{"id":45489,"date":"2026-03-31T12:14:49","date_gmt":"2026-03-31T16:14:49","guid":{"rendered":"https:\/\/www.bloomberg.com\/company\/stories\/sustaining-opentelemetry-cncf-moving-from-dependency-management-to-stewardship\/"},"modified":"2026-04-21T10:04:08","modified_gmt":"2026-04-21T14:04:08","slug":"sustaining-opentelemetry-cncf-moving-from-dependency-management-to-stewardship","status":"publish","type":"post","link":"https:\/\/www.bloomberg.com\/company\/stories\/sustaining-opentelemetry-cncf-moving-from-dependency-management-to-stewardship\/","title":{"rendered":"Sustaining OpenTelemetry: Moving from Dependency Management to Stewardship"},"content":{"rendered":"
\n \n\t\n\t\n\t
\n\t\t\n\t\t\t
\n\t
\n \n

Modern software runs on open source. In fact, “free” and open source software generates <\/span>more than $500 billion in annual value in the U.S.<\/span><\/a> alone and <\/span>an estimated $8.8 trillion in total global value<\/span><\/a>.<\/span><\/p>\n

For most organizations, \u201cdependency management\u201d means tracking what you use, scanning for known vulnerabilities, and patching when you\u2019re forced to. That work matters\u2014but it mostly addresses what\u2019s visible: direct dependencies, known CVEs, and near-term upgrades.<\/span><\/p>\n

However, the real risk lives below the surface.<\/span><\/p>\n

Open source is made up of many complex ecosystems: deep transitive dependency chains, small maintainer teams, uneven review capacity, and critical projects that are \u201ceverywhere\u201d but owned by no one. Without sustained investment in contributor capacity, a project\u2019s human bandwidth can erode \u2013 through maintainer burnout, underfunding, or a thin contributor pipeline \u2013 and when that happens, security and stability can degrade quickly. The result is a recurring pattern the industry knows too well: emergency patch cycles, fragile forks, and \u201csilent\u201d maintenance debt that compounds until it becomes a business outage \u2013 sometimes even global disruption. The most effective response to this risk is proactive, not reactive: investing in contributor pipelines before a project reaches that breaking point.<\/p>\n\n<\/div>\n

\n \n

A practical model: Structured contributor pipelines<\/span><\/h2>\n

At Bloomberg, we\u2019ve been developing \u2013 in partnership with nonprofit foundations that support open source \u2013 a mentorship-based approach to open source stewardship that focuses on the key missing ingredient:<\/span> creating sustained contributor capacity for maintainers and projects<\/b>.<\/span><\/p>\n

Instead of one-off patches, we run time-bound cohorts where Bloomberg engineers \u2013 including many who have never contributed to open source \u2013 spend volunteer hours learning to contribute directly to a project with structured support from experienced open source guides:<\/span><\/p>\n