Actually, the kind of features ESR asks for are covered by github, IMO. It's easy to review code quality from there, the number of stars and forks reflect proje

Actually, the kind of features ESR asks for are covered by github, IMO. It's easy to review code quality from there, the number of stars and forks reflect project popularity, the list of committers (how many they are and who they are) can help having an idea about long term maintenance expectations, etc. The cool thing is that it works for almost any language : github is "social coding", thus it's also social validation. But this article raises an other question : if you want 10 years long stability, is it wise to rely on third party code? If you plan on maintaining your own project that long, it's probably acceptable to take time to write your own implementation and maintain it. Or you could even use a third party dependency, then progressively replace it with your own API compatible implementation.