A component might release a new version but not update all of their dependencies. Those dependencies that are lagging behind, we call stale, and we account for those as well.
— Dr. Stephen Magill, Derek Weeks · A Data-Driven Look at Open Source Software Supply Chains, Las Vegas 2019 · at 15:31