npmの非推奨警告は効かない——衰退を駆動するのは下流のロックファイル

import datetime as dt
import requests

REGISTRY = "https://registry.npmjs.org/{pkg}"
DOWNLOADS = "https://api.npmjs.org/downloads/range/{start}:{end}/{pkg}"


def acquire(pkg, start=dt.date(2021, 1, 1), session=None):
    s = session or requests.Session()

    def get(url):
        r = s.get(url, timeout=30)
        r.raise_for_status()
        return r.json()

    meta = get(REGISTRY.format(pkg=pkg))
    times = meta.get("time", {})
    dep_versions = {v: d["deprecated"]
                    for v, d in meta.get("versions", {}).items() if "deprecated" in d}
    first_dep = min((times[v] for v in dep_versions if v in times), default=None)

    rows, cur, today = [], start, dt.date.today()
    while cur < today:  # API caps each range at 365 days; stitch windows
        end = min(cur + dt.timedelta(days=364), today)
        try:
            rows += get(DOWNLOADS.format(start=cur, end=end, pkg=pkg)).get("downloads") or []
        except requests.RequestException as e:
            print(f"window {cur}:{end} failed: {e}")
        cur = end + dt.timedelta(days=1)

    return {"pkg": pkg, "latest": meta.get("dist-tags", {}).get("latest"),
            "deprecated_since": first_dep, "dep_versions": dep_versions, "downloads": rows}


if __name__ == "__main__":
    import json, sys
    print(json.dumps(acquire(sys.argv[1] if len(sys.argv) > 1 else "left-pad"), indent=2))

import pandas as pd, numpy as np
from scipy import stats
from lifelines.statistics import logrank_test

# Expect a CSV of deprecated npm packages with the columns referenced below.
df = pd.read_csv("deprecated_npm_packages.csv")
# columns: package, n_dependents, months_to_decay (weekly dl < 10% of peak),
#          decayed (1=event observed,0=censored), peak_weekly_downloads,
#          msg_names_replacement (0/1), security_advisory (0/1)

# --- H1: dependents -> longer survival tail (log-rank) ---
has = df[df.n_dependents >= 1]
no  = df[df.n_dependents == 0]
lr = logrank_test(has.months_to_decay, no.months_to_decay,
                  event_observed_A=has.decayed, event_observed_B=no.decayed)
p90 = df.groupby(df.n_dependents.ge(1)).months_to_decay.quantile(0.90)
print("H1 90th-pct lifetime (no/has dependents):\n", p90)
print("H1 log-rank p =", lr.p_value)

# --- H2: replacement-named message -> shorter lifetime (OLS on log peak) ---
import statsmodels.formula.api as smf
df["log_peak"] = np.log1p(df.peak_weekly_downloads)
m = smf.ols("months_to_decay ~ msg_names_replacement + log_peak", data=df).fit()
print("\nH2 replacement coef =", m.params["msg_names_replacement"],
      " p =", m.pvalues["msg_names_replacement"])
print("H2 median by flag:\n", df.groupby("msg_names_replacement").months_to_decay.median())

# --- H3: security advisory -> faster decay (Mann-Whitney U) ---
sec  = df.loc[df.security_advisory == 1, "months_to_decay"]
nsec = df.loc[df.security_advisory == 0, "months_to_decay"]
u, p = stats.mannwhitneyu(sec, nsec, alternative="less")
print("\nH3 median (security/non):", sec.median(), nsec.median())
print("H3 Mann-Whitney U =", u, " p =", p)

git clone https://github.com/example/npm-deprecation-decay.git
cd npm-deprecation-decay
python3 -m venv .venv && source .venv/bin/activate
pip install requests pandas numpy scipy lifelines statsmodels
python fetch.py left-pad > data/left-pad.json   # repeat per package, build CSV
python analyze.py                                # runs H1–H3 on deprecated_npm_packages.csv