ai
Interview with a Maintainer
28 Jul 2026
Interview with a Maintainer
What happened
- libcapstan receives eighty million downloads per month.
- Approximately forty thousand packages depend on libcapstan.
- Erin Marsh is the primary maintainer of libcapstan.
- libcapstan had three maintainers until 2023.
- One co-maintainer left libcapstan in 2023 when he had kids.
- Another co-maintainer stepped back last year and now has a farm.
- Erin Marsh reported bugs in libcapstan in 2019.
- Erin Marsh received repository transfer invitation for libcapstan about a month after reporting bugs.
- libcapstan receives approximately ten security reports per month, up from one or two a few years ago.
- Roughly one in fifteen security reports to libcapstan describes a real problem.
- Erin Marsh set up an agent to verify security exploits in libcapstan in November.
- The exploit verification agent worked well for two weeks before the account was banned.
- A security vendor filed a vulnerability report in libcapstan header parsing in February with a seventy-two hour deadline before public disclosure.
- Erin Marsh shipped a fix for the libcapstan vulnerability in twenty-six hours.
- libcapstan has four dependencies.
- libcapstan previously had six dependencies.
- libcapstan depended on a small library since 2014.
- Last month libcapstan received approximately sixty pull requests per week from agent contributors.
- Three agent contributions to libcapstan were useful this year.
- Erin Marsh said about an excellent agent contribution: 'One was excellent, actually, a race in the retry logic that none of us had caught in a decade.'
- Erin Marsh has stopped reporting bugs upstream to her dependencies.
Numbers
- libcapstan receives eighty million downloads per month. (80000000)
- Approximately forty thousand packages depend on libcapstan. (40000)
- libcapstan receives approximately ten security reports per month, up from one or two a few years ago. (10)
- Roughly one in fifteen security reports to libcapstan describes a real problem. (1)
- A security vendor filed a vulnerability report in libcapstan header parsing in February with a seventy-two hour deadline before public disclosure. (26)
- libcapstan has four dependencies. (4)
- libcapstan previously had six dependencies. (6)
- Last month libcapstan received approximately sixty pull requests per week from agent contributors. (60)
- Three agent contributions to libcapstan were useful this year. (3)
Why founders should care
- May indicate faster shipping cycles for teams adopting the new tools.