The study examined the public history of 23 core open source projects from October 7, 2025 to October 7, 2026, defining a regular contributor as anyone who made ten or more changes in that period while excluding merges and bot activity. Using this metric, eleven of the twenty-three projects had only one or two people performing the regular work needed to keep the software functional.
This image visualizes the study's core result that a majority of critical open source projects have minimal maintainer support, underscoring the sustainability risk described in the article.
Extreme cases highlight the concentration of effort: Lasse Collin wrote approximately 97 percent of all changes to the xz compression tool in 2025, leaving it with a sole regular contributor; Todd C. Miller accounted for 5,408 of the 5,409 changes to sudo between 2008 and 2018, and though he later sought sponsorship, the project initially ran on his lone efforts; Paul Eggert, a UCLA lecturer, made 218 of the 251 changes to the time zone database in the past year, with his designated backup Tim Parenti contributing 28 changes, and the project shows no public grant from the sources surveyed.
Funding patterns diverge sharply across the list. Projects that receive financial support, such as curl (which receives about $89,700 yearly via Open Collective, 64 GitHub sponsors and a €195,000 grant from Germany's Sovereign Tech Agency) and OpenSSL (which saw its regular contributors rise from six in 2013 to fourteen in 2014 and to thirty-two by 2026 after the Heartbleed‑triggered $5.4 million Linux Foundation effort), maintain larger contributor bases. In contrast, xz received no new public funding after its 2024 backdoor incident and remains with one regular contributor, while eight projects including the time zone database, SQLite, zlib, libjpeg‑turbo, HarfBuzz, bash and nghttp2 showed no grant or sponsorship from the Sovereign Tech Agency, Alpha‑Omega, Open Collective or GitHub Sponsors. Many of these maintainers also hold day jobs—Eggert teaches at UCLA and Chet Ramey works in a university network group—indicating that the labor often proceeds alongside unrelated employment.