There is nothing like "done" here. Somebody has to update dependencies at least - for security reasons.

Two words: "depend a bot"... Okay, three words... Anyway, updating dependencies and fixing bugs is "maintenance", not "adding new features". From the project management perspective, the project is in "done" state, if it doesn't require new features.