Critical open-source projects often rest on one or two maintainers, report warns

Thin staffing and little funding leave widely used code exposed to failures and security incidents across the software stack companies depend on.

A report on open-source maintainers argues that widely used infrastructure is often protected by too few people and too little money, which raises the risk of failures and security incidents for the software stack companies rely on. It says 11 of 23 critical projects it examined have only one or two maintainers, and it points to past breakouts such as Shellshock, Log4Shell, libwebp, and the xz compromise as examples of how neglected code can become a systemic problem. The story highlights several understaffed projects, including Bash, ImageMagick, core-js, HarfBuzz, libjpeg-turbo, Libxml2, and SQLite, with some of them effectively carried by a single maintainer or a tiny team. It also notes that some projects do have outside support: curl has 11 maintainers and funding from Open Collective and Germany's Sovereign Tech Agency, while Log4j, OpenSSL, FFmpeg, and OpenSSH are also receiving Sovereign Tech Agency backing.