Topic
The study of how open-source software is funded and maintained, focusing on the gap between corporate reliance on volunteer coders and the support they receive.
Backtrader, the 23.5k-star backtesting library, has shown no GitHub repository activity since 19 Aug 2024, according to a daily directory snapshot. Existing strategies still run, but the directory's operator says new projects should start on a maintained library.
Reality
ngx-daterangepicker-material, downloaded about 250,000 times a month, now has a release for each Angular major from 16 to 22. About 7 in 10 installs are still on v6, and a ^6.0.4 range will not move them, so each team has to pick its major by hand.
Reality
AutoGen has about 60,400 GitHub stars, the most of three leading agent frameworks, but its own README puts it in maintenance mode. A dev.to audit verified on 2026-08-16 says to weigh installs and release history before stars when starting a new project.
Reality
QGIS has banned all LLM, AI and agent assisted code in qgis/qgis, on master as of October 7 under QEP #387. Asked how compliance will work, a core contributor pointed to the contributor's own conscience, a dev.to analysis reports.
Reality
Google measured 54 updates to its internal copies of open-source packages and found a median effort of 2.2 engineering hours. Private patches raise the cost of a typical update in that data, but the longest updates trace to repair work.
Reality
Deno's entire team is joining Cloudflare and taking celld, its open-source implementation of Workers and Durable Objects, along with it. For teams on Workers, the code they would use to leave now comes from the company they would be leaving.
Perspective Coverage
7 publishersReality
FINOS says its bank-funded OSERA alliance now ships patched builds of more than 50 older open-source project lines that member banks still run. The signed, tested builds go only to paying members, while anyone can read the patched source.
Reality
eslint-plugin-unicorn 77 moves 11 CSS rules to eslint-cssicorn and removes its deprecated flat configs. Keeping those checks after the upgrade means adopting a version 0.1 package with its own ESLint and ESM requirements that does not accept pull requests.
Reality
Anthropic's Frontier Red Team has disclosed 6,157 open-source vulnerabilities and knows of upstream patches for 516. The gap sits with maintainers, whose capacity Anthropic's own policy treats as the ceiling on how fast it files reports.
Reality
PyTorch has moved all image, video and audio decoding and encoding into TorchCodec after a two-year consolidation of its media stack. Teams whose vision, audio or generative training code still reads media through TorchVision or TorchAudio now have a port to plan.
Reality
postgres-js leaves a connection's row cursor set after a query fails mid-stream, so one team's LIMIT 500 query came back with 813 entries. With the one-line fix an open pull request since October 2025, pooled users have to patch the driver themselves.
Reality
The program paid for critical vulnerabilities for about a year and closed because generating a plausible report now costs about a tenth of a cent while reading one still costs ten minutes of the person who knows the code.
Reality
An outsider benchmarking laya's multilingual checkpoint on 300 Japanese emails found the first-listed ordinal level effectively unreachable, and the maintainer shipped the limitation in a README before any retrain.
Reality
A public measurement across five ecosystems puts one component in seven down as unmaintained, though its own findings data shows that almost never changes what you can do about an advisory today.
Reality
Chainguard says its Athena coalition will start releasing about 50 findings on September 28, with affected version ranges attached. A scanner needs those ranges before it can flag a pinned old release.
Reality
The dev.to post announcing llm-sentinel says llm-guard is archived. The replacement is ten pattern-matching scanners with a score threshold each, benchmarked on 133 hand-written cases its author calls a smoke test.
Reality
The year's CVE tally has reached 66,401, close to double where it stood last September, and Microsoft alone patched 974 in a single month. Jerry Gamblin, who keeps the count, says more known bugs is mostly the system working.
Reality
Since uv 0.12.0 landed on July 28, 2026, uv init has written a src layout and a uv_build build-system table by default. The old --package tip is now backwards, and --no-package is the way back to a flat main.py.
Reality
A dev.to writeup dates the README link-spam campaign to at least September 14 and puts one bot at three pull requests a day. Worked out per repository, that is about one arrival a day at any project it targets.
Reality
The case that generated code fails without the usual warning signs comes from two practitioner accounts, while the only measured series is curl's inbound bug reports, and Daniel Stenberg stopped taking those in January 2026.
Reality
Security · September 14, 2026 · Confirmed2 publishers