Consuming Open-source: A maintainer's perspective
summary
Open-source consumption poses concrete risks and concrete fixes: Node.js has 1.5 million modules on npm, maintainers face overwhelm and supply-chain attacks such as the event-stream incident, and enterprises need predictable support. The Node.js Package Maintenance group (since 2018) publishes best practices, adds optional support metadata to package.json like response: time permitting paid: false, and builds tooling (the dependents tool) that lists the top 5 downstream projects so maintainers can prioritize breaking changes.
AI-written summary · about
chapters (9)
- 0:00Start
- 3:05focus on our product and our business logic
- 4:37building a project atop of open source
- 5:46update your dependencies
- 6:19reduce your risk in terms of maintenance
- 7:02help support the maintainers of the projects
- 7:26test your project against nightly versions of your open source dependencies
- 15:52output all of the support information
- 16:27building these tools under an organization on github
related talks
14mWhat can we do to make Open Source more sustainable?
26mTrapped in the Open Source Supply Chain
23mInvesting in Open-Source
37mEnterprises, Node.js and Open Source, the Good, the Bad and the Ugly.
39mSOS: Sustainable Open Source
32mSOS: Sustainable Open Source
16mAre we Forever Doomed to Software Supply Chain Security?
30mHappy Developers, Healthy Modules - Together We Can Do This