An archived PyPI project will not be updated again and accepts no new uploads, but its existing files can still be downloaded. A deprecated project is obsolete and may have a replacement, yet behaves like an active one on the index. Neither status blocks an install by itself.
The four markers
PEP 792 defined project status markers for the simple index. The PEP was resolved in July 2025, and the page notes the current canonical specification is now maintained by the Python Packaging Authority. The four values are:
| Status | New uploads | Existing files | What it signals |
|---|---|---|---|
| active | Allowed | Downloadable | Default, nothing special |
| archived | Blocked | Downloadable | No further updates will come |
| deprecated | Allowed | Downloadable | Obsolete, may be replaced |
| quarantined | Blocked | Not offered | Considered unsafe, for example malware |
Installers may warn about archived, deprecated and quarantined projects. The word is "may": the PEP does not force a warning, so do not rely on your installer to tell you.
Why archived matters more than it sounds
An archived status is the maintainer saying the project is finished. Any vulnerability found afterwards has no one to fix it on the index. If your code uses an archived package, you own the problem from then on.
Deprecated is a softer signal. The maintainer calls the project obsolete, perhaps pointing to a successor, but may still publish updates. Treat it as notice to plan a migration.
Quarantined is the severe one. It means nothing is offered for download, so an install would fail, and the reason is a safety concern.
What to do when a dependency shows one
- Find the status. Look at the project page and any warning your installer printed. Check your tooling output in CI too, since warnings can scroll past unseen.
- Read the maintainer's reason. Many archived projects point to a successor.
- Check for open vulnerabilities. An archived package with known advisories is a clear migration case.
- Pick a path: switch to the named successor, switch to a similar maintained library, or take on the risk with an owner and a review date.
- Add a policy so a new archived or deprecated dependency raises a ticket instead of passing quietly.
For the decision on what to replace it with, the general approach in what to do with an abandoned open source project applies.
Try it yourself
Open the demo and watch how a dependency inventory is built from manifests. Notice that status is something you would have to join onto this list, which is why a policy needs a data source.
Click through it at your own pace, or open it full screen.
Quick check
Can I still pip install an archived package?
Yes, existing distributions stay downloadable. You may see a warning, but the install is not blocked by the archived status.
Is deprecated the same as archived?
No. Deprecated means obsolete and possibly replaced, and uploads still work. Archived means no more updates and uploads are blocked.
Safeguard's SBOM and dependency scanning inventories the dependencies in your repositories so you can find the ones that need attention, and you can try the free scan.
Sources
Last reviewed: 19 October 2026.
