Topic
The limited volunteer time and effort available to maintain widely used open-source projects, often strained by security patching and triage demands.
Node.js will ship one major release a year from this October, dropping the odd-numbered line that few teams ran in production. LTS-only shops mostly see renumbering, and the cost lands on teams that took new APIs from the odd Current line.
Reality
Core Lightning says the machine-written reports found real flaws in its payments software. It is holding the count and severity for at least two weeks, leaving node operators to decide what to do with a hazard whose size is still private.
Perspective Coverage
3 publishersReality
Anil Madhavapeddy patched a path traversal bug in OCaml's cohttp and found probes for it in his logs ten minutes after opening the fix PR. His own agent had already built the exploit from a bug-class hint.
Reality
Helm charts and container images keep working after March 2026, but the patch stream stops, and the recommended replacement is a specification rather than software, so every team now picks its own controller.
Reality
A J.P. Morgan report counts more than 1,400 AI-generated vulnerability reports that maintainers accepted at roughly 90% validation and mostly did not patch, which moves the budget question from finding to fixing.
Reality
The Apache team confirmed code execution is reachable under specific conditions, said the issue was already triaged, and told the community its volunteers have better uses for their time. Teams that scrambled were tracking circulating reports, not upstream guidance.
Reality