Abandonment

Every tool in this field answers the question with one number — days since the last commit — and every one of them is wrong about the same projects. A small, complete library that has needed no changes in three years is not abandoned. It is finished. Marking it dead costs a record its credibility precisely on the software that deserves the most confidence.

So silence is never the finding here. The assessment rests on a different proposition:

Abandonment is an unmet obligation, not an absence of noise.

A project incurs obligations when work arrives from outside it — a pull request that wants review, an issue that wants an answer, a published fix for a vulnerability in something it ships. A quiet project with no such demands owes nobody anything and cannot be failing them. A quiet project with fifteen pull requests nobody has looked at in two years, and a year-old advisory whose patch shipped the same week, is not resting.

• Category: Vitality (0% within category)
• Effect: a multiplier on the overall rating, and a ceiling in the severest states
• Metric key: abandonment

What the assessment reads

Declared. The maintainer said so. GitHub's archive flag, or a registry deprecation covering every package the repository publishes. Nothing is inferred and nothing needs corroborating — the record is quoting its subject.

Drought. No human commit for a long time. Deliberately not the repository's push recency, which counts a dependency bot's version bump as a sign of life: projects whose only activity for a year was automated updates report a last push measured in days. Commit authorship is read per commit, and automated authors are excluded. Drought is a necessary condition and never a finding on its own.

Unmet obligations. The corroborating signals — pull requests left unanswered, issues left unanswered, a published fix left unapplied, releases stalled, continuous integration broken, a sole maintainer absent, or OpenSSF Scorecard independently reporting the project unmaintained. Each is a duty the project is visibly not discharging.

Guards. Evidence that someone is still there, or that nothing is being asked of them: a maintainer still replying, nothing open to answer, a release within the year, no affected dependency. Two guards hold the result short of a finding however many obligations fired, because both readings — "someone is answering" and "nobody is asking" — fully explain the silence.

What the states mean

Anything the data cannot answer is unverified and costs the repository nothing. An unauthenticated scan reads no commit sample and no tracker queues, so it can reach no conclusion — recorded as an absence of evidence rather than evidence of absence.

Reading the result

• The alert names its evidence. The drought length is stated with the obligations beside it, so the finding can be checked rather than trusted.
• The drought may be a floor. The commit sample is bounded; when it holds no human commit at all, the true gap predates the window and is reported as "at least" that long.
• A finding is not a verdict on the maintainers. Projects are abandoned for ordinary reasons — jobs change, interest moves, people fall ill. The record states what a consumer would find, not why.
• Automation does not rescue a project here, and does not condemn it either. Bot commits are excluded from the drought calculation, so a repository kept warm by a dependency bot reads as quiet as it truly is. Heavy automation beside recent human work is not a signal at all — see development activity.

Improving the value

• Answer what is open, or close it. An unanswered queue is the single strongest contributor to a finding.
• Apply published security fixes to dependencies, or state why they do not apply.
• If the project is finished rather than abandoned, say so — archiving it, or marking its packages deprecated, replaces an inference with a fact.

Related: development activity · maintainer resilience · Vitality