Dependency releases · Snapshot 2026-10-26
What happened to dependency releases.
Which stable releases did maintainers pull, and which were followed by a patch within days? Explore 200 of the most-updated packages from a curated candidate pool across npm, PyPI and crates.io over the snapshot’s last 12 months.
These are outcomes, not predictions. They are the history Rework Risk learns from for dependency-bump pull requests.
- Stable releases
- 9,343
- Pulled or quickly fixed
- 894
- Packages
- 200
200 of 200 packages · Scroll the table to see all columns.
| npm | ai | 649 | 58 | 8.9% | 7.0.153 |
|---|---|---|---|---|---|
| npm | vercel | 314 | 67 | 21.3% | 65.2.0 |
| npm | @cloudflare/workers-types | 277 | 1 | 0.4% | 5.20261026.1 |
| PyPI | boto3 | 240 | 3 | 1.3% | 1.43.118 |
| PyPI | botocore | 240 | 3 | 1.3% | 1.43.118 |
| npm | @aws-sdk/client-s3 | 221 | 0 | 0.0% | 3.1156.0 |
| npm | @aws-sdk/client-dynamodb | 220 | 0 | 0.0% | 3.1156.0 |
| npm | electron | 199 | 3 | 1.5% | 45.0.0 |
| PyPI | awscli | 189 | 2 | 1.1% | 1.46.2 |
| npm | @types/node | 142 | 20 | 14.1% | 26.6.5 |
| npm | wrangler | 142 | 12 | 8.5% | 4.153.0 |
| PyPI | hypothesis | 142 | 25 | 17.6% | 6.170.11 |
| npm | expo | 133 | 14 | 10.5% | 58.0.19 |
| PyPI | fastapi | 124 | 30 | 24.2% | 0.162.0 |
| npm | knip | 115 | 9 | 7.8% | 6.43.0 |
| npm | astro | 113 | 16 | 14.2% | 7.4.2 |
| npm | @angular/cli | 110 | 4 | 3.6% | 21.2.28 |
| PyPI | uv | 103 | 9 | 8.7% | 0.13.5 |
| npm | @angular/core | 101 | 6 | 5.9% | 22.2.3 |
| PyPI | openai | 101 | 7 | 6.9% | 3.37.0 |
| npm | svelte | 97 | 15 | 15.5% | 5.57.2 |
| npm | @anthropic-ai/sdk | 94 | 8 | 8.5% | 1.3.0 |
| PyPI | anthropic | 93 | 6 | 6.5% | 2.3.0 |
| npm | @supabase/supabase-js | 92 | 10 | 10.9% | 2.118.0 |
| npm | lucide-react | 92 | 1 | 1.1% | 1.61.0 |
| npm | next | 88 | 23 | 26.1% | 16.4.3 |
| npm | eslint-config-next | 88 | 10 | 11.4% | 16.4.3 |
| npm | openai | 87 | 0 | 0.0% | 7.44.0 |
| npm | storybook | 86 | 6 | 7.0% | 10.6.4 |
| npm | @storybook/react | 86 | 6 | 7.0% | 10.6.4 |
| PyPI | langchain-core | 85 | 6 | 7.1% | 1.7.0 |
| npm | langchain | 84 | 14 | 16.7% | 1.5.19 |
| npm | framer-motion | 83 | 16 | 19.3% | 14.6.0 |
| PyPI | tox | 81 | 9 | 11.1% | 4.67.1 |
| npm | mongoose | 80 | 1 | 1.3% | 9.11.4 |
| npm | @langchain/core | 78 | 14 | 17.9% | 1.3.0 |
| npm | turbo | 76 | 10 | 13.2% | 2.11.10 |
| npm | @tanstack/react-query | 76 | 12 | 15.8% | 5.105.0 |
| npm | @sentry/node | 76 | 4 | 5.3% | 11.9.0 |
| npm | @sentry/react | 76 | 4 | 5.3% | 11.9.0 |
| npm | @sentry/nextjs | 76 | 4 | 5.3% | 11.9.0 |
| PyPI | huggingface-hub | 74 | 15 | 20.3% | 2.3.0 |
| npm | nx | 70 | 7 | 10.0% | 24.0.1 |
| npm | aws-cdk | 67 | 7 | 10.4% | 2.1146.1 |
| npm | hono | 66 | 10 | 15.2% | 4.13.14 |
| PyPI | virtualenv | 66 | 11 | 16.7% | 21.14.13 |
