How old is what you already locked?
Inspect every resolved direct and transitive version. Hold CI when a release is younger than your policy—across npm, Python, Rust, and PHP lockfiles.
npx lockfile-age-audit check --min-age 3d- npm
- pnpm
- Yarn
- Bun text
- uv / pip
- Cargo
- Composer
A young dependency can hide two edges deep.
Change the cooldown. The sample stays local and performs no network requests.
| Resolved release | Age | Registry | Dependent chain | Finding |
|---|---|---|---|---|
| tiny-transitive@2.0.0 | 12 hours | npm | sample-app › parent-lib@1.0.0 › tiny-transitive@2.0.0 | younger than 3d |
| parent-lib@1.0.0 | 1,928 days | npm | sample-app › parent-lib@1.0.0 | clear |
HOLD 2 releases checked · cooldown 3.0d
! tiny-transitive@2.0.0 12h npm
sample-app > parent-lib@1.0.0 > tiny-transitive@2.0.0One policy after every resolver.
- 01
Read resolved facts
Auto-discover a lockfile or pass several. Aliases, workspaces, direct nodes, and transitive edges normalize into one graph.
- 02
Retrieve timestamp evidence
Public registries are queried with bounded concurrency, retries, and a 24-hour on-disk cache. Offline mode is cache-only.
- 03
Stamp the build
Exit 0 means compliant, 2 means policy violations, and 1 means the audit could not complete. JSON stays stable for automation.
GitHub Actions
- uses: B-Divyesh/sf-lockfile-age-audit@v0.1.0
with:
min-age: 3d
lockfiles: package-lock.jsonpre-commit
- id: lockfile-age
entry: npx --no-install lockage check --min-age 3d
language: system
pass_filenames: falseCooldown is evidence,
not a safety verdict.
This tool does not detect malware, inspect code, consult advisory feeds, or decide which maintainer to trust. Old releases can be harmful. Young releases can be sound.
Private authenticated registries, Go, and Maven are outside 0.1.0. Lockfiles stay local; public registry requests contain only package names and versions.
Read the full threat model →