Early patch releases in npm: A retrospective study of CI and integration-test signals

Early patch releases may reflect release problems or routine maintenance. This study examines associations between historical continuous integration (CI) configuration, integration-test signals, and subsequent npm patches. A fixed November 2024 sampling frame yielded a baseline of 599 releases from 216 repositories in 2022–2025. An exploratory extension added 155 releases from 70 repositories, published from January through 24 August 2026, with complete 30-day follow-up bounded by 25 September 2026. The combined dataset contains 754 releases from 217 repositories. Fourteen-day patch proportions were 32.2% and 36.8%, respectively; the difference was 4.6 percentage points (95% repository-bootstrap interval: −4.7 to 13.7). Baseline adjusted odds ratios were 1.03 (0.43–2.48) for CI configuration and 1.95 (1.21–3.13) for integration signals. Pooled estimates were 1.07 (0.44–2.57) and 2.25 (1.48–3.42). Only two 2026 releases lacked CI configuration, preventing a standalone CI comparison. Among CI-present 2026 releases, the integration-signal odds ratio was 3.34 (1.48–7.57). Models fitted exclusively to 2022–2024 releases were evaluated unchanged on both later cohorts. Adding engineering signals changed ROC-AUC from 0.678 to 0.626 in 2025 and from 0.704 to 0.749 in 2026; the 2026 difference remained uncertain. The extension retains the association between integration signals and early patching but does not establish a change in patch prevalence or consistent predictive improvement. These observational results concern release-process signals, not the causal effectiveness of testing or mandatory quality gates.