| npm | aws-cdk-lib | 65 | 5 | 7.7% | 2.274.0 |
| npm | oxlint | 65 | 1 | 1.5% | 1.89.0 |
| npm | undici | 64 | 3 | 4.7% | 8.12.3 |
| npm | @sveltejs/kit | 60 | 6 | 10.0% | 3.1.0 |
| PyPI | filelock | 60 | 7 | 11.7% | 4.2.4 |
| PyPI | langchain | 59 | 12 | 20.3% | 1.4.7 |
| npm | vite | 52 | 8 | 15.4% | 8.3.5 |
| npm | rollup | 52 | 6 | 11.5% | 4.65.1 |
| npm | @biomejs/biome | 52 | 5 | 9.6% | 2.6.3 |
| PyPI | ruff | 49 | 3 | 6.1% | 0.17.2 |
| npm | puppeteer | 48 | 5 | 10.4% | 25.16.0 |
| npm | @typescript-eslint/parser | 46 | 0 | 0.0% | 8.72.0 |
| npm | @typescript-eslint/eslint-plugin | 46 | 0 | 0.0% | 8.72.0 |
| npm | typescript-eslint | 46 | 0 | 0.0% | 8.72.0 |
| npm | @react-navigation/native | 46 | 11 | 23.9% | 7.5.1 |
| npm | @nestjs/core | 43 | 8 | 18.6% | 11.2.8 |
| npm | @nestjs/common | 43 | 8 | 18.6% | 11.2.8 |
| PyPI | transformers | 43 | 11 | 25.6% | 5.20.2 |
| npm | electron-builder | 39 | 3 | 7.7% | 26.18.1 |
| PyPI | platformdirs | 39 | 6 | 15.4% | 4.13.5 |
| PyPI | gradio | 38 | 3 | 7.9% | 6.30.0 |
| npm | vitest | 37 | 3 | 8.1% | 4.1.12 |
| npm | mysql2 | 37 | 5 | 13.5% | 3.24.6 |
| PyPI | sentry-sdk | 37 | 2 | 5.4% | 2.73.0 |
| npm | @apollo/client | 36 | 5 | 13.9% | 4.3.5 |
| npm | msw | 35 | 6 | 17.1% | 3.0.3 |
| npm | @swc/core | 34 | 5 | 14.7% | 1.16.20 |
| npm | react-router | 34 | 3 | 8.8% | 8.5.0 |
| npm | stripe | 34 | 3 | 8.8% | 23.0.1 |
| npm | @types/react | 32 | 3 | 9.4% | 19.3.0 |
| PyPI | google-auth | 32 | 2 | 6.3% | 2.62.0 |
| npm | webpack | 31 | 6 | 19.4% | 5.112.2 |
| npm | sass | 31 | 6 | 19.4% | 1.106.1 |
| npm | react-hook-form | 31 | 1 | 3.2% | 7.91.0 |
| PyPI | django | 31 | 0 | 0.0% | 5.2.18 |
| npm | nuxt | 30 | 0 | 0.0% | 4.6.2 |
| npm | react | 29 | 3 | 10.3% | 19.1.10 |
| npm | react-dom | 29 | 3 | 10.3% | 19.1.10 |
| npm | cypress | 29 | 1 | 3.4% | 16.2.0 |
| npm | inquirer | 28 | 6 | 21.4% | 14.2.4 |
| npm | eslint | 27 | 0 | 0.0% | 10.13.0 |
| npm | zod | 27 | 7 | 25.9% | 4.6.7 |
| PyPI | polars | 27 | 10 | 37.0% | 2.1.0 |
| npm | react-router-dom | 26 | 2 | 7.7% | 7.18.4 |
| npm | fastify | 26 | 7 | 26.9% | 5.12.7 |
| PyPI | typer | 26 | 3 | 11.5% | 0.27.3 |
| npm | postcss | 25 | 7 | 28.0% | 8.5.31 |
| npm | react-native | 25 | 2 | 8.0% | 0.88.0 |
| npm | axios | 24 | 3 | 12.5% | 0.34.0 |
| npm | tsx | 24 | 4 | 16.7% | 4.23.15 |
| npm | lint-staged | 24 | 5 | 20.8% | 17.6.0 |
| npm | styled-components | 24 | 6 | 25.0% | 6.6.0 |
| PyPI | starlette | 24 | 5 | 20.8% | 1.10.0 |
| crates.io | tokio | 24 | 1 | 4.2% | 1.54.1 |
| PyPI | coverage | 23 | 4 | 17.4% | 7.17.0 |
| PyPI | streamlit | 23 | 3 | 13.0% | 1.66.1 |
| npm | prettier | 22 | 5 | 22.7% | 3.9.10 |
| npm | vue | 22 | 3 | 13.6% | 3.5.44 |
| npm | @vue/compiler-sfc | 22 | 3 | 13.6% | 3.5.44 |
| npm | nanoid | 22 | 4 | 18.2% | 6.0.2 |
| npm | mapbox-gl | 22 | 1 | 4.5% | 3.33.0 |
