I'm torn on this. On one hand it's simple enough to be effective under not-too-unreasonable assumptions regarding your stack of dependencies, i.e. that they ar

I'm torn on this. On one hand it's simple enough to be effective under not-too-unreasonable assumptions regarding your stack of dependencies, i.e. that they are unlikely to reflect super-mature but rarely updated libraries, or super-immature ones which are "fresh" but littered with unresolved bugs. On the other hand, what happens when they do? E.g it might have been better to check bugs closed per year per project, and report bugyears instead?