This article is based on findings from Sonatype’s State of the Software Supply Chain Report, as reported by BetaNews (2017).
Open Source Speeds Development — But Introduces Risk
Modern software teams rarely build applications entirely from scratch. Instead, they assemble them from a growing ecosystem of open source components, pulling libraries and frameworks from repositories like Maven Central, npm, and Docker Hub. This dramatically accelerates development cycles, but it also introduces a critical risk: if the quality and security of those components are not actively managed, vulnerable code can flow directly into production applications.
Key Findings from Sonatype’s Software Supply Chain Report
Sonatype’s State of the Software Supply Chain Report found that organizations which actively manage the quality of open source components flowing into their production applications achieve measurable improvements across multiple dimensions:
- 28% improvement in developer productivity
- 30% reduction in overall development costs
- 48% increase in application quality
Wayne Jackson, CEO of Sonatype, summarized the finding: “Companies are no longer building software applications from scratch, they are manufacturing them as fast as they can using an infinite supply of open source component parts. However, many still rely on manual and time-consuming governance and security practices instead of embracing DevOps-native automation. Our research continues to show that development teams managing trusted software supply chains are dramatically improving quality and productivity.”
The Scale of Open Source Component Consumption
The scale of open source consumption makes manual governance impractical. According to the report’s data (covering 2016):
- Java component downloads grew 68% year-on-year, reaching approximately 52 billion downloads.
- JavaScript (npm) downloads grew 262% year-on-year, reaching approximately 59 billion downloads.
- Docker component downloads were projected to grow 100%, reaching approximately 12 billion downloads.
Faced with this volume, high-functioning DevOps organizations are replacing manual review processes with machine automation — integrating component quality and security checks directly into their CI/CD pipelines rather than treating them as a separate, downstream concern.
Open Source Maintainers Are Slow to Fix Vulnerabilities
One of the more concerning findings is that the open source community itself is slow to address known vulnerabilities:
- Only 15.8% of OSS projects actively fix vulnerabilities.
- Even among those that do, the mean time to remediation is 233 days — more than seven months after a vulnerability is publicly known.
This slow remediation cycle places the responsibility squarely on consuming organizations. DevOps teams cannot rely on upstream maintainers to patch vulnerabilities in a timely manner. Instead, they need internal policies and automated tooling to control which OSS projects and specific component versions are permitted to enter their software supply chains.
Signs of Gradual Improvement
Despite these challenges, the data shows modest but real progress. In 2016, the percentage of Java components downloaded from the Maven Central Repository that contained known security vulnerabilities fell to 5.5%, down from 6.1% the previous year. While still significant at scale, this represents the third consecutive year of decline and suggests that the broader ecosystem’s security hygiene is slowly improving.
The regulatory environment is also providing a tailwind. Government agencies and industry bodies have begun issuing guidelines around software supply chain security, creating additional pressure on both OSS maintainers and consuming organizations to raise the bar on component quality