It's a fair point that sometimes software is "just done". Combining the dependency graph with version freshness may yield even more informative retention/attrition metrics. { EDIT: as in "either updated in N months or a dependency of something which was". Of course, this can easily neglect reverse dependencies not in the package graph, but perfect can be the enemy of the good. :-) }