What happened to 9,343 dependency releases
A snapshot of pulled and quickly fixed releases across 200 npm, PyPI and crates.io packages.
When a bot opens a dependency-bump pull request, the release history is useful context. We collected stable releases from a curated pool of frequently updated npm, PyPI and crates.io packages, then ranked the pool by releases over the preceding 365 days.
The October 26, 2026 snapshot covers 9,343 releases across 200 packages. Of those releases, 894 were pulled by maintainers or replaced by a patch within 72 hours and unusually quickly for that package. The two counts overlap.
Look up a package’s release history, including @types/node on npm and openai on PyPI.
These are outcomes, not predictions. A quick patch is a timing proxy; it does not establish that the preceding release was defective. A three-day cooldown would have waited past the replacement patches counted here. Each package page includes Dependabot and Renovate examples.
The table does not detect compromised or malicious releases. Unpublished npm releases have no registry explanation. For security, use a dedicated supply-chain scanner. Read the methodology and column definitions before interpreting the counts.
Rework Risk finds the merged pull requests in your repo that later needed corrective work, dependency bumps included. Get a rework backtest on your repo.