Early patch releases in npm: A retrospective study of CI and integration-test signals
Abstract
Early patch releases may reflect release problems or routine maintenance. This study examines associations between historical continuous integration (CI) configuration, integration-test signals, and subsequent npm patches. A fixed November 2024 sampling frame yielded a baseline of 599 releases from 216 repositories in 2022–2025. An exploratory extension added 155 releases from 70 repositories, published from January through 24 August 2026, with complete 30-day follow-up bounded by 25 September 2026. The combined dataset contains 754 releases from 217 repositories. Fourteen-day patch proportions were 32.2% and 36.8%, respectively; the difference was 4.6 percentage points (95% repository-bootstrap interval: −4.7 to 13.7). Baseline adjusted odds ratios were 1.03 (0.43–2.48) for CI configuration and 1.95 (1.21–3.13) for integration signals. Pooled estimates were 1.07 (0.44–2.57) and 2.25 (1.48–3.42). Only two 2026 releases lacked CI configuration, preventing a standalone CI comparison. Among CI-present 2026 releases, the integration-signal odds ratio was 3.34 (1.48–7.57). Models fitted exclusively to 2022–2024 releases were evaluated unchanged on both later cohorts. Adding engineering signals changed ROC-AUC from 0.678 to 0.626 in 2025 and from 0.704 to 0.749 in 2026; the 2026 difference remained uncertain. The extension retains the association between integration signals and early patching but does not establish a change in patch prevalence or consistent predictive improvement. These observational results concern release-process signals, not the causal effectiveness of testing or mandatory quality gates.
Keywords: release engineering, continuous integration, integration testing, npm, mining software repositories, software quality
Declarations
Data availability
Supplementary File S2 retains the fixed sampling frame, baseline records, October extension protocol, new release-level observations, source-evidence audits, committer-time checks, analysis scripts, model outputs, and figures. Baseline event histories end on 31 January 2026 at 00:00 UTC; extension histories end on 25 October 2026 at 00:00 UTC. Extension metadata and historical source files were retrieved on 25 October 2026. Source revisions are identified by commit hashes, and the analyses can be reproduced offline from derived records. A permanent public repository link and archival DOI should be supplied when the author deposits the reviewed materials; no deposit is claimed here.
Ethics statement
This computational study analyses public software-release records and repository artefacts. It did not involve recruitment of human participants or experiments involving animals; ethics approval and informed consent were therefore not applicable to the study design.
Acknowledgments
AI assistance. Numerical analyses and figures were generated using the accompanying Python scripts applied to public registry and repository records. Reference DOIs were verified against bibliographic metadata. AI assistance does not constitute independent human validation of the engineering labels. Responsibility for the accuracy, interpretation, and final approval of the manuscript remains with the author.