ALL-DEPE0002 · explicit_dependency_state_count
Count dependencies with an explicit adverse upstream or release state.
This is a deterministic rule for all languages. Read its implementation.
Definition
Section titled “Definition”Collect current dependency evidence in memory and report only standardized project states of
archived, deprecated, or quarantined, an archived source repository, and optionally an
exact resolved release marked as yanked. Release age and repository inactivity never imply
one of these states.
Evidence
Section titled “Evidence”Each finding retains the dependency and resolved version, every observed adverse state, the target lock or manifest location, and retrieval time. Unknown states remain unknown and produce no finding. The value is the number of dependencies carrying an adverse state.
Exceptions
Section titled “Exceptions”Set include_yanked to false only when another package policy owns yanked artifacts. An active
PyPI state means uploads are allowed. It does not prove healthy maintenance. A mature package
with old releases and no explicit adverse state is not reported by this rule.
Examples
Section titled “Examples”A project marked deprecated produces one finding. A resolved yanked wheel also produces one
finding by default. A stable parser whose latest release is three years old produces none.
References
Section titled “References”- Cites “Python Packaging User Guide”, Simple Repository API project status markers. Open reference
- Cites “Python Packaging User Guide”, Simple Repository API yanked files. Open reference
- Cites “GitHub documentation”, repository archived field. Open reference