| PyPI | uvicorn | 22 | 3 | 13.6% | 0.54.0 |
| npm | @astrojs/react | 21 | 1 | 4.8% | 7.1.1 |
| npm | @hookform/resolvers | 21 | 7 | 33.3% | 6.0.0 |
| crates.io | syn | 21 | 2 | 9.5% | 3.0.9 |
| npm | joi | 20 | 7 | 35.0% | 18.3.0 |
| npm | @commitlint/cli | 20 | 0 | 0.0% | 21.2.4 |
| npm | prisma | 20 | 0 | 0.0% | 7.10.1 |
| npm | @prisma/client | 20 | 0 | 0.0% | 7.10.1 |
| PyPI | google-api-core | 20 | 2 | 10.0% | 2.43.0 |
| npm | firebase | 19 | 0 | 0.0% | 13.1.0 |
| crates.io | clap | 19 | 2 | 10.5% | 4.6.7 |
| PyPI | sqlalchemy | 18 | 3 | 16.7% | 2.1.6 |
| PyPI | google-cloud-storage | 18 | 0 | 0.0% | 3.17.1 |
| crates.io | uuid | 18 | 0 | 0.0% | 1.29.0 |
| npm | jotai | 17 | 0 | 0.0% | 3.0.1 |
| npm | @opentelemetry/sdk-node | 17 | 0 | 0.0% | 0.300.0 |
| npm | ws | 17 | 3 | 17.6% | 8.22.0 |
| npm | @mui/material | 17 | 2 | 11.8% | 9.5.0 |
| PyPI | jupyterlab | 17 | 0 | 0.0% | 4.5.11 |
| PyPI | ipython | 17 | 0 | 0.0% | 9.17.1 |
| npm | dotenv | 16 | 3 | 18.8% | 18.0.9 |
| PyPI | pydantic-core | 16 | 4 | 25.0% | 2.50.1 |
| PyPI | protobuf | 16 | 1 | 6.3% | 7.36.2 |
| PyPI | datasets | 16 | 3 | 18.8% | 5.1.0 |
| npm | autoprefixer | 15 | 5 | 33.3% | 10.6.1 |
| npm | mobx | 15 | 4 | 26.7% | 7.1.1 |
| npm | @playwright/test | 14 | 1 | 7.1% | 1.64.1 |
| npm | playwright | 14 | 1 | 7.1% | 1.64.1 |
| npm | @vitejs/plugin-react | 14 | 1 | 7.1% | 6.1.2 |
| crates.io | libc | 14 | 2 | 14.3% | 0.2.191 |
| npm | recharts | 13 | 1 | 7.7% | 3.10.1 |
| PyPI | numpy | 13 | 1 | 7.7% | 2.5.4 |
| PyPI | alembic | 13 | 1 | 7.7% | 1.20.1 |
| PyPI | redis | 13 | 0 | 0.0% | 8.1.0 |
| PyPI | grpcio | 13 | 2 | 15.4% | 1.85.0 |
| PyPI | notebook | 13 | 0 | 0.0% | 7.5.8 |
| npm | @babel/preset-env | 12 | 2 | 16.7% | 8.0.7 |
| npm | tailwindcss | 12 | 1 | 8.3% | 4.3.3 |
| npm | esbuild | 12 | 1 | 8.3% | 0.28.2 |
| npm | nock | 12 | 2 | 16.7% | 15.0.5 |
| npm | firebase-admin | 12 | 0 | 0.0% | 14.5.0 |
| npm | graphql | 12 | 1 | 8.3% | 15.10.3 |
| npm | three | 12 | 1 | 8.3% | 0.186.1 |
| PyPI | setuptools | 12 | 1 | 8.3% | 84.2.1 |
| PyPI | pydantic | 12 | 3 | 25.0% | 2.14.1 |
| PyPI | types-requests | 12 | 0 | 0.0% | 2.33.0.20261006 |
| PyPI | duckdb | 12 | 0 | 0.0% | 2.0.0 |
| crates.io | rustls | 12 | 0 | 0.0% | 0.23.46 |
| npm | @radix-ui/react-dialog | 11 | 2 | 18.2% | 1.3.1 |
| PyPI | mypy | 11 | 0 | 0.0% | 2.4.0 |
| PyPI | pylint | 11 | 0 | 0.0% | 4.1.3 |
| PyPI | googleapis-common-protos | 11 | 0 | 0.0% | 1.76.0 |
| PyPI | cryptography | 11 | 0 | 0.0% | 50.0.2 |
| PyPI | tqdm | 11 | 1 | 9.1% | 4.70.1 |
| PyPI | opentelemetry-api | 11 | 1 | 9.1% | 1.45.1 |
| PyPI | opentelemetry-sdk | 11 | 1 | 9.1% | 1.45.1 |
| PyPI | poetry | 11 | 2 | 18.2% | 2.5.1 |
| npm | @babel/core | 10 | 2 | 20.0% | 8.0.9 |
| npm | lerna | 10 | 1 | 10.0% | 10.1.1 |
| npm | pg | 10 | 1 | 10.0% | 8.23.1 |
