still_active - Cross-ecosystem dependency maintenance auditor: fl

项目说明

still_active

How do you know the dependencies you ship are still maintained?

Install · Quick start · GitHub Action & CI · Cross-ecosystem · Configuration · Rules

Your package manager tells you what's outdated and what has a known C tells you whether anyone's still working on the thing. An abandoned dependency is a quiet liability: when it finally breaks or a lands, there's no release coming and no one to ping, and you find out at the worst time.

still_active flags that risk before it bites, across your whole dependency graph: archi, no release in years, low OpenSSF scores, unfixable , and the poison-pill case where a dormant package holds one of your deps below its own security patch. Native on Ruby gems; npm, PyPI, Cargo, Go, Maven, and NuGet via a CycloneDX SBOM.

Why still_active?

No package ecosystem's standard tooling answers "is anyone still maintaining this?" npm audit, cargo audit, pip-audit, and bundler-audit find known CVEs; the outdated commands find drift. None tell you a dependency's upstream is archived, hasn't shipped in three years, or is holding one of your deps below its security fix. That maintenance gap is what still_active fills. It's complementary to, not a replacement for, the tools you already run.

On Ruby, where it runs natively:

| | bundle outdated | bundler-audit | libyear-bundler | still_active |
| ---------------------------- | ----------------- | ---------------------- | ----------------- | ------------------------ |
| Outdated | Yes | - | Yes | Yes |
| Known (CVEs) | - | Yes (ruby-ad) | - | Yes (deps.dev + OS) |
| Libyear drift | - | - | Yes | Yes |
| Last-commit activity | - | - | - | Yes |
| Archived repo detection | - | - | - | Yes |
| OpenSSF Scorecard | - | - | - | Yes |
| Poison-pill / below-the-fix | - | - | - | Yes |
| Cross-ecosystem (npm/PyPI/Cargo/Go/Ma) | - | - | - | Yes (--sbom) |
| CI quality gates | - | Exit code | - | Yes (6 gate flags) |

With bundler-audit installed alongside, still_active merges its ruby-ad ad with its own deps.dev + OS, so running both no longer means reconciling two vuln counts by hand.

Installation

Requires an acti Ruby (the gemspec floor tracks Ruby's EOL schedule). You don't have to run it *on* the Ruby you audit: it reports on the pinned in Gemfile.lock, so run it from any current Ruby and it still flags an EOL target.

Quick start

Full flags: docs/cli.md. Tokens for private registries and self-hosted forges: docs/authentication.md.

GitHub Action & CI

The still_acti uploads findings to your GitHub Security tab as SARIF, with inline PR annotations on Gemfile.lock:

Gate the build on what you care about (all off by default, so nothing breaks until you opt in), and use --baseline for PR review.

<details>
<summary>CI gate flags and PR-review diff</summary>

</details>

Building on top of still_active? The JSON en is the supported interface (the Ruby constants are internal): docs/schema.md.

Rule reference (SA001-SA010), suppression, and composing with dependency-re: docs/rules.md, docs/ci.md. This repo audits itself every push, so you can browse li in its Code Scanning tab.

Cross-ecosystem audit

Point --sbom at a CycloneDX SBOM (from Syft, Trivy, npm sbom, cyclonedx-npm, cyclonedx-py, or any producer; see generator compatibility) and still_active assesses npm, pypi, cargo, go, maven, and nuget packages the same way it does gems, via deps.dev and ecosyste.ms. The SBOM is treated as untrusted input (only ecosystem/name/ are read, repositories resolve from deps.dev, and anything unassessable is surfaced rather than faked as ok). Most signals apply e; a few are deliberately scoped.

<details>
<summary>Which signal covers which ecosystem</summary>

| Signal (rule) | Ruby (native) | --sbom (cross-ecosystem) |
| ------------- | ------------- | -------------------------- |
| Archived (SA001), no recent release (SA002), low OpenSSF (SA005), libyear (SA004) | Yes | Yes (all six ecosystems) |
| (SA003) | deps.dev + OS | deps.dev + OSV |
| &nbsp;&nbsp;↳ "below the fix" (a dead package pins a dep) | Yes | npm, Cargo, PyPI |
| Poison-pill (SA008) | rubygems | PyPI (flat resolution only) |
| Language-runtime ceiling (SA009) | Ruby | Python |
| Ruby EOL (SA006), yanked (SA007) | Yes | n/a |

The Go toolchain (stdlib) isn't a module deps.dev can serve, so it's read from endoflife.date and OS, and an end-of-life Go release line is reported as deprecated (SA010). A deprecated Go module (// Deprecated: in its latest go.mod) is deprecated whiche is pinned, as go list -m -u reports it.

