To be fair, for many libraries, maintenance is not really required. Hit a bug? Don't do that, or fix that particular bug. Doesn't require daily changes. Certai

To be fair, for many libraries, maintenance is not really required. Hit a bug? Don't do that, or fix that particular bug. Doesn't require daily changes. Certain types of exposed and way too large components need constant hardening (e.g. OpenSSL, nginx) to patch CVEs, but they are the exception not the rule. We're a bit too stuck on the idea that things need to constantly change to be healthy.