18% Drop in Actively Maintained Open-Source: What Development Managers Must Do Now
Intro
Sonatype's 2023 report rang a bell. Actively maintained open-source projects fell by 18% in 2023. That number matters. It changes risk. It changes decisions. Development managers must adjust. They need strategy, not code snippets.
Why the 18% Drop Matters
Open-source is the backbone of modern software. Libraries and packages speed us up. They also create risk. When fewer projects are actively maintained, vulnerabilities linger. Bug fixes slow down. Compatibility breaks show up in production. For managers, the math is simple: more risk, more oversight.
What Managers Should Watch: Platforms and Ecosystems
- GitHub, GitLab, Bitbucket: Where code lives. Watch repo health: last commit, open issues, pull request activity. Use these metrics in vendor and dependency reviews.
- Package registries: npm, PyPI, Maven Central. Track download spikes and abandoned packages.
- Artifact repositories: Nexus, Artifactory. Use them to cache and control third-party dependencies.
Essential Tools to Add to Your Toolbox
- Software Composition Analysis (SCA): Snyk, Sonatype Nexus, Whitesource. Scan for vulnerable deps automatically.
- Automated updates: Dependabot, Renovate. Let bots open PRs. But gate them.
- SBOM generation: CycloneDX, SPDX. Maintain a bill of materials for every release.
- CI/CD security gates: Integrate SCA and SBOM checks into pipelines. Block builds on high-risk libs.
Trends and Issues to Track
- Maintainer burnout and project abandonment. Fewer active maintainers means longer windows for exploits.
- Transitive dependency chains. A tiny package deep in the tree can break everything.
- Supply chain attacks. Malicious updates and typosquats are not theoretical.
- Licensing drift. Abandoned code can change license or fall into unclear legal states.
Practical Playbook for Development Managers
- Inventory and prioritize. Start with high-value services. Map the dependency graph. Focus on business-critical libraries.
- Require SBOMs for all releases. Track versions and transitive deps.
- Automate scans in CI. Block or flag risky builds.
- Enforce update windows. Patch minor and patch semver quickly. Reserve manual review for major bumps.
- Maintain an internal cache. Mirror critical packages in Nexus or Artifactory.
- Create fallbacks. Have vetted alternative libraries ready.
- Measure maintenance health. Track last commit date, release cadence, and number of maintainers.
- Budget for support. Pay or sponsor critical open-source if it supports your business.
Anecdote from My Career
Iām Ermenildo Valdez Castro, Jr. Call me Ernie. I worked at Google, Microsoft, Amazon, and Zulily. I learned this the hard way.
At Zulily we relied on a small image-processing library. One day it stopped receiving updates. A vulnerability surfaced. We had no SBOM. We spent a week tracing transitive deps in a messy repo. I felt the pressure. We patched, forked, and then sponsored the project. It cost less than a week of downtime. It taught me to always know what is under my code. š
At Amazon I watched strict supply chain checks stop risky code from reaching production. That discipline saves reputations.
How to Talk to Your CTO and Product Leads
Speak in risk and dollars. Show the dependency map. Show the SBOM. Tie outages to business impact. Ask for budget for SCA tools, a mirrored registry, and maintainer sponsorship. Be specific. Say: "We need $X for continuous scans and $Y to mirror critical packages." Say it plainly. Leaders respond to numbers.
Checklist for the Next 30 Days (Quick Wins)
- Generate SBOMs for the top 5 services.
- Turn on Dependabot or Renovate in core repos.
- Add SCA scan to the main CI pipeline.
- Mirror the top 10 npm/PyPI packages used in prod.
- Sponsor or support one critical open-source project your team relies on.
Final Thought
Open-source built the stack we run on. When maintainers step back, managers must step up. Do the work now. Build simple guardrails. Pay attention to platforms, tools, and trends. Protect your product and your users.
ā Ernie Castro (Ermenildo V Castro) š