssf-scorecard outdated-dependencies ruby rubygems sarif sbom security-audit supply-chain-security vulnerability-scanner

Last synced: 13 Jul 2026