Another view: It is an issue of libraries owned by individual developers. I commonly argue for organisations of some kind to take over ownership over "relevant"

Another view: It is an issue of libraries owned by individual developers. I commonly argue for organisations of some kind to take over ownership over "relevant" libraries. This of course is nothing which can be enforced. Benefits are not only reduction of "bus factor" on a single developer, but also enables review procedures. Depending on the project this could be a custom organisation, a "generic" organisation like ASF. Libraries owned by a single developer for me are a notable risk, when taking them as dependency.