The Unexpected Demise of Open Source Libraries
summary
Stories show small maintainer actions breaking huge ecosystems: left-pad removed (≈2.5M downloads) unpublishes nested deps and breaks builds; faker.php archived after 120M+ downloads citing ~11 metric tons CO2 and refuses handoff; a maintainer publishes empty releases and pushes colors 1.4.1 denial-of-service loop, generating ~500k downloads/day and outage. Practical defenses are named: use lockfiles and caching proxies like Verdaccio, dependency overrides to pin transitive versions, delay automated updates for ~3 weeks, and rely on community forks to revive critical projects.
AI-written summary · about
chapters (7)
- 0:00Start
- 0:28The Unexpected Demise of Open Source Libraries
- 5:06Azure
- 6:44Learnings
- 9:11Faker Php Library
- 21:32Automated Dependency Upgrade Tools
- 23:11Faker Js
related talks
46mThe Unexpected Demise of Open Source Libraries
14mWhat can we do to make Open Source more sustainable?
32mSOS: Sustainable Open Source
26mTrapped in the Open Source Supply Chain
38mRemember When We Broke the Internet?
47mGame of Open Source: A Tale of Hype & Mire
39mSOS: Sustainable Open Source
49mTrustworthy Open Source: The Consequences of Success