If a major framework hasn't had commits for a month that might indicate something. If it's just some random module that's small and has no major open issues, then that policy is unreasonable. Does your team regularly audit the commit streams of already-in-use dependencies so you can rip them out when the maintainers take a break?