ALL-DEPE0001 · dependency_technical_lag
Measure resolved dependencies lagging their latest compatible release.
This is a deterministic rule for all languages. Read its implementation.
Definition
Section titled “Definition”Collect current dependency evidence in memory and compare exact release timestamps. Divide
in-scope dependencies whose latest compatible release is more than
maximum_release_lag_days newer than the resolved release by all in-scope dependencies with
complete timestamp evidence.
Evidence
Section titled “Evidence”Findings retain the declared requirement, exact resolved and compatible versions, resolved version age, release lag, artifact location, and stable evidence identifiers. Missing upstream facts remain explicit provider failures and do not become maintenance conclusions. The value is the percentage of measurable dependencies lagging past the configured window.
Exceptions
Section titled “Exceptions”The comparison uses the latest release compatible with the declared requirement. Local, VCS, or
otherwise unresolved dependencies remain outside the denominator until evidence is known.
Package maintenance, archival, and deprecation are separate observations. Development
dependencies stay out of both sides unless include_development asks for them, since a lagging
test tool and a lagging runtime dependency carry very different risk.
Examples
Section titled “Examples”Four dependencies beyond the configured lag among forty measurable dependencies produce 10.
A year-old resolved release matching the latest compatible release does not count as lag. The
value counts what lags rather than what is current, so the bound is a ceiling in the way its
sibling ALL-DEPE0004 states one.
References
Section titled “References”- Cites “PyPI API documentation”, release upload timestamps. Open reference
- Cites “Python Packaging User Guide”, dependency specification. Open reference