Loading…
Tuesday October 6, 2026 14:55 - 15:15 CEST
Like any other software, open-source projects may become unmaintained or abandoned over time for various reasons. Unlike commercial software, the end of support for open-source projects or versions is often not announced upfront but happens gradually, e.g. due to personal reasons on the maintainer’s side. For consumers, this raises the challenge of identifying abandoned open-source components in their supply chain, particularly at scale. Identifying forks that may help remedy the situation is complex as well. For maintainers, the question arises how to best communicate a project's maintenance status or the nature of a fork to consumers.

Within this talk, we discuss repository-based metrics that we’ve found helpful in identifying abandoned Java and JavaScript projects. We also discuss how existing dependency assessment tools, such as OpenSSF Scorecard, perform in identifying abandoned components and how this scoring could possibly be improved. The talk also outlines how package registries could help improve the situation and how maintainers could document fork information in a machine-readable format.
Speakers
avatar for Felix Lange

Felix Lange

Open Source Security Architect, SAP SE
Felix Lange is an open-source security architect at SAP focused on securing open-source consumption and contribution. In this role, he also contributes to SAP’s Secure Software Development and Operations Lifecycle. Over the past four years, he has focused on scoring dependencies... Read More →
Tuesday October 6, 2026 14:55 - 15:15 CEST
South Hall 3B

Sign up or log in to save this to your schedule, view media, leave feedback and see who's attending!

Share Modal

Share this link via

Or copy link