Open Source Is Shrinking. What Development Managers Must Do Now.

The fact

In 2023, Sonatype reported an 18% drop in open-source projects considered actively maintained. The software supply chain shifted overnight. This matters. It changes risk. It changes hiring. It changes budgets.

Why managers should care

Development managers need a different kind of content than developers. They need platforms to watch. They need tools to buy. They need trends to plan for. They need issues to prioritize. Developers want code. Managers want outcomes.

Short story from my life

I’m Ermenildo Valdez Castro, Jr. Call me Ernie. I have run teams at Google, Microsoft, Amazon, and Zulily. I learned one hard truth: if you don’t inventory your dependencies, you will be surprised. In one project at Amazon, a transitive dependency vanished overnight. Builds failed. Shipping stopped. We fixed it by adding a simple dependency policy and a paid registry mirror. It cost less than a week of downtime. It saved millions in lost time.

What the 18% decline means

More abandoned libraries. More security holes. Fewer bug fixes.
Higher maintenance burden for teams that rely on OSS.
Increased need for alternative vendors or in-house maintenance.
Greater importance for supply chain tools and SBOMs.

Platforms and places to watch

GitHub and GitLab: still the hubs. Watch project health metrics. Use dependency graphs.
Package registries: npm, PyPI, Maven Central, NuGet. Monitor package deprecation and yanked releases.
Registries and mirrors: use private mirrors for critical packages.

Tools for managers (and why they matter)

Dependency scanners: Snyk, Dependabot, Renovate. They automate updates and flag vulnerabilities.
Repository managers: Sonatype Nexus, JFrog Artifactory. They give control over artifacts.
SBOM and supply chain: tools to produce Software BOMs that auditors understand.
License scanners: detect risky licenses before they reach production.

Trends to plan for

Paid maintenance and sponsorship. More projects will ask for money.
Vendor-backed open source is rising. Expect more corporate maintainers.
Managed services over DIY. Teams buy hosted services to reduce risk.
Emphasis on long-term support (LTS) libraries and stable APIs.

Immediate actions for Development Managers

Inventory and classify dependencies. Make a living list.
Prioritize critical paths. Decide which libraries must be owned.
Adopt a dependency policy. Pin versions. Use reproducible builds.
Add observability. Track maintenance signals: recent commits, issue backlog, release frequency.
Fund and sponsor key projects. It’s cheaper than rebuilding.
Use mirrors and internal registries for critical packages.
Train developers on supply-chain hygiene and secure defaults.

Metrics to track

Percentage of transitive deps with no commit in 12 months.
Number of critical packages without active maintainers.
Time-to-update for vulnerabilities.
Cost of maintaining forked libraries versus replacing them.

A tiny prayer and a fact

I grew up with my mother telling me: build on rock, not sand. It sounds religious. It’s practical. When I set standards for dependency health at Zulily, builds stopped breaking. Teams shipped more. We saved engineers’ time. I call myself Ernie Castro. I still use that rule.

Closing: a manager’s checklist

Start with an audit this week.
Choose one tool to automate updates.
Pick two libraries to sponsor or replace this quarter.
Educate your team.

Act now. The supply chain will not wait. - Ermenildo V Castro 😎