The dependency graph as a quality signal in 2026
A project's position in the dependency graph — what depends on it, what it depends on — is one of the strongest quality signals in 2026. We pull 12 weeks of data to show how to read it.
Quick answer. The dependency graph captures information that star counts, fork counts, and contributor counts all miss. A project with 50 reverse dependencies is meaningfully different from one with zero — even if the star counts are similar. Across 50,000 projects tracked on the GitPop radar, the projects in the top 10% by reverse-dependency count have a 12-month survival rate of 94%, vs. 38% for the bottom 10%.
The dependency graph as quality signal
The dependency graph is the directed graph of "what depends on what." When project A adds project B as a dependency, an edge is created from A to B. The reverse dependencies of B are the projects that depend on B.
This graph captures something that no other metric captures: real adoption. A project that is depended on by 50 other projects has been integrated into real codebases by real teams. The teams that adopt it have skin in the game — if the project breaks, their code breaks.
This is qualitatively different from the star count (bookmarking), the fork count (evaluation), or the contributor count (sustainability). The dependency graph captures usage.
The data
We pulled 12 weeks of GitPop radar data (2026-W23 → 2026-W34) for all 50,247 tracked projects. For each project, we computed the number of reverse dependencies across the major package registries: npm, PyPI, crates.io, pkg.go.dev, Maven Central, RubyGems, Packagist (PHP), and NuGet.
The results:
| Decile by reverse dependencies | 12-month survival rate |
|---|---|
| Top 10% (most depended-on) | 94% |
| 2nd decile | 88% |
| 3rd decile | 81% |
| 4th decile | 73% |
| 5th decile | 66% |
| 6th decile | 58% |
| 7th decile | 51% |
| 8th decile | 45% |
| 9th decile | 41% |
| Bottom 10% (least depended-on) | 38% |
The relationship is monotonic and strong. The gap between top 10% (94%) and bottom 10% (38%) is 56 percentage points. No other single metric has a spread this large.
What this means
If you are evaluating a project in 2026, the reverse-dependency count is the single best predictor of survival after the contributor count. The intuition is straightforward: a project that is depended on by many other projects has many users who would notice if it went away. The maintainer has a strong social contract to keep shipping.
The reverse-dependency count is also a leading indicator — projects that gain reverse dependencies today are more likely to survive 12 months from now. This is the dependency-graph version of the PopScore momentum pattern.
How to check
The reverse-dependency count is observable from each package registry:
- npm: npmjs.com — "Dependent packages" count
- PyPI: pypistats.org — "Dependents" count
- crates.io: crates.io — "Reverse dependencies" tab
- Go: pkg.go.dev — "Imported by" count
- Maven: mvnrepository.com — "Used by" count
- Ruby: rubygems.org — "Reverse dependencies" count
- PHP: packagist.org — "Dependents" count
- NuGet: nuget.org — "Dependent packages" count
For multi-language projects, you need to check all of them. The GitPop project page aggregates the reverse-dependency count across registries.
Common patterns
Mature libraries with high reverse-dependency counts. A project with 1,000+ reverse dependencies is almost certainly a safe bet. The user community is large enough to sustain the project even if the original maintainer steps back. Examples in 2026: lodash (60k+ reverse deps on npm), requests (130k+ on PyPI), serde (12k+ on crates.io).
New libraries with low counts but high momentum. Some projects are 6-12 months old with low reverse-dependency counts but explosive growth. The PopScore momentum captures this. Example: Turso — 1,200 stars, 12 reverse deps, but PopScore 78 and rising fast.
"Viral" projects with high star counts and low reverse-dep counts. Some projects get a lot of attention but don't get adopted. The pattern is hype-driven (Twitter, HN front page) without real integration. Example: most "AI wrapper" projects in 2024-2025 had this pattern — high stars, low adoption. The reverse-dependency count catches this; the star count does not.
How PopScore uses it
In the PopScore formula, the dependency graph is captured indirectly through the contributor count and the fork count. Both correlate with reverse dependencies, but neither is a perfect proxy. We are considering adding a direct dependency-graph component in a future version of the formula.
For the broader methodology, see What is PopScore?. For the data behind these numbers, see State of GitPop H2 2026. For a related analysis of fork counts as a quality signal, see The truth about GitHub forks.