4.7% of Open Source Projects Have One or Two Maintainers*

TLDR: 7 (4.7%) critical open source projects have 1 or 2 maintainers, 33 (22.6%) have 1 or 2 maintainers which commit 75% of commits.

A couple weeks ago there was an article on the front page of HN about how many critical open source projects are led by only one or two maintainers. It was an interesting. We all know how important open source projects are (I refuse to link the XKCD comic), and we all know the consequences when they fail. I'm not going to be reiterating that in this article.

What I am going to be iterating is that that vibe coded article was poorly designed and poorly written and no one should put any quantitative stock in it. In this article I will put forth a better research design to come up with a more accurate statistic than "11 of 23 Core Open Source Projects Run on 1 or 2 People".

My Design

The Dataset

I used the OpenSSF Set of Critical Open Source Project dataset for my list of open source software.

This list is a crowdsourced attempt by the Open Source Software Security Foundation to track critical open source software. It was created "2022-June 2023" so it's not entirely up to date, but I don't think this will impact the breadth of software tracked as most critical software is older than 4 four years anyway. Software was found in a number of ways and was evaluated by working group.

I chose this list because it was supported by the OpenSSF (a well known, professional group which works in this space), had adequate scientific rigor in its selection process, and each software was chosen by holistic and quantitative methods. There are limitations of the dataset, but I believe that it was the best option for this survey.

I considered using the Census of Free and Open Source Software but it didn't measure the "criticality" of the software and was too broad for these purposes.

I decided to pull the previous three months of commits for measurement pretty arbitrarily, it just seemed like a good measure.

Cleaning

I had Opus5.5 convert the markdown to a csv file and find git repo URLs for the projects which referenced a non-git homepage. I then had Opus run through the dataset to find problems before taking a pass myself.

The Set of Critical Open Source Projects left me with a list of 148 projects to clean. Some of them had issues and needed cleaning:

• "Autotools" led to a Github organization mirror with repos for automake, autoconf, libtool, gettext, m4, and textinfo. I took autoconf and automake from this and added them to my list of software
• "Bitwarden" is a server and various clients, I picked the backend server
• "GNU make" and "make" were copies, I took one out
• "PHP" and "php-src" were copies, I took one out
• "Python" and "cpython" were copies, I took one out

After cleaning I ended up with 146 git repos for open source projects.

Measuring Git Repositories

Now that I had a list of git repos, I had Opus write a python script to clone only the metadata of all commits for all project repositories for the past N months. The script then saved the metadata to a tsv file and deleted the clone. Because the script is multi-threaded and I didn't want to run into race condition issues, it saved the data from all of the .tsv files to a central .csv file after all of the clones were finished.

I ran the script 2026-10-15.

Cleaning

Git commits contain the name and email of the author. If we're trying to determine the number of real people who are making commits, we need to do some cleaning with the raw commit data:

• Remove merge commits
• Remove automated bot commits
  • I had Opus go through a few rounds of finding bot accounts, filtering, and finding more bot accounts to come up with a pretty comprehensive list finding generic bots and bots specific to certain projects
  • \[bot\]|dependabot|renovate|github-actions|^bot$|\bbot\b|\brobot\b|[-_+]bot\b|-bot@|\+bot@|bot-|autoroll|automation|cron\.bot|gserviceaccount\.com|brewtestbot|ryantm-bot|mergebot|updatebot|flutteractionsbot|dilumaluthgebot|chromeos-ci-prod|^olprod$|google java core libraries
• Remove multiple emails from the same person
  • I had Opus go through the same process as finding bot names, I told it to go through the data in a few different rounds to find emails which have the same contributor name. For example, Mark Otto has two Gmail addresses that he uses for commits to Bootstrap, they were deduplicated to be attributed to him
  • Important note: I counted commits from a person using a coding agent as contributed by that person. For example, Tomcat's Opencode commits used Rémy Maucherat's email, I attributed them to him
    • Other important note: I didn't track every single AI agent name, Obvious is also an agent which was used in some commits but I didn't have a good rule or way to determine every single AI agent so I left it in as a contributor. It's messy but I don't know of a good way to solve this and I don't think it had a big effect on the results. Only bots that fit the bot regex in the point above were counted as bots
  • Some emails which aren't unique to a person weren't merged, such as noreply@google.com for Google projects

Analysis

Looking at the data it seems that the vast majority of critical open source projects do not rely on one or two sole maintainers. The whole picture is only slightly more nuanced. While only 7 (4.7%) projects have 1 or 2 maintainers, 33 (22.6%) have 1 or 2 maintainers which commit 75% of commits.

This data shows that most open source projects have multiple active maintainers.

In conclusion, the article "11 of 23 Core Open Source Projects Run on 1 or 2 People" sucks. 4.7% of critical open source projects have one or two maintainers*.

My code and data is on my Github if you want to check my work.

Future Work

This project is only quantitative, there was little work done in understanding which projects had few maintainers which did the bulk of the work and why. Future work could address things like:

• How does the number of maintainers change for different ecosystems/types of projects
• Which projects have few maintainers and why?
• Why do so many projects have 0 commits in the past 3 months? Are the projects "done" or is there no one to work on them?
• Are these trends in the number of maintainers the same with a wider dataset of open source projects? (IE the Census III)
• How does the number of maintainers change with institutional support (IE the Linux Foundation or the FSF)