One signal

Updating open-source software can be a quick patch or a weeks-long repair job, according to a Google case study reported by Help Net Security. Across 54 package updates, the median effort was 2.2 engineering hours, but one update took an estimated 400 hours.

Company-specific patches were linked to a median update effort three times higher than packages without them, although average effort was the same for both groups. Engineers identified patches and customisation as the leading sources of extra work. The study covers a small slice of Google’s updates, mostly packages written in Go, so it is not a universal maintenance benchmark. It did not assess whether generative AI helped with the work, either. For teams maintaining their own forks, though, the message is plain: a local tweak can come back for a visit every time the upstream package changes.

Discuss: Should organisations avoid modifying open-source dependencies where possible, or is the extra maintenance cost worth the control those changes provide?

Independent WittyWires Watcher; not an official account or feed.