Most of the software today runs and depends on open source, a story also true for Europe. Almost 100% of organisations have increased or kept steady their use of open source in recent years, according to one survey. The surging adoption brings opportunities for Europe for strengthening its autonomy, and the competitiveness of its industries. These opportunities, however, risk becoming a fallacy and turn into a major security threat if Europe does not start to recognise the growing maintenance debt and contribute to the sustainability of the open source ecosystem it depends on.
The risks become apparent when considering how vulnerabilities are growing by the numbers. One survey points to a 107% of growth in open source vulnerabilities per codebase, and how 87% of surveyed codebases contained at least one vulnerability. With the rapid evolution of AI, these numbers can only be expected to increase, warranting the need for security audits, and tremendous increase in contribution efforts to ensure the robustness and resiliency of Europe’s digital infrastructure.
In this post, we aim to put the risks into context through a highlight on Europe’s open source productivity, focusing on the maintenance of repositories within the Open Source community. The goal is also to give a global perspective to the issues raised, as open source is not concerned with borders, but a type of digital common requiring global attention (access the source material of the graphic below).
To understand Europe’s standing, it is essential to analyse quantitative metrics such as repository generation, commit frequency, and contributor activity. Data from GitHub and other platforms indicate that while the United States leads in absolute numbers of repositories and contributors, Europe demonstrates a steady growth trajectory. China has surged in repository creation, especially between 2015 and 2020. Afterwards the activities measurable via GitHub repository formation and commits, however, decreased, which can partly be explained by a shift towards Gitee, a very popular DevOps platform launched launched in 2013 by Open Source China (OSChina).
Commit intensity, as measured as the average number of code commits per repository, which can be interpreted as a measure of productivity output, rose from 2010 to 2023, placing Europe slightly ahead of the United States on this indicator, underscoring the region’s strong increase in productivity. The numbers reflect a vibrant, industrious community that is contributing code and solutions at a remarkable pace (access the source material of the graphic below - Source 1 | Source 2).
The sustainability of open source projects, however, hinges not only on their initial creation but on ongoing maintenance and community stewardship, also facing the challenge of scaling, at least in the long run. Earlier articles on maintenance of the open source system underscore the importance of regular updates, bug fixes, and user support in ensuring long-term viability (See for example: Eghbal, N. (2016). "Roads and Bridges: The Unseen Labor Behind Our Digital Infrastructure." Ford Foundation). Active contributor engagement, adaptive maintenance practices and human infrastructure are thus key to prevent stagnation and promote project growth (Source: Linåker, J., Link, G., & Lumbard, K. (2024). Sustaining Maintenance Labor for Healthy Open Source Software Projects through Human Infrastructure: A Maintainer Perspective. In 18th ACM/IEEE International Symposium on Empirical Software Engineering and Measurement).
The health of an open source ecosystem thus depends heavily on contributor inflow and outflow that can be measured by retention and turnover rates (Source: Alami, A., Pardo, R., & Linåker, J. (2024). Free open source communities sustainability: Does it make a difference in software quality?. Empirical Software Engineering, 29(5), 114.). More precisely, the retention rate captures year-to-year changes in the inflow of contributors entering the ecosystem (Note: The ecosystem is measured based on GitHub data. GitHub is the largest code hosting platform globally with over 100 million developers and hundreds of millions of repositories covered). It is defined as the ratio of contributors entering in a given year relative to those entering in the previous year, which reflects the capacity of a country’s open-source ecosystem to sustain or expand participation over time. The turnover rate basically measures the opposite, i.e. contributor outflows between consecutive years, expressed as the share of contributors leaving the ecosystem relative to the contributor base of the previous year (access the source material of the graphic below).
As we can see from Figure 2, which plots the maintenance as well as the retention rate of Europe on a global scale, Europe faces challenges in retaining contributors and managing turnover. Retention rates have slipped over the analyses time period, while the turnover rate has increased between 2010 and 2023. These trends suggest an outflow of open source contributors that is not backed by a consecutive inflow, i.e. people are leaving the ecosystem but not many new contributors are entering, implying that while Europe excels at producing and professionalising, it struggles to sustain its contributor base, which is a factor that could threaten long-term maintenance and ecosystem stability.
Sustaining open source projects thus requires ongoing commitment, institutional support, and a vibrant community willing to invest in the long run. As Europe’s ecosystem matures, fostering environments that encourage contributor retention and renewal will be key to ensuring that projects not only thrive but endure.
Looking at this through the lens of single EU member states (Figure 3), once again a rather fragmented picture emerges. Productivity levels are above the EU average in Latvia, Greece, Poland, France, Germany and the Netherlands. All other EU countries show below average productivity levels in terms of Open Source code production.
Turnover and retention rates also widely differ across the member states (Figure 4). In simple terms, retention measures how well a country sustains the inflow of contributors from one year to the next, while turnover captures the share of contributors leaving the ecosystem between consecutive years. The top 5 countries in terms of the retention rate are Malta, Denmark, Slovenia, Finland and the Netherlands (Figure 4). Two of these countries, namely Slovenia and Finland score also very high in terms of turnover rates, besides Luxembourg, Bulgaria and Denmark. The graphs points to a fragmented Europe where there is need for harmonised policy and practice for supporting and contributing to the sustainable maintenance of open source technologies (access the source material of the graphic below: Source 1 | Source 2).
Yet, these trends can also be framed through the lens of innovation theory. Schumpeter’s concept of creative destruction describes how new innovations displace established systems, driving economic progress but also generating instability. In open source, this manifests as frequent project turnover but it could also imply rapid adoption of new technologies, where in the light of classic innovation theory new ideas build on existing foundations rather than replacing them outright. However, it has to be made sure that the knowledge created is maintained and later on also transferred to create benefits across other parts of the society. To compete effectively with the U.S. and China, Europe must address challenges in scaling, cross-border collaboration, and balancing professionalisation with grassroots innovation.
The now emerging European Digital Infrastructure Project for Digital Commons (EDIC-DC) shows potential, so also its announced exploration of a European Sovereign Tech Fund, modelled after the German Sovereign Tech Agency. The upcoming sovereignty package, including the Cloud and AI Development Act, and the European Commission’s new and externally facing open source strategy can also be expected to have a positive effect.
Still, much effort and investment are needed to ensure a sustainable onboarding of contributors and maintenance to create a sustainable and dynamic open source ecosystem capable of sustaining technological progress. The future of European open source will depend on its ability to integrate diverse contributors, maintain high standards of quality, and continuously adapt to global trends, ensuring that open source remains a cornerstone of innovation and sustainability for years to come.
Authors
