MaintainerPulse

temporal prediction of dependency maintenance risk

defusedxml tiran/defusedxml ▲ high risk

77%

no release in the next 12 months

70%

new issues will go unanswered (30 days)

100%

maintainer activity collapse within 12 months

13%

chance of a release within 12 months (survival model)

Model risk over time

calibrated P(no release next 12mo) at each historical monthly snapshot

Repository activity, last 36 months

pushes issues PyPI release

What drives this score

TreeSHAP contributions; raises risk / lowers risk

Survival curve

P(still no release) m months ahead, discrete-time hazard model

What if? — poke the model

drag a signal and the deployed models rescore this package live (implied signals move together — two years without a release also zeroes "releases, last 12mo"). The needle tracks the activity-collapse model, a logistic regression: monotone by construction, so it responds smoothly to counterfactuals where the tree models step.

maintainer activity collapse, 12mo

In plain words

no PyPI release in 35 months
no pushes to the repository in 35 months

Maintained alternatives

similar packages with low predicted risk; ranked by summary similarity blended with shared-dependents overlap, validated against known migrations

package	what it is	similarity	shared dependents	its 12mo risk
signxml	Python XML Signature and XAdES library	0.49	0	6%
xdis	Python cross-version byte-code disassembler and marshal routines	0.49	0	9%
lxml	Powerful and Pythonic XML processing library combining libxml2/libxslt with the ElementTre	0.47	2	1%

Signals at the latest snapshot

days since last release	1068	releases, last 12mo	0
people pushing, last 12mo	0	bus factor (top pusher share)	-
issues opened, last 12mo	0	30-day response rate	no issues
stars accumulated	524	open vulns without fix	0

Probabilities are isotonic-calibrated on a held-out validation year and evaluated on future snapshots the models never saw (PR-AUC 0.894, precision@50 = 1.00 on the headline target).