dead-deps — what happened to your dependencies

Is istanbul still maintained?

No — istanbul stopped being maintained around August 2016. The same project continues under the name nyc.

Status
No longer maintained
Last maintained
August 2016
Use instead
nyc on npm
Succession
Renamed package
Drop-in
no — expect code changes
Confidence
high

What should I use instead of istanbul?

The same project continues under the name nyc. nyc is not a drop-in replacement, so expect to change call sites.

How to migrate from istanbul to nyc

Replace istanbul cover _mocha style commands with nyc mocha. Configuration moves from CLI flags to .nycrc or an "nyc" key in package.json.

Why istanbul is on this list

The istanbul CLI stopped at 0.4.5 in August 2016 and is deprecated on npm with a notice recommending nyc. Istanbul did not disappear — it was rewritten as the istanbuljs monorepo, with nyc as the command line front end and istanbul-lib-* as the internals. c8 is the newer option for projects that prefer V8's built-in coverage.

The succession is settled: primary sources agree and the ecosystem has already moved.

istanbul alternatives

Beyond the primary recommendation, these are credible for istanbul's use case:

Check your own project for istanbul

npx dead-deps --all --min-state unmaintained

Run that in the directory holding your lockfile. If istanbul is anywhere in your tree — a direct dependency or buried under something else — it appears in the report with this verdict, this successor and the same evidence links, alongside anything else that has stopped moving. Nothing is uploaded; the scan reads your lockfile locally and queries public registry metadata.

Exit code 1 means something was flagged, which makes npx dead-deps --min-state deprecated usable as a CI gate. See how verdicts are produced.

Evidence

Every claim on this page traces to a primary source. Check them:

See the full index of covered packages, or read the methodology for how a verdict is reached and why a quiet package is not a dead one.