{"id":"76951313-9db4-467c-80d0-2e2a5d7f7875","arxiv_id":"2502.00615","paper_version":2,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":4.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":5,"one_line_summary":"Roughly 25% of qualifying Maven libraries stop releasing within their first year, and release slowdowns or long inactivity usually precede abandonment, while some abandoned libraries speed up near the end.","lead":"This paper studies ten years of Maven Central release records and finds that roughly one in four libraries stop releasing within their first year. It also shows that slowing release cadence and long inactive periods often, though not always, come before a library is abandoned.","discovery_kind":"extension","skeptic_critique":{"model":"deepseek-v4-flash","headline":"The one-in-four abandonment claim is computed after excluding single-release and younger-than-one-year libraries, so it may understate true ecosystem abandonment; include the excluded libraries to check the headline.","rationale":"The paper has real strengths: it uses a large ecosystem graph, makes replication materials available, and its qualitative conclusion that abandonment is common is likely robust. The reader's conditional verdict is appropriate. The most load-bearing weakness is the mismatch between the abstract's ecosystem-level phrasing and the Section II.A filter that removes 38.7% of libraries, especially single-release libraries. Because a single-release library's only release is also its latest release, any such library created before September 2022 is automatically abandoned within its first year under Section II.B; excluding all of them from Table II makes the one-in-four figure a statement about multi-release, at-least-one-year-old libraries only. If the excluded group raises the inclusive first-year rate substantially, the headline claim in the abstract would need to be scoped or revised. The RQ2 release-pattern conclusions also deserve scrutiny because slowdown and inactivity partly overlap with the two-year inactivity definition, but I did not select that as the primary concern because the head-to-head comparison with active libraries provides some independent signal. My recommendation is to keep the conditional verdict; the re-analysis on the unfiltered set is a concrete way to decide.","tokens_in":8033,"tokens_out":8892,"duration_ms":92508,"concrete_test":"Re-run the Table II cohort analysis on the unfiltered release dataset: include all libraries with at least one release, keep only libraries whose first release is at least one year before September 4, 2024, and compute the fraction of each 2015-2021 cohort whose latest release occurs within one year of first release. Compare the resulting first-year abandonment rates to the 21.4%-26.7% reported in Table II. If the inclusive rates are materially higher, the one-in-four claim is an artifact of the Section II.A filtering. Also report the number of single-release libraries per cohort so the magnitude of the excluded group is explicit.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The abstract and RQ1 Summary claim approximately one in four Maven libraries fail to survive beyond their creation year. This figure is computed from Table II after the Section II.A filter removes libraries with a single release and libraries created less than one year before the observation window; the retained set is 403,048 libraries, only 61.3% of the original set. For the 2015-2021 cohorts, every excluded single-release library has its only release before September 2022 and therefore satisfies the Section II.B definition of abandonment within its first year; removing all of them selectively removes the easiest-to-count abandoned libraries. Including them would raise the first-year abandonment rate for those cohorts, so the headline number is not yet established as a property of all Maven libraries. The paper's qualitative conclusion that abandonment is common may survive, but the approximately one-in-four figure is currently a property of the filtered study population unless the authors show otherwise.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper analyzes library abandonment in the Maven Central ecosystem using release data from September 2014 to September 2024. After filtering to 403,048 libraries with at least two releases and at least one year of history, the authors define a library as abandoned if it has no releases in the last two years of the observation window. RQ1 reports annual abandonment rates and cohort-based first-year abandonment rates, leading to the headline claim that approximately one in four Maven libraries fail to survive beyond their creation year. RQ2 categorizes libraries by lifespan and release speed and examines quartile-level release patterns, concluding that slowdown and inactivity often precede abandonment, although some abandoned libraries release rapidly at the end. The paper includes a replication package and discusses threats to validity.","tokens_in":8198,"tokens_out":4082,"duration_ms":42871,"significance":"If the claims are established, the paper would provide a useful descriptive baseline for abandonment in a major package ecosystem and would support the practical recommendation that dependency monitoring should watch for release slowdowns. The study's strengths include its large real-world dataset, its cohort-based time-to-event view, the explicit operationalization of abandonment, and the availability of a replication package. However, the load-bearing quantitative claim and the early-warning interpretation both require substantial qualification because of the filtering rule and the