11 of 23 core open-source projects run mostly by 1–2 people

Several widely used digital tools rely on core open-source software, some maintained by very small teams. A recent online post claims 11 of 23 key projects have only one or two regular maintainers, highlighting potential fragility in widely used tech. This explainer clarifies what the report says, who could be affected, and practical steps for users and communities.

What the claim says

The report summarizes a study of 23 core open-source projects that support devices and services such as phones, browsers, and servers. It states that 11 of these projects had one or two people making ten or more changes in a recent year, suggesting a small group maintains them. The article notes this is based on publicly visible activity (changes logged in project repositories) and references a broader post that compiled the numbers. The claim focuses on maintenance activity, not on funding or quality per se.

Who is affected

End users (anyone with a phone, browser, or cloud service) indirectly rely on these projects. If a project with only one or two maintainers encounters burnout, funding gaps, or a security issue, there could be slower responses to fixes or updates. Vendors and developers who package or build on top of these core projects may face supply-chain implications and need contingency plans for alternatives or longer-term maintenance.

Practical next steps

What to consider: (1) For users: keep devices and apps updated, enable automatic security updates where possible, and stay informed about major OSS components in your tech stack. (2) For organizations: map critical OSS dependencies, monitor maintenance activity, and diversify where feasible (support multiple maintainers or sponsor maintainers). (3) For the OSS community: consider funding, contributor support, and mentorship to broaden the pool of active maintainers and reduce single points of failure. (4) For policymakers and researchers: encourage transparent reporting of maintainer workloads and sustainable funding models.

Limits and questions

The source report is based on a snapshot of contributor activity and may not capture all forms of maintenance (for example, maintainers who contribute but aren’t counted by the cited method). It also doesn’t measure code quality, security practices, or long-term viability. Readers should consider this as a perspective on workload distribution rather than a definitive safety assessment of each project.

Information and responsibility notice: This article is general information based on the cited material available when published. It is not legal, tax, immigration, medical, financial, banking, or investment advice; it does not create a professional-client relationship; and it is not a guarantee of outcome, availability, accuracy, or eligibility. Rules, schedules, prices, and third-party information can change. Confirm material decisions with the relevant authority and an appropriately qualified adviser before acting.