Dormancy vs dependents
Commit counts for 2,676 open-source repositories, ranked by how many other repositories depend on them. Measured 6 September 2026.
The finding
The more projects depend on a repository, the less likely anyone committed to it in the first eight months of 2026. Sixty of the hundred most depended-upon repositories made no commit at all to their default branch between 1 January and 31 August 2026. Below rank 1,000 that figure is 41%.
| Ranked by dependent repositories | Repos | No commits in 8 months | Median commits |
|---|---|---|---|
| Top 100 | 100 | 60 (60%) | 0 |
| Top 250 | 250 | 147 (59%) | 0 |
| Ranks 251–1,000 | 750 | 474 (63%) | 0 |
| Ranks 1,001+ | 1,676 | 688 (41%) | 4 |
Take the data
dormancy-2026-09.csv
— 2,676 rows, one per repository: repository, dependent_repos,
commits_jan_aug_2026, days_measured. No sign-up, no email required.
Licence: CC BY-SA 4.0. The dependent_repos column is derived from
ecosyste.ms, whose data is published under CC BY-SA 4.0, so this
derivative carries the same licence and the same attribution requirement. Credit ecosyste.ms and
Anteproof, and share any derivative alike. Commit counts are from the GitHub REST API.
How it was measured
- Commits: GitHub REST API, default branch only, 1 January to 31 August 2026. Every repository in the file has exactly 243 days measured; a zero means measured zero, never "not looked at".
- Dependent repositories: ecosyste.ms
dependent_repos_count. Where several packages resolve to one repository, the highest count is used. - Excluded: 9 repositories in the universe whose commit history could not be read (renamed, redirected or deleted). The universe holds 2,685 repositories with a dependent count; 2,676 of them have a full window, and the 9 are absent here rather than counted as zero.
- Not used: the public GitHub event archive. That feed lost most of its push, star and release events during 2026, so nothing here depends on it.
What this does not mean
Dormant is not abandoned. A small utility that does one thing correctly may simply be finished. Zero commits can mean stability.
Dependent counts are transitive. Five and a half million repositories did not
each choose fs.realpath; they inherited it through a lockfile. Nobody should use this
file to shame a maintainer.
Why we published it
From 11 September 2026 the EU Cyber Resilience Act requires a manufacturer to report an actively exploited vulnerability within 24 hours. A bill of materials tells you what is in the product; it does not tell you whether anyone is still home to fix it. That is the question Anteproof forecasts, and the record, including the families we are currently withholding and why, is on the calibration page.
A probability is not advice, and we never call a package safe.