What makes some open source updates so difficult?
Google found a 2.2-hour median effort for internal open-source updates, with local patches tripling that time.
Google studied the engineering effort required to update 54 internal copies of open-source packages between April and December 2024. The median effort was 2.2 hours and the average was 13.9 hours, while one update was estimated at 400 hours. Of 47 packages with usable patch data, those carrying company-specific patches had three times the median update effort of unmodified copies. Work beyond two days was mostly spent repairing downstream breakage, and 52 of the packages were written in Go.
- Google measured 54 internal open-source package updates from April to December 2024.
- Median effort was 2.2 hours; the average was 13.9 hours, with one update at 400 hours.
- Company-specific patches tripled median update effort versus unmodified copies.
- Updates lasting more than two days were mostly remediation of downstream breakage.
- Fifty-two of the 54 packages were written in Go, and the sample was under 1% of updates.
From the original article
2 min read at helpnetsecurity.com
Many organizations adopt open source software because they see it as a cheaper alternative to proprietary development. Maintaining it, however, still requires engineering effort, according to Google’s case study, “How much does it cost to maintain a copy of an open source software package (at Google)?”
By Anamarija Pogorelec · helpnetsecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.