depkeep/ossrisk
Scan dependencies for EOL versions, CVEs, and abandonment signals
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Stale
- License
- None
Inputs
| name | description | required | default |
|---|---|---|---|
| path | Path to the project directory | no | . |
| fail-on | Exit 1 if any dependency reaches this risk level or above (none|low|medium|high|critical) | no | high |
| no-eol | Skip EOL checks | no | false |
| no-cve | Skip CVE checks | no | false |
| no-activity | Skip abandonment/staleness checks | no | false |
| no-outdated | Skip latest-version checks | no | false |
| no-typosquat | Skip typosquatting checks | no | false |
| no-license | Skip license compliance checks | no | false |
| no-maintainer | Skip maintainer/publisher checks | no | false |
| no-install-script | Skip install-script (preinstall/postinstall) checks | no | false |
| direct-only | Scan only direct dependencies, skip transitives | no | false |
| github-token | GitHub token for posting a PR comment with the report | no | "" |
Outputs
| name | description |
|---|---|
| risk-level | Highest risk level found across all dependencies |