Package Maintenance Status in Mend SCA
Overview
Mend.io will provide additional insight into the maintenance status of package versions, by marking them as Deprecated or Maintained, allowing you to decide whether it’s safe to upgrade/downgrade a vulnerable package to that version.
This information is available to you via the Mend AppSec Platform user interface or your Repository Integration, using Renovate.
Scope
Supported Ecosystems
Package Manager | Registry | Status |
|---|---|---|
npm | Supported |
* Note: As of June 2024, only npm packages are supported; JavaScript packages from any ecosystem other than npm will show up as “Maintained”.
Statuses
Maintained - the package in question has not been marked as deprecated by a maintainer.
Deprecated - the package in question has been officially deprecated in the registry.
Getting it done
Mend AppSec Platform UI
For the package’s Maintenance Status (Maintained/Deprecated), expand the package’s Library Information section, as depicted below.
Repository Integrations
The package maintenance status is also available in Mend.io’s repository integrations, for customers employing Renovate.
More information about warnings for deprecated dependencies in Renovate can be found here.