Research Domain
4 published observations collected under this domain with verified sources.
The September 2026 package-registry funding pledge is bigger than pricing: it recognizes npm, PyPI, Maven Central, crates.io, and similar services as load-bearing infrastructure for modern software supply chains.
npm automation can now prepare a release without being able to publish it directly. That small permission change matters because it separates build automation from the final act of putting a package on the public registry.
Apache's annual report is notable because it measures open source not only as code production, but as governance, release infrastructure, security tooling, and long-term stewardship.
Commits, pull requests, releases, issues, stars, and contributors describe different parts of project activity. They should not be collapsed into one magic number.