way abandonment is defined.","major_comments":[{"comment":"The headline claim that approximately one in four libraries are abandoned within their first year is computed on a filtered dataset of 403,048 libraries, which is only 61.3% of the original set. The filtering excludes libraries with only a single release and libraries created less than one year before the observation window. For the 2015-2021 cohorts, a single-release library whose only release predates September 2022 satisfies the Section II.B abandonment definition within its first year; excluding these libraries therefore systematically removes easy-to-count abandoned libraries and makes the one-in-four figure an underestimate if the excluded libraries are representative of the full population. Please recompute the cohort rates including the single-release libraries as a sensitivity analysis, or explicitly restate the RQ1 claim as conditional on the filtered population.","section":"Section II.A and RQ1 Summary (Tables I-II)"},{"comment":"Because abandonment is defined as having no releases in the last two years of the observation window, the RQ2 finding that abandoned libraries show slowdown and inactivity is partly encoded in the definition itself. A library labeled abandoned under this rule necessarily has at least two final years with no releases, which will appear as slow or 'nan' quartiles in the pattern analysis of Table IV. The text describes these patterns as 'precursors' and 'signals,' but the analysis uses the full lifespan including the abandonment-defining period. To support the early-warning framing, estimate release activity up to a fixed cutoff before the end of the observation window and test whether that earlier activity distinguishes subsequently abandoned libraries from active ones.","section":"Section II.B and Section IV.B"},{"comment":"The pattern analysis covers only 18.2% of abandoned and 26.2% of active libraries, and the top patterns are dominated by quartiles with no releases ('nan'). These 'nan' patterns are direct consequences of the two-year abandonment definition and the quartile partition, so they do not by themselves establish that inactivity is a behavioral precursor rather than a tautological artifact. In addition, the thresholds (20% deviation, quartile grouping, and the minimum of four releases) are introduced without sensitivity analysis. Please report the distribution of all patterns, not only the top ten, and compare the observed patterns with a baseline such as random release times to quantify the discriminative value.","section":"Section IV.B and Tables IV-V"}],"minor_comments":[{"comment":"The percentage columns appear to be computed over libraries with at least four releases, not over all libraries, because the stated top-10 coverage (18.2% and 26.2%) is inconsistent with the sum of the listed percentages. The denominator should be stated explicitly in the caption or the text.","section":"Section IV.B, Tables IV and V"},{"comment":"The original library count is not stated directly; the numbers 635,003 (96.5%), 581,424, and 403,048 (61.3%) can be reconciled, but the reporting would be clearer if the initial total and the exclusions were presented in one flow.","section":"Section II.A"},{"comment":"The column heading 'within 5 and remaining years' is ambiguous for cohorts with less than five years of follow-up. Consider presenting cumulative abandonment rates for each elapsed year or using a consistent time-to-event notation.","section":"Table II"},{"comment":"The phrase 'fail to survive beyond their creation year' is looser than the operational definition, which uses the latest release date as the abandonment date. Aligning the wording with the definition would avoid overstating the result.","section":"Abstract and RQ1 Summary"},{"comment":"The study is descriptive and does not provide confidence intervals or significance tests. This is acceptable for an exploratory analysis, but it would strengthen the paper to report at least basic uncertainty around the key percentages in Tables I and II.","section":"Throughout"}],"recommendation":"major_revision","confidential_remarks":"The replication package and large dataset are genuine strengths, and the qualitative conclusion that abandonment is common in Maven may survive the filtering criticism. However, the one-in-four headline is currently an artifact of a filtered study population and should be re-estimated or explicitly scoped. The RQ2 'early warning' interpretation also needs a temporal holdout design to avoid being definitional. These issues are fixable within the scope of the manuscript, so major revision is appropriate rather than rejection."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Two things to know about this paper. First, the headline \"one in four libraries fail within their first year\" is computed on a filtered set that excludes single-release and too-new libraries, so it is an underestimate for the whole ecosystem, not a property of all Maven libraries. Second, the RQ2 finding that slowdown precedes abandonment is partly baked into the abandonment definition; every abandoned library by definition has no releases in the final two years, which shows up as \"nan\" patterns in the quartile analysis.\n\nThat said, the paper does useful descriptive work. It uses a large, current Maven Central dataset and ships a replication package. The quartile-based release trajectory analysis is new relative to prior ecosystem abandonment studies; Jaime et al. introduced release speed but did not tie quartile trajectories to abandonment. The paper is also honest about the two-year cutoff in its threats section, even if it does not fully resolve the filtering issue.