What the experiment shows.
Explore model diagnosticsRanking packages and forecasting their growth are different capabilities. We report the evidence for each, including failed estimates.
Latest experiment · held-out research diagnostic
This diagnostic retrains a model for its evaluation. It does not measure the exact model serving today, and its overlapping outcome windows do not establish independent forecasting performance.
What was tested
Question and outcome
Predict the change between the next 70 days and the previous 70 days of downloads, using a trailing 28-day smoother. Features describe download levels, trend, and volatility. Downloads measure activity, not unique users or business adoption.
Evaluation and its limit
Origin dates are ordered into train, validation, and test partitions. Their 70-day outcome windows overlap, with no embargo. This is research evidence about ranking, not proof that a model issued today will forecast accurately.
What would strengthen the claim?
Freeze model, origin date, input data version, and prediction before the forecast window begins. After 70 days, compare the exact served predictions with no-change and calibrated persistence baselines. Repeat across non-overlapping origin windows; report uncertainty by package and origin. Until then, predictive usefulness remains unestablished.
Read the model definitions and limitationsA practical application: dependency review
Check your installed versionsHow findings are selected
Security findings require a successful OSV lookup and at least one advisory published in the last 28 days. Maintenance findings flag archived repositories or releases older than 365 days, with successful source checks. These are review rules, not probabilities. The watchlist does not establish whether your installed version is affected.
Download activity
| Package | Last 7 days | Prior 7 days | Change |
|---|
Ranked by absolute percentage change. Downloads include bots, CI, and repeat installs; they do not measure unique users or adoption.
Release changes
Evidence coverage
Missing data means unknown. A successful pipeline does not prove predictive accuracy or the absence of security exposure.
Is your version affected?
Check an exact Python package version against OSV. A package-level advisory alone cannot answer this question.