| npm | redis | 10 | 1 | 10.0% | 6.3.0 |
| npm | ioredis | 10 | 1 | 10.0% | 6.0.0 |
| npm | glob | 10 | 1 | 10.0% | 13.0.6 |
| PyPI | s3transfer | 10 | 0 | 0.0% | 0.19.3 |
| PyPI | certifi | 10 | 1 | 10.0% | 2026.10.23 |
| PyPI | aiohttp | 10 | 1 | 10.0% | 3.14.5 |
| PyPI | mkdocs-material | 10 | 0 | 0.0% | 9.8.0 |
| crates.io | reqwest | 10 | 2 | 20.0% | 0.13.5 |
| crates.io | rand | 10 | 1 | 10.0% | 0.10.3 |
| npm | body-parser | 9 | 0 | 0.0% | 2.4.0 |
| npm | @react-three/fiber | 9 | 2 | 22.2% | 9.8.2 |
| npm | webpack-cli | 9 | 2 | 22.2% | 7.2.3 |
| PyPI | idna | 9 | 0 | 0.0% | 3.20 |
| PyPI | black | 9 | 1 | 11.1% | 26.10.1 |
| PyPI | hatchling | 9 | 2 | 22.2% | 1.32.4 |
| PyPI | build | 9 | 2 | 22.2% | 1.6.1 |
| crates.io | serde_json | 9 | 3 | 33.3% | 1.0.154 |
| npm | zustand | 8 | 0 | 0.0% | 5.0.16 |
| npm | semantic-release | 8 | 2 | 25.0% | 25.0.9 |
| npm | @changesets/cli | 8 | 0 | 0.0% | 3.0.3 |
| npm | typeorm | 8 | 0 | 0.0% | 1.1.2 |
| npm | uuid | 8 | 0 | 0.0% | 14.0.3 |
| PyPI | charset-normalizer | 8 | 2 | 25.0% | 3.5.2 |
| PyPI | pip | 8 | 0 | 0.0% | 26.2.2 |
| PyPI | pandas | 8 | 1 | 12.5% | 3.1.0 |
| PyPI | psycopg | 8 | 1 | 12.5% | 3.3.6 |
| PyPI | anyio | 8 | 1 | 12.5% | 4.15.1 |
| PyPI | websockets | 8 | 1 | 12.5% | 17.3 |
| PyPI | azure-core | 8 | 0 | 0.0% | 1.41.0 |
| PyPI | azure-storage-blob | 8 | 0 | 0.0% | 12.31.0 |
| PyPI | torch | 8 | 0 | 0.0% | 2.14.1 |
| PyPI | sphinx | 8 | 2 | 25.0% | 9.2.0 |
| crates.io | hyper | 8 | 2 | 25.0% | 1.12.0 |
Shares are omitted for packages with fewer than six releases. Pulled and fixed counts can overlap.
A practical setting
Give a new release three days.
In this snapshot, a 3-day cooldown would have waited past the replacement patch for 851 releases fixed within 72 hours. This describes release timing; it does not establish why a patch was published or guarantee that an update will hold up.
Merge these settings into your existing configuration and adjust the manifest directory. Dependabot applies this to version updates; security updates are handled separately. The Dependabot example covers the ecosystem; the Renovate example applies to all packages.
Dependabot
version: 2
updates:
- package-ecosystem: "npm"
directory: "/"
schedule:
interval: "daily"
cooldown:
default-days: 3Renovate
{
"packageRules": [
{
"minimumReleaseAge": "3 days"
}
]
}Dependabot cooldown reference · Renovate release age reference
This table records what maintainers did after a release. It does not detect compromised or malicious releases. For security, use a dedicated supply-chain scanner. npm removals are unpublished; the registry does not say why.
See this for your own code.
Rework Risk finds the merged pull requests in your repo that later needed corrective work, dependency bumps included.
Get a rework backtest on your repo