\n\nThe soft spots are the ones I mentioned. Excluding single-release libraries is reasonable for pattern analysis but not for the prevalence claim. For the 2015-2021 cohorts, essentially every excluded single-release library is abandoned by the paper's own definition, so including them would raise the first-year rate, potentially well above 25%. The authors should report a sensitivity analysis or qualify the abstract. Similarly, the \"slowdown\" patterns in RQ2 are partly definitional: Q4 is \"nan\" for most abandoned libraries because the last release is the endpoint. The paper acknowledges the definitional threat but does not decompose which patterns are forced by the definition versus genuinely predictive. Finally, there are no confidence intervals or significance tests, though with sample sizes in the tens of thousands, that is a minor point.\n\nWho should read this: practitioners building dependency-health tooling will find the descriptive numbers useful, and researchers studying ecosystem survival can use it as a data point. It is not a breakthrough, but it is a competent empirical study.\n\nMy recommendation: send it to peer review. A good reviewer can ask for the sensitivity analysis on the filtered set and a sharper treatment of the circularity. The replication package makes those checks feasible. I would not desk reject it.","headline":"The one-in-four abandonment headline is an artifact of a filtered sample; the paper is still a useful descriptive study.","tokens_in":8735,"tokens_out":4992,"would_cite":false,"duration_ms":47269,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"The Maven ecosystem abandons roughly one in four new libraries within their first year, and release slowdowns offer a detectable warning — though final bursts of fast releases are not a reliable sign of health.","keywords":["Maven ecosystem","library abandonment","release speed","early-warning signal","software supply chain","open-source sustainability","dependency risk","ecosystem health"],"falsifier":"Re-run the cohort analysis on the full 635,003-library set without dropping single-release libraries, classifying any library whose first release is also its last as abandoned in its creation year; if the first-year abandonment rate among those excluded libraries is materially above 25%, the one-in-four headline is an artifact of the filter. A second check is to extend the observation window by one year and see whether the 2022 cohort's abandonment rate rises from 14.8% toward the 20%+ plateau, which would confirm the depressed recent rate is a window-edge effect rather than an ecosystem improvement.","tokens_in":7812,"feed_emoji":"⚠️","tokens_out":7760,"duration_ms":67685,"temperature":0.7,"pith_summary":"This paper sets out to measure how common library abandonment is in the Maven ecosystem and whether release activity can warn of it in advance. Analysing a decade of release records for 403,048 libraries, it reports that roughly one in four libraries created between 2015 and 2021 were abandoned within their first year, with annual abandonment rates between 20.9% and 24.4%. It then claims that release cadence carries a signal: abandoned libraries typically slow down or fall silent before their final release, while active libraries mostly keep a steady rhythm. The stakes are practical — an abandoned dependency can carry unpatched bugs and security holes, so an observable early-warning sign would help developers and package platforms manage supply-chain risk.","feed_headline":"One in four Maven libraries dies in its first year","feed_subtitle":"Annual abandonment tops 20 percent from 2015 to 2021, and slower release cadence is an early-warning signal.","key_machinery":"The load-bearing instrument is the operational definition of abandonment: a library is abandoned if it has no releases in the final two years of an observation window ending September 4, 2024, and its abandonment date is its last release. Around that definition the paper builds two measuring tools: release speed (average releases per day, month, or year, a metric it borrows from earlier Maven rhythm-and-speed work) and a quartile pattern analysis in which each quarter of a library's lifespan is labelled Fast, Normal, or Slow relative to that library's own average release interval, with 'nan' marking quartiles containing no releases. Cohort-based time-to-event tables then convert these per-library labels into cumulative abandonment rates by creation year. The quartet of definition, speed metric, quartile labels, and cohort tables is what lets the paper turn raw release timestamps into claims about ecosystem health.","core_discovery":"On the authors' own terms, the discovery is that abandonment is a mainstream event in the Maven ecosystem, not a tail risk: across the 2015–2021 creation cohorts, 21.4%–26.7% of libraries made no release after their first year, and the two-year cumulative abandonment rate reached 39.7%–48.1%. The second discovery is in the release-pattern analysis: when a library's lifespan is split into four quartiles, abandoned libraries most often show a slowdown signature — for instance 'Fast → Slow → nan' quartile patterns — or long inactive stretches, whereas active libraries most commonly show a uniform 'Normal → Normal → Normal → Normal' cadence. The paper also finds an important nuance: about a fifth of abandoned libraries released quickly throughout their lives, and some sped up at the very end, so fast release speed alone does not prove a library is healthy.","pith_inferences":["If the single-release libraries removed by the filtering step were counted, the true