Package Maintenance Status in Mend SCA
Overview
Mend.io will provide additional insight into the maintenance status of package versions, by marking them as Deprecated or Maintained, allowing you to decide whether it’s safe to upgrade/downgrade a vulnerable package to that version.
This information is available to you via the Mend Platform user interface or your Repository Integration, using Renovate.
Scope
Supported Ecosystems
Package Manager | Registry | Status |
|---|---|---|
npm | Supported |
* Note: As of June 2024, only npm packages are supported; packages from any ecosystem other than npm will show up as “Maintained”.
Statuses
Maintained - the package in question has not been marked as deprecated by a maintainer.
Deprecated - the package in question has been officially deprecated in the registry.
Getting it done
Mend Platform UI
Information about the maintenance status of packages will be displayed in the package’s Library Info section in the Mend Platform user interface.
To get to it, navigate to your application or project within the application. Then, select a library and on the library page, select ‘Library Info’ from the left pane.
Repository Integrations
The package maintenance status is also available in Mend.io’s repository integrations, for customers employing Renovate.
More information about warnings for deprecated dependencies in Renovate can be found here.