🪦 dep-graveyard

Scan your project dependencies for abandoned, deprecated, and risky packages — with a beautiful terminal report and Slack notifications.

Supports Node.js (package.json) and Python (requirements.txt) projects. Works on local folders or any GitHub URL — no cloning needed.

Usage (Zero Setup)

# Scan a GitHub repo instantly
npx dep-graveyard https://github.com/expressjs/express

# Scan your current project
npx dep-graveyard

# Fast mode (no AI summary)
npx dep-graveyard --no-llm

# Skip Slack notification
npx dep-graveyard --no-slack

What It Checks

| Risk | Signal | |------|--------| | 💀 CRITICAL | Package officially deprecated or yanked from npm/PyPI | | 🔴 HIGH | Package not updated in 2+ years | | 🟡 MEDIUM | Package not updated in 1+ year, or has a single maintainer | | ✅ SAFE | No issues found |

Environment Variables

Copy .env.example to .env and fill in your keys:

cp .env.example .env

| Variable | Required | Description | |----------|----------|-------------| | GROQ_API_KEY | Optional | Enables free AI plain-English summary of findings (get one at console.groq.com) | | SLACK_WEBHOOK_URL | Optional | Posts the full report to your Slack channel |

On macOS / Linux:

export GROQ_API_KEY="gsk-your-key-here"
export SLACK_WEBHOOK_URL="https://hooks.slack.com/services/..."
npx dep-graveyard

On Windows (PowerShell):

$env:GROQ_API_KEY="gsk-your-key-here"
$env:SLACK_WEBHOOK_URL="https://hooks.slack.com/services/..."
npx dep-graveyard

Getting a Slack Webhook URL

1. Go to api.slack.com/apps → Create an App → From scratch
2. Click Incoming Webhooks in the sidebar → Toggle it ON
3. Click Add New Webhook to Workspace and select a channel
4. Copy the Webhook URL and add it to your .env file

Contributing (Local Development)

git clone https://github.com/YOUR_USERNAME/dep-graveyard.git
cd dep-graveyard
npm install
node src/cli.js https://github.com/expressjs/express --no-slack --no-llm

License

Apache-2.0