first-year mortality share of all Maven libraries could well be higher than one in four, since a library that never got a second release is the most natural candidate for abandonment; re-running the cohort analysis without that filter is a direct test.","The two-year cutoff interacts with the observation window's end: the depressed 2022 abandonment rate (14.8%) is likely an artifact of truncation, and extending the window by another year should pull recent cohorts up toward the sustained 20%+ plateau.","The quartile labels could be converted into a genuine predictive model — for example, flagging a 'Fast → Slow' transition early in a library's life — and scored for precision and recall against the release history that follows; the paper reports descriptive patterns, not prediction.","Running the same measurement on npm or PyPI would test whether a ~25% first-year abandonment rate and a release-slowdown signature are general properties of package ecosystems or specific to Maven's governance culture."],"forward_implications":["Developers who watch a dependency's release cadence can treat a sustained slowdown or a release gap approaching two years as an early-warning signal that the library may soon fall silent.","The second year of a library's life is the steepest risk period: cumulative abandonment reaches roughly 40–48% by the end of year two, so surviving that window is a meaningful durability milestone.","Package platforms could automate alerts for libraries showing plateaued or slowed release patterns, which is the paper's own suggested intervention for ecosystem-level risk.","Because 21.3% of abandoned libraries had high release speeds, release count alone is a poor risk meter; cadence trends and inactivity matter more than raw frequency.","A late burst of fast releases is not a reliable sign of recovery — several top patterns show abandoned libraries speeding up in their final quartile before the silence."],"supporting_citations":[{"why":"Supplies the Maven Central Neo4j dataset from which all release records are extracted.","marker":"[13]"},{"why":"Provides the Goblin framework used to enrich and query the Maven Central dependency graph.","marker":"[14]"},{"why":"Introduces the release-speed metric (releases per time) that the quartile analysis builds on.","marker":"[15]"},{"why":"Prior survival analysis across four ecosystems, providing the baseline showing abandonment is widespread.","marker":"[10]"},{"why":"The prior npm abandonment study whose maintainer-notification approach leaves the gap this paper fills with data-driven release indicators.","marker":"[11]"}],"fun_headline_variants":["22% of Maven libraries never make a second release","Slow release cadence is a Maven abandonment warning","Fast releases don't keep Maven libraries alive","Nearly half of Maven libraries vanish in two years","Abandonment in Maven: slow releases are the tell"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The headline one-in-four figure is computed on a filtered set of libraries — those with at least two releases and at least one year of history — and the paper assumes this set fairly represents the whole ecosystem; if the excluded single-release libraries fail at even higher rates, the true abandonment share is understated rather than measured.","fun_headline_variants_meta":{"raw":{"variants":["22% of Maven libraries never make a second release","Slow release cadence is a Maven abandonment warning","Fast releases don't keep Maven libraries alive","Nearly half of Maven libraries vanish in two years","Abandonment in Maven: slow releases are the tell"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000551,"raw_usage":{"total_tokens":2584,"prompt_tokens":857,"completion_tokens":1727,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":473,"completion_tokens_details":{"reasoning_tokens":1649}},"tokens_in":473,"tokens_out":1727,"duration_ms":11699,"temperature":1.0,"reasoning_tokens":1649,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-09T18:17:21.981416+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Re-run the cohort analysis on the full 635,003-library set without dropping single-release libraries, classifying any library whose first release is also its last as abandoned in its creation year; if the first-year abandonment rate among those excluded libraries is materially above 25%, the one-in-four headline is an artifact of the filter. A second check is to extend the observation window by one year and see whether the 2022 cohort's abandonment rate rises from 14.8% toward the 20%+ plateau, which would confirm the depressed recent rate is a window-edge effect rather than an ecosystem improvement.","supporting_citations":[{"cited_title":"Navigating and ex ploring software dependency graphs using goblin,","cited_arxiv_id":null,"evidence_quote":"Supplies the Maven Central Neo4j dataset from which all release records are extracted."},{"cited_title":"A preliminary stu dy of rhythm and speed in the maven ecosystem,","cited_arxiv_id":null,"evidence_quote":"Introduces the release-speed metric (releases per time) that the quartile analysis builds on."},{"cited_title":"An empirical st udy on the survival rate of github projects,","cited_arxiv_id":null,"evidence_quote":"Prior survival analysis across four ecosystems, providing the baseline showing abandonment is widespread."},{"cited_title":"Understanding the response to open-source dependency aba ndonment in the npm ecosystem,","cited_arxiv_id":null,"evidence_quote":"The prior npm abandonment study whose maintainer-notification approach leaves the gap this paper fills with data-driven release indicators."}],"review_version":1}