[simonw]

PyPI’s policies are here: https://policies.python.org/pypi.org/Acceptable-Use-Policy/

Outside of abuse, PyPI does not impose editorial standards on packages. That would take an incredible amount of additional work, and it’s not clear to me that it would be “better”. How much does it really matter if there’s a university student project on there with virtually no downloads?

“I think package maintainers should be required to push an update every other year or have their package get dropped.”

Sometimes libraries really are “finished” - if you go through your dependency stack you may find a surprising number of packages with no new releases in the past 12 months, because they didn’t need a release.

I tried that myself just now, here are some of the packages I found that haven't had a release in a few years:

    decorator               2022-01-07
    rfc3986                 2022-01-10
    aiosignal               2022-11-08
    colorama                2022-10-25
    h11                     2022-09-25
    jmespath                2022-06-17
    mdurl                   2022-08-14
    rsa                     2022-07-20
    mergedeep               2021-02-05
    dictdiffer              2021-07-22
    janus                   2021-12-17
    conda-content-trust     2021-05-12
    six                     2021-05-05
    uritemplate             2021-10-13
    pytest-clarity          2021-06-11
    ptyprocess              2020-12-28
    backcall                2020-06-09
    text-unidecode          2019-08-30
    PySocks                 2019-09-20
    sphinxcontrib-jsmath    2019-01-21
    pprintpp                2018-07-01
    homebrew-pypi-poet      2018-02-23
    pickleshare             2018-09-25
    webencodings            2017-04-05

Script here: https://gist.github.com/simonw/6165948ce595d74c767ce2bce8465...