I use typescript-ioc, a small dependency-injection library that hasn't had a release for more than 7 years, but is still downloaded thousands of times every week. It is flagged by security scanners due to its dependencies having high-severity CVEs. So, I submitted a pull request to update its dependencies and replace packages to fix these. The tests and validations pass, but the pull request is still sitting there. So, I just carry the patch myself, for years.

Open source has plenty of code, sometimes too much of it. The problem has always been finding people who are willing to own them. Projects need maintainers to create that sense of responsibility, to understand, fix, and review the changes. This doesn't need AI, I have been doing it for decades. But now, AI makes that understanding part easier, which is usually the expensive part of the equation.

My example is also the easy case here. Once the patch works, there is very little to do for me. The harder case is where requirements diverge from the main project. A year from now, there is a new release, and now I need to figure out what changed. Did the project rewrite the whole thing? Or is my patch still valid?

This is the real cost. Writing the first patch wasn't difficult, but coming back to it after a year and trying to understand and rebuild the context is.

This is where AI can be useful. I can understand the code much faster with it.

And this describes a huge amount of the open-source ecosystem. Away from the usual Linux, Kubernetes, React… and the other projects with large communities and money, there are thousands of smaller libraries that people depend on every day. A library can have thousands of users and still depend on one maintainer because they needed it five years ago and somehow ended up becoming an unpaid infrastructure provider for half of the internet. For these projects, the most realistic option is for the people who depend on them to take on a small piece of the maintenance themselves.

Open source has always meant that if the main project is gone or stopped working, you still have the code. But it also means you inherit the maintenance problem along with it. AI can make it cheap enough for us to exercise the freedom open source gives us.

Of course, the downside is, if it is so easy and cheap to carry a patch, why would people contribute the change to the main project? A company may just decide to hold on to its changes forever, and that is bad for open source. The project gets fewer contributions and is a much more fragmented.

Open source always promised that if the software stops working for you, you can fix it yourself. AI might finally make that practical. Whether any of those fixes find their way back upstream is up to us.