MTTX: Dependency Update Metrics
MTTX measures how quickly the developers of an open-source package respond to new dependency releases and to security fixes. For the direct dependencies of an npm, PyPI, or Cargo package, it computes:
- MTTU (Mean Time To Update): how long the dependencies stay behind their newest version.
- MTTR (Mean Time To Remediate): how long the dependencies keep a known vulnerability after a fix is available.
MTTX resolves each version constraint as of a past date, so a value never uses data from the future.
Project homepage: https://imranur-rahman.github.io/dependency-update-metrics/. It has the interactive dashboard, the demo video, and the links to every part.
Use MTTX
Quick start
pip install dependency-update-metrics
# MTTU and MTTR of one package over a time window (the first run builds the OSV index)
dependency-metrics --ecosystem npm --package express \
--start-date 2024-01-01 --end-date 2025-12-31 --build-osv
# The same run in the container image, with the OSV index of that date inside
docker run --rm -v "$PWD:/data" ghcr.io/imranur-rahman/mttx:0.2.1-osv-2026-10-23 \
--ecosystem npm --package express --start-date 2024-01-01 --end-date 2025-12-31 --depsdev
USAGE.md lists every option: batch runs from a CSV file, --per-release, weighting, --json, worksheets, and the cache. ALGORITHM.md describes how MTTU and MTTR are computed.
Project structure
dependency-update-metrics/
├── dependency_metrics/ The Tool: the dependency-metrics CLI and Python package
├── tests/ Tool tests: unit, integration, regression, and metamorphic
├── vendor/pip/ Patched pip fork (git submodule) that resolves PyPI constraints as of a date
├── image/ Container image of the Tool on GHCR
├── host/ Server API, Job queue, and workers behind the interactive dashboard
├── webapp/ Interactive dashboard and project homepage (GitHub Pages)
├── extension/ IDE extension for VS Code and Open VSX, with a demo project
├── action/ GitHub Action, copied to imranur-rahman/mttx-action on release
├── contract/examples/ Shared JSON examples of the result format, which the tests of each part read
├── case_study/ Inputs and scripts of the manual validation of 90 packages
└── docs/ Architecture decision records and cited research
Development
git clone --recurse-submodules https://github.com/imranur-rahman/dependency-update-metrics.git
cd dependency-update-metrics
pip install -e ".[dev]"
pytest tests/ -q
TESTING.md maps each test type to its tests, and AGENTS.md gives the checks and the CI workflow of each part.
Citation
@software{rahman2026dependencyupdatemetric,
title = {Beyond Stars: {MTTX} Brings Developer Responsiveness to Dependency Decisions, from Dashboard to {IDE} to {GitHub} Actions},
author = {Rahman, Imranur and Paramitha, Ranindya and Tamanna, Mahzabin and Williams, Laurie},
year = {2026},
doi = {10.5281/zenodo.23608337},
url = {https://github.com/imranur-rahman/dependency-update-metrics}
}
License
MIT. See LICENSE.