Full rule detail in docs/rules.md.
</details>

The play is maintenance, not C, so compose Tri for full co.

Generator compatibility

CycloneDX producers disagree about almost e a reader could naively depend on, so the SBOM path derives what it needs structurally rather than from any one tool's con. Each of these is exercised in the test suite against output from the tool, not a hand-written fixture:

| generator | spec | metadata.component | bom-ref con |
| --- | --- | --- | --- |
| Syft | 1.7 | file, and not a graph node at all | pkg:npm/…?package-id=… |
| Trivy | 1.7 | application | UUID |
| npm sbom | 1.5 | library | name@ |
| cyclonedx-npm | 1.6 | application | parent@ver\|child@ver |
| cyclonedx-py | 1.6 | absent | requirements-L1 |

Given the same project, all of them produce the same .

Two beha worth knowing, because they are deliberate rather than incidental:

An SPDX document is refused with a clear error rather than read as an empty, all-clear audit.

Output formats

Auto-detected: a coloured terminal table on a TTY (above), JSON when piped. Or ask explicitly.

<details>
<summary><strong>JSON</strong> (<code>--json</code>): a , contract-tested schema for automation</summary>

Fields are documented in docs/schema.md.
</details>

<details>
<summary><strong>Markdown</strong> (<code>--markdown</code>): a table for pull requests, docs, or wikis</summary>

| activity | up to date? | OpenSSF | vulns | name | | last commit |
| -------- | ----------- | ------- | ----- | ---- | ------- | ----------- |
| | ✅ | 5.9/10 | ✅ | nokogiri | 1.19.4 | 2026/06 |
| 🚩 | ✅ | 2/10 | ✅ | paperclip | 6.1.0 | 2021/03 |
</details>

SARIF feeds GitHub Code Scanning (see GitHub Action & CI). CycloneDX (--cyclonedx) emits a standards-track SBOM so your graph and still_active's signals flow into Tri, or Snyk.

Configuration

A committed .still_active.yml keeps policy in control and replaces the blunt --ignore=GEM (which mutes *every* gate for a gem) with granular, expiring suppression. A suppression must name an ad id (so a new CVE is ne), an expires: date makes accepted risk re-surface instead of rotting, and a suppressed finding still shows in output (and as a dismissed SARIF entry).

<details>
<summary><code>.still_active.yml</code> example</summary>

</details>

Full semantics, thresholds, and transiti: docs/configuration.md.

Data sources

Release dates and licenses from RubyGems / GitHub Packages / Artifactory; repo activity from the GitHub API and ecosyste.ms (CC-BY-SA 4.0), each the other's fallback (GitHub first with a token), and from the GitLab / Codeberg API, on both audits; a repository no service can check reads unknown, never "not archived" (repository_check); OpenSSF Scorecard and CVSS from deps.dev; ad se and fixed- ranges from OSV, scored with c when deps.dev has no number (CVSS 4.0); extra ad from ruby-ad; runtime EOL from endoflife.date. Public sources' answers are cached under ~/.cache/still_active/http, each for as long as it holds (ad an hour); --no-cache skips it.

De

bin/setup installs dependencies and wires git hooks; rake runs the full lint + test suite. A pre-push hook runs rake automatically. Releases publish to rubygems.org automatically on a GitHub Release (trusted publishing). See CONTRIBUTING.md.

License

Open source under the MIT License.

项目信息

开发语言：Ruby

Star 数：19

技术要点

该项目属于安全软件方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Cross-ecosystem dependency maintenance auditor: flags unmaintained, archived, stale, and below-the-fix deps across the full transitive graph. Ruby gems natively; npm/pypi/cargo/go/maven/nuget via CycloneDX SBOM. Signals: activity, OpenSSF Scorecard, OSV advisories, libyear, poison-pill, runtime-ceiling. Outputs SARIF/JSON/CycloneDX with CI gates.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。