How long will our dependencies survive? Built an ML model to find out
Kept adopting dependencies that died later, so I built a tool to try to catch it early It's an ML model that scores GitHub repo health 0–100, using commit velocity, contributor concentration, PR merge rate, that kind of stuff. SHAP values explain each score so it's not a black box.
Best sanity check so far: facebook/create-react-app scored 58 (Watch). The model has no idea Meta officially deprecated it, it just saw 437 days since last commit, declining activity, thinning contributors, and flagged it.
Here's how some well-known repos score:
supabase/supabase 94 Healthy
vllm-project/vllm 96 Healthy
babel/babel 91 Healthy
gruntjs/grunt 90 Healthy # still alive?
facebook/create-react-app 58 Watch
gulpjs/gulp 42 At Risk
bower/bower 8 Critical
trufflesuite/truffle Archived
A few edge cases it handles well:
- Archived repos: determine Archived status, never even touches the ML pipeline
- Repos under 6 months old: Unscored with an explanation of not enough signal history
- Private/missing repos: simple 404
You can score any public repo, takes about 3 seconds. There's also a README badge, every repo that adds one helps surface the tool to more devs.
Would genuinely love feedback on scores that feel wrong, that's the best signal for improving the model. Happy to dig into what the model saw for any specific repo.