DM001: Maintenance Risk
Severity: high (constraint drag) or medium (deprecated) · Auto-fix: no (remediation is a manual dependency decision)
DM001 flags a direct dependency that is a maintenance liability for your security posture. It fires on either of two signals:
- Constraint drag (
high) - the direct dependency pins a transitive dependency below the version that fixes a known CVE, and clearing the block requires a major-version upgrade of the direct dependency (a breaking change). - Deprecated on npm (
medium) - the direct dependency's latest published version is marked deprecated on the npm registry, so no fix is coming through a normal update. This fires on any deprecated direct dependency, even one that is not blocking a CVE fix.
A constraint-drag finding is reported against the direct (parent) dependency that is dragging the fix, not the transitive package the CVE is in, because the parent is what you have to change. A deprecated finding is reported against the deprecated dependency itself.
Release age is context, not a verdict
When a flagged package's latest release is at least two years old, DM001 adds a Last release: <year> line as context, to help you judge whether it is genuinely abandoned. Release age never changes severity on its own: a stable, feature-complete package can be years old and perfectly fine. Only the explicit signals above - a blocked fix, or an npm deprecation - set the severity. A repository-archive signal is a planned addition (opt-in, network-based).
Example: constraint drag
Your scan reports a CVE in js-yaml, fixed in 4.0.0. But you do not depend on js-yaml directly - gray-matter@2.1.0 does, and its version range only allows js-yaml below 4.0.0. The transitive fix is unreachable until you upgrade gray-matter itself, and the next gray-matter that permits the fix is a major version (5.0.0).
A version-matching scanner tells you "upgrade js-yaml." DM001 tells you the truth: gray-matter is dragging js-yaml below its fix, and only a major gray-matter upgrade resolves it.
Output
Maintenance findings are grouped by severity under a 🔧 Maintenance Risk heading. A constraint-drag finding is high and renders like this:
| Rule | Package | Details |
|---|---|---|
| DM001 | gray-matter@2.1.0 | Drags js-yaml@3.13.1 below fix 4.0.0 - upgrade to 5.0.0 |
A deprecated direct dependency is medium. The terminal shows a compact Deprecated flag; when the package's last release is old, a Last release context line is added:
| Rule | Package | Details |
|---|---|---|
| DM001 | request@2.88.2 | Deprecated |
| Last release: 2020 (6 years ago) |
The terminal keeps that line compact and drops the registry URL, which is not usable in a truncated cell. The full npm deprecation message, including its URL, is preserved in the --json, --report (HTML), and --sarif outputs, each of which also carries a structured staleness field (lastPublish, ageYears).
Fix
There is no automatic fix. The remediation is a real dependency decision:
# Upgrade the blocking direct dependency to the version that permits the fix.
# This is a MAJOR version bump - review its changelog for breaking changes first.
npm install gray-matter@5.0.0
Then rescan to confirm the transitive CVE is resolved. If the blocking dependency is deprecated, plan a migration to a maintained alternative - a deprecated dependency will not receive future security fixes.
Offline behavior
The constraint-drag signal is computed entirely from the resolved dependency graph, so it works --offline. The deprecated-on-npm signal and the release-age context both need a registry lookup (one npm packument per direct dependency, fetched with bounded concurrency and cached), so they are skipped in offline mode; drag findings are still reported without them.