How to Prevent the Use of Deprecated or Outdated Packages in Development
Use Case:
A DevOps team wants to ensure developers use actively maintained and secure package versions, and prevent reliance on end-of-life, outdated, or unsupported dependencies.
Workflow Steps:
- Create a Policy
- Go to Administration > Curation > Policies Management and click Create Policy. Name the policy, for example, Enforce Up-to-Date Dependencies.
- Under Policy Scope, apply the policy to all curated repositories.
- Define an Operational Condition
- Select a condition that prevents the use of unsupported or outdated package versions:
- Package version is End of Life: Blocks package versions that JFrog Catalog marks as End of Life (EOL), for example, because the upstream project was archived or the release stream is no longer supported. EOL versions no longer receive security patches or maintenance updates. The blocking message states the reason the version is EOL, and recommends upgrading to an actively supported version.
- Package version is aged (no newer version identified): Blocks package versions released more than 2 years ago when no newer version exists (the package appears to be unmaintained).
- Package version is aged (newer version available): Blocks package versions released more than 180 days before the package's latest version.
- Package version is immature (permissive, moderate, or strict): Blocks package versions released less than 2, 14, or 30 days ago, respectively, to avoid unstable releases. To set a different threshold, create a custom condition.
- Select a condition that prevents the use of unsupported or outdated package versions:
- Select an Action & Notifications
- Choose Block to enforce the restriction.
- Enable Email notifications to alert the requester and DevOps team when a package is blocked.
- Validate Package Version Control
- Attempt to install an outdated or restricted package version.
- Confirm the request is blocked and an explanatory alert is shown.
- Review package metadata and enforcement details in Audit Events.
End of Life Condition Support
The Package version is End of Life condition is available from Xray 3.150.17 for the following package types:
- npm
- PyPI
- NuGet
- RubyGems
- Composer
- Cargo
The Package version is End of Life condition is a built-in condition only: it has no relaxation parameters and cannot be used as the basis for a custom condition. To allow a specific EOL package or version, add a waiver to the policy.
This condition relies on End of Life data from JFrog Catalog, and is not supported in On-Demand Curation.
For the full list of conditions and the package types each one supports, see List of Available Conditions.
Updated 27 days ago