We should all be using dependency cooldowns

Re:We should all be using dependency cooldowns by coredog64 on Friday November 21, 2025 @03:48PM (#46008804)

My current employer publishes "staleness" metrics at the project level. It's imperfect because it weights all the dependencies the same, but it's better than nothing.

[ Parent | on HN ]

Re:We should all be using dependency cooldowns by m000 on Saturday November 22, 2025 @08:57AM (#46014844)

I wonder, are there tools to help you automate this? I.e. to assign a value to the staleness of each package instead of simple "oudated" boolean, and also a weight to each package.

E.g. something like:

  pkg_staleness = (1 * missed_patch + 5 * missed_minor + 10 * missed_major) * (month_diff(installed_release_date, latest_release_date)/2)^2

  proj_staleness = sum(pkg.staleness * pkg.weight for pkg in all_packages)

[ Parent | on HN ]

Re:We should all be using dependency cooldowns by decasia on Saturday November 22, 2025 @05:23PM (#46018840)

My current org uses this:

https://libyear.com/

[ Parent | on HN ]