There ought to be an organization willing to offer these maintainers the option to transfer control to a committee or organization set up to be stewards. Not qu

There ought to be an organization willing to offer these maintainers the option to transfer control to a committee or organization set up to be stewards. Not quite locked and frozen, but say, resistant to change. Security fixes only. Perhaps the Linux Foundation would sponsor something like this? A package that hasn't been updated since 2015 should be considered frozen, not a long term risk. End of life open source projects should be safe to use, not undetonated warheads.