The Vanity Metric and the Velocity Metric
GitHub stars are a one-time gesture. A developer clicks the button, moves on, and never returns. The star persists forever. It does not decay when the developer switches frameworks, when the repository goes dormant, or when the last maintainer leaves. Stars are cumulative and permanent — a record of what developers once found interesting.
Commits are different. A commit means someone wrote code, reviewed it, and merged it into the project. It means the framework is being maintained, patched, improved, or at minimum kept alive. Commits require ongoing effort. They cannot be faked at scale and they cannot accumulate from past enthusiasm.
Gatsby's Trajectory
Gatsby launched in 2015 and defined the static site generation category for React developers. At its peak, it attracted venture capital, built a commercial cloud platform, and became the default recommendation for marketing sites and blogs. The framework's GraphQL data layer was polarizing but architecturally ambitious. Gatsby had a vision for how content-driven sites should work.
That vision stopped evolving. WebPulse scores Gatsby at 47.0 activity — the lowest tier in the scoring system. At 183 commits per year, the framework averages roughly one commit every two days. For a project of Gatsby's complexity, that pace covers security patches and minor fixes. It does not cover feature development, architectural improvements, or adaptation to the shifting demands of the AI-agent web.
Astro's Contrast
Astro shipped its 1.0 in August 2022 and has maintained aggressive development since. At 2,937 commits per year and an activity score of 75.0, Astro ships roughly eight commits per day. The framework introduced Islands Architecture, server-first rendering by default, and content collections that map directly to the structured data formats AI agents consume. Astro evolved into what Gatsby would need to become — but Gatsby stopped moving.
The security profile tells a nuanced story. Gatsby has 5 total CVEs in its entire history. Astro has 60. On the surface, fewer CVEs looks safer. In practice, Astro's higher CVE count reflects more code surface area, more third-party integrations, and more active security disclosure. Astro scores 90 in WebPulse security scoring — vulnerabilities found and patched are a sign of a living project, not a failing one. Frameworks that stop shipping also stop finding and fixing vulnerabilities.
What This Means for Sites Running Gatsby
A framework with 183 commits per year is not dead. It is dormant. The distinction matters because dormancy creates a specific kind of risk: the sites running Gatsby today continue to function, but they will not receive meaningful improvements. When browser APIs change, when Node.js drops support for older versions, when a dependency in the Gatsby ecosystem publishes a breaking update — 183 commits per year does not leave room to respond.
Organizations running Gatsby-powered sites should measure their exposure not by whether the site works today, but by the framework's capacity to respond when something breaks tomorrow. Stars do not fix vulnerabilities. Stars do not adapt to new runtime requirements. Commits do. And at 183 per year, the window to plan a migration is open now — not because Gatsby has failed, but because it has stopped iterating while the web continues to move.
