テーマ： maintainership
-
After a vulnerability report arrives: acknowledge, assess, fix in private, disclose
Once a report reaches the project's security contact, the work is a sequence with dates: acknowledge quickly, classify (working as intended, bug, feature request, vulnerability), agree an embargo with the reporter, develop the fix privately, obtain a CVE identifier, then release and publish an advisory that names affected and fixed versions and credits the reporter. The OpenSSF maintainer guide and GitHub's disclosure guidance describe this process; this article compresses it for a project with one to five maintainers.
-
Issue triage for a small project: a fixed label set and a regular pass
Triage means deciding for every new issue what it is, whether it is actionable and who moves next. A small label vocabulary in three families (type, status, area) plus a short pass at a fixed cadence keeps the tracker honest; GitHub's default labels (among them bug, enhancement, documentation, duplicate, question, wontfix, good first issue and help wanted) are a workable starting set.
-
Recognising contributors: a contributors table by contribution type, without rankings
The All Contributors specification calls for a Contributors section in a prominent place, as a table of name, link and contribution category, inclusive of every kind of contribution at any level, with order immaterial; it recommends against excluding anyone for a perceived low level of contribution. Git's Co-authored-by trailer credits co-authors of a single commit. Together they let a small project credit documentation, triage, design and reports, not only merged code.
-
Release cadence for a small project: time-based trains versus release-when-ready
A version number says what a release promises; a cadence policy says when releases happen. Rust ships a stable release every six weeks from a nightly, beta, stable train, Python moved to an annual feature release with PEP 602, and Django issues feature releases on a time-based schedule with patch releases as needed. A small project can copy the shape: feature releases on a calendar or when something notable accumulates, patch releases whenever a fix lands.
-
A CONTRIBUTING file that answers a newcomer's first five questions
Before writing code, a would-be contributor asks: is this change wanted, how do I propose it, what must a pull request contain, how long until someone answers, and how does a merged change reach users. A CONTRIBUTING file that answers those five questions in order, and links out for everything else, is meant to head off pull requests that would be rejected for scope or missing tests.
-
Declining a feature request without losing the contributor
A refusal that points to written scope, arrives promptly, names an alternative and closes the thread is kinder than silence, and it keeps the requester as a contributor. The Open Source Guides note that writing things down makes it easier to say no and that a reply rarely needs more than one or two sentences.
-
Governance for a small project: decision rights written down before they are needed
A governance file answers who can merge, who settles a scope dispute, how maintainers are added and removed, and how the rules themselves change. Python's PEP 13 shows a council model with authority that is meant to be used rarely and with public deliberation; the Apache glossary defines lazy consensus, under which a proposal passes if nobody objects within a stated period. A project with one to three maintainers needs only a page.
-
How do maintainers of small projects actually spend their hours, and what shifted the split away from writing code?
Open question: the Open Source Guides observe that maintainers of widely used projects end up coding less and responding to issues more, and recommend documentation, saying no, sharing the load and automation as remedies; what is missing is measured time per activity for small projects, and evidence about which of those remedies changed the split.
-
Maintainer hand-over and bus factor: what a successor must be able to do on day one
A project survives its maintainer when a second person already holds every account and key, can perform a release from the written steps alone, and knows where decisions are recorded. PEP 541 shows what happens otherwise on PyPI: a project counts as abandoned only when the owner is unreachable, no release has appeared for twelve months and its home page shows no activity, and only then can it be handed to a new owner under the abandonment rule. GitHub's repository transfer moves issues, pull requests, stars and watchers with the code.
-
Supporting several release lines: which fixes go where
A support policy is a table of release lines with a status each (feature, bugfix, security-only, end of life) and a rule for which fix classes are backported to which lines. Python maintains a series with bugfix releases for two years and security-only releases for three more; Django backports critical fixes to the last feature release and security and data-loss fixes to the last two plus long-term-support lines; Rust supports only the most recent stable. A small project should publish the table and default to the narrowest promise it can keep.
機械可読： JSON