I propose a different metric, version points: subtract version number of the currently used library from the version number of the latest version. Translate to

I propose a different metric, version points: subtract version number of the currently used library from the version number of the latest version. Translate to semver first if possible. Also, a release addressing a CVE adds extra ten million points.