feat(enrichment): package maintenance-health / deprecated-dep scorer

.env.example

@@ -65,17 +65,17 @@ GITTENSORY_REVIEW_ENRICHMENT=false
 # Current analyzer names:
 # dependency,lockfileDrift,secret,license,installScript,heavyDependency,actionPin,eol,redos
 # provenance,codeowners,secretLog,assetWeight,typosquat,commitSignature,iacMisconfig,nativeBuild
-# history,docCommentDrift
+# depMaintenanceHealth,history,docCommentDrift
 #
 # Profile defaults:
 # fast: dependency,lockfileDrift,secret,license,installScript,heavyDependency,actionPin,eol
-# redos,provenance,secretLog,typosquat,iacMisconfig,nativeBuild
+# redos,provenance,secretLog,typosquat,iacMisconfig,nativeBuild,depMaintenanceHealth
 # balanced (default): dependency,lockfileDrift,secret,license,installScript,heavyDependency
 # actionPin,eol,redos,provenance,codeowners,secretLog,assetWeight,typosquat,commitSignature
-# iacMisconfig,nativeBuild,history,docCommentDrift
+# iacMisconfig,nativeBuild,depMaintenanceHealth,history,docCommentDrift
 # deep: dependency,lockfileDrift,secret,license,installScript,heavyDependency,actionPin,eol
 # redos,provenance,codeowners,secretLog,assetWeight,typosquat,commitSignature,iacMisconfig
-# nativeBuild,history,docCommentDrift
+# nativeBuild,depMaintenanceHealth,history,docCommentDrift
 # END GENERATED REES ANALYZERS
 
 # Submitter-reputation spend control (internal-only): downgrades new/burst/low-rep

apps/gittensory-ui/src/lib/rees-analyzers.ts

@@ -454,6 +454,29 @@ export const REES_ANALYZERS = [
       notes: "Registry JSON is capped so large package metadata cannot monopolize REES memory.",
     },
   },
+  {
+    name: "depMaintenanceHealth",
+    title: "Dependency maintenance health",
+    category: "supply-chain",
+    cost: "registry",
+    defaultEnabled: true,
+    profiles: ["fast", "balanced", "deep"],
+    requires: ["files", "public-network"],
+    limits: {
+      maxQueries: 25,
+      maxRegistryJsonBytes: 2097152,
+    },
+    docs: {
+      summary:
+        "Flags newly-added or upgraded dependencies that are deprecated/yanked by their maintainer or stale (no recent release).",
+      looksAt: "New/upgraded npm and PyPI dependency versions.",
+      reports:
+        "Package, version, ecosystem, the maintenance signal (deprecated/yanked/stale), and a public-safe reason.",
+      network: "Calls the npm and PyPI registries. No GitHub token required.",
+      notes:
+        "Registry JSON is capped so large package metadata cannot monopolize REES memory; PyPI versions are matched to releases by PEP 440 equality.",
+    },
+  },
   {
     name: "history",
     title: "Author and change-area history",

review-enrichment/analyzer-metadata.json

@@ -524,6 +524,33 @@
         "notes": "Registry JSON is capped so large package metadata cannot monopolize REES memory."
       }
     },
+    {
+      "name": "depMaintenanceHealth",
+      "title": "Dependency maintenance health",
+      "category": "supply-chain",
+      "cost": "registry",
+      "defaultEnabled": true,
+      "profiles": [
+        "fast",
+        "balanced",
+        "deep"
+      ],
+      "requires": [
+        "files",
+        "public-network"
+      ],
+      "limits": {
+        "maxQueries": 25,
+        "maxRegistryJsonBytes": 2097152
+      },
+      "docs": {
+        "summary": "Flags newly-added or upgraded dependencies that are deprecated/yanked by their maintainer or stale (no recent release).",
+        "looksAt": "New/upgraded npm and PyPI dependency versions.",
+        "reports": "Package, version, ecosystem, the maintenance signal (deprecated/yanked/stale), and a public-safe reason.",
+        "network": "Calls the npm and PyPI registries. No GitHub token required.",
+        "notes": "Registry JSON is capped so large package metadata cannot monopolize REES memory; PyPI versions are matched to releases by PEP 440 equality."
+      }
+    },
     {
       "name": "history",
       "title": "Author and change-area history",