Topic
Unpaid or thinly resourced maintainers absorbing report volume from automated scanning across more than a thousand projects.
Ned Deily asked the 2026 Python Language Summit whether CPython should keep shipping macOS installers that carry 25 years of technical debt. Nobody knows whether anyone would miss them, because the project has not measured who installs Python from python.org on a Mac.
Reality
The 2026 event drops the four-pull-request quota that cheap generation made meaningless and rebuilds around one-day in-person Fests, so a T-shirt now depends on a local organizer finding a venue and Wi-Fi.
Reality
Anthropic sent 8% of its model's 23,019 findings out for review and stopped there, citing a shortage of people to check them. Where independent scoring did happen, 14 of 27 severity ratings had to be moved.
Reality
A TypeScript monorepo accumulated eight glob versions, seven of minimatch and three of brace-expansion, and the dozens of GitHub alerts they raised over twelve months were mostly ReDoS the code could not reach.
Reality
Project Glasswing scanned more than 1,000 open source projects, and Anthropic says human triage became the slow part. Most teams are staffed for discovery, not response.
Reality