Check P11 · provenance family · severity MEDIUM · automatic · one of the 12 npm and PyPI package checks
Maps to OWASP LLM03 Deprecation and yanking are the maintainer's or the registry's own word that a release should not be used; neither framework names that as a technique.
The question this check asks: has the person who published this release said not to use it? npm lets a maintainer deprecate a version with a message; PyPI lets a release be yanked, with a reason. Either is the publisher's own word.
A deprecation or a yank is the cheapest warning there is: the people who know the package best have said something is wrong with this release. Sometimes it is a renamed package, sometimes a broken build, sometimes a security problem. It costs nothing to read, and a package manager installing the release anyway prints the message where it scrolls past.
On npm the latest version's deprecated message is read; on PyPI whether the latest release is yanked, and its yank reason. pkg-deprecated is MEDIUM and 4 points on any package, and the finding quotes the message. A MEDIUM is a warning under the default profile, never a block on its own.
A package deprecated in favour of a new name is still a working package, and a release yanked for a packaging mistake may be harmless. The finding quotes the maintainer's own message so the reader can see which case it is.
Earlier releases. Only the latest release is read; a deprecated version further back is not this check's concern. Why it was deprecated, beyond the message the maintainer wrote. The package's code is not read.
Scope, the same on every page of this roster: RepoGates does not see git clone, package managers or curl — outside Claude Code with the RepoGates plugin, whose hook refuses a clone or install that names a blocked repository on the command line, before it runs. The hook sees Bash tool calls in that one client and nothing else; a package named on the line (npm install express, pip install flask, npx, npm create) is judged by its own verdict under this roster, its declared repository riding along. Direct dependencies named on the command line only; transitive dependencies and lockfiles are not resolved. A package added by editing package.json or requirements.txt and installed later is not a line the hook judges. Edit and Write are read for one thing only — an API key about to be saved — checked on the machine and never sent; that guard asks, it never denies. This roster reads what npmjs.org and pypi.org publish about a package — its record, its release history, its declared repository — and never the package's code or what it installs after it. A registry other than those two (a --registry or --index-url on the line) is asked about, not assessed. A package the registry no longer serves is not assessed, never a pass. A PASS means nothing matched on what was read.
npm view NAME deprecated
curl -s https://pypi.org/pypi/NAME/json | jq '.info | {yanked, yanked_reason}'What is the difference between deprecated and yanked? npm deprecation marks a version with a maintainer's message and leaves it installable; a PyPI yank marks a release so that installers skip it unless it is asked for exactly. Both are the publisher's word that the release should not be used, and both are read the same way here.
Why is it a warning and not a block? Because a deprecated package is often only renamed or replaced, and still works. The finding quotes the maintainer's message so the reader can decide.
Are older deprecated versions read? No. The check reads the latest release, which is what a bare install takes.
P7 Dormant then released · C7 Maintenance activity.
Add RepoGates to Chrome Pricing
Sources for this page: the rule and weights from the product's own roster and scoring tables.