Google tracked the engineering effort behind 54 open source package updates between April and December 2024, according to Help Net Security's coverage of the company's case study. Most updates should take four engineering hours or less, but more demanding ones can require days or months. One update in the sample took an estimated 400 hours.
Local modifications were the clearest driver of extra work. Among the 47 packages with usable patch-detection results, those carrying company-specific patches had a median update effort three times higher than packages without patches. Engineers surveyed by Google identified patches and customization as the leading cause of additional effort. Larger numbers of external dependencies and upstream contributors were also tied to longer updates.
For updates that took more than two days, most time went to remediation: resolving downstream dependency issues and repairing breakage in applications that rely on the package. Google's setup limits broader conclusions, however. The observed updates represented less than 1% of Google's package updates during the period, 52 of the 54 packages were written in Go, and selections followed internal business priorities. The study did not evaluate the impact of individual tools, including generative AI.