Nobody left to fix it: measuring dependencies with no maintainer

A recent study measured the maintenance status of dependencies in open-source software, finding that 13.4% of components had no known maintainer. This number comes from analyzing 8,943 components across 24 pinned repositories in five different ecosystems. The study used three sources to determine maintenance status: deprecation flags, inactivity for four years, and inferred abandonment based on silence.

For most packages, having a maintainer means an upgrade to a fixed version is possible. However, for some packages, there is no maintainer, and no release is available. This results in no upgrade path, leaving developers with limited options such as replacing the package or accepting the risk. The study found that abandoned packages are not clustered in production dependencies, meaning they have the same level of maintenance as test dependencies.

The cost of an abandoned dependency is often realized during a critical incident when no fix version is available. The measurement showed that 6.1% of vulnerabilities in production were linked to components with maintenance signals, but most of these had newer releases available. The earlier draft of the study had suggested abandoned components had worse vulnerabilities, but this finding did not hold up when re-run.

Overall, the study highlights the importance of maintaining open-source dependencies to avoid potential issues during incidents.