Is gulp healthy, maintained, and safe?
Maintained, but watch it — gulp has real signals (drift, thin maintenance, or advisories) worth tracking.
The verdict
gulp earns a health score of 50/100, a medium risk rating, computed deterministically from live npm release history, maintainer data, and the OSV vulnerability database. Maintained, but watch it — gulp has real signals (drift, thin maintenance, or advisories) worth tracking.
Nothing has shipped since 1 June 2025 — over a year ago (420 days) — which points to a dormant project. Historically it released far more frequently, so the current silence reads as a genuine collapse in velocity rather than a natural gap. Two maintainers are listed; better than a lone author, but still a thin bench if one steps away.
On the security side, OSV has no advisories on record for gulp today. That's reassuring, but "no known advisory" is not the same as "no vulnerability" — it only means nothing has been disclosed and indexed yet.
gulp is usable but carries real signals — pin versions, watch for new advisories, and keep a fallback in mind. This is a one-time snapshot of a single package — real projects depend on dozens or hundreds of packages, and any one of them can drift or be compromised between releases. Run your own package.json through the free health check, or have OSPulse monitor your whole dependency tree continuously.
Evidence trail — deterministic, auditable
Key facts
- Latest version
- v5.0.1
- Last release
- 1 June 2025 (420 days ago)
- Total releases
- 69
- First release
- 4 July 2013
- Package age
- 13.1 years
- Maintainers
- 2
- Known advisories
- 0
- Confidence
- High
Frequently asked
Is gulp still maintained?
Partly — the most recent release was 1 June 2025 (420 days ago), so maintenance has slowed but not fully stopped.
Does gulp have known security vulnerabilities?
No advisories are currently recorded for gulp in the OSV database. That means none have been publicly disclosed and indexed — it is not a guarantee of safety.
Is gulp safe to use?
Maintained, but watch it — gulp has real signals (drift, thin maintenance, or advisories) worth tracking. OSPulse rates it 50/100 (medium risk) based on release recency, cadence, maintainer bus factor and known vulnerabilities.
Alternatives to gulp
Other npm packages we've checked
gulp is one package. What about the other hundreds in your tree?
Paste your own package.json into the free health check for an instant snapshot — or let OSPulse monitor your whole dependency tree continuously, before your CVE scanner wakes up.
Data from the npm registry & OSV.dev · snapshot generated 2026-07-27 · scores are deterministic and recomputed on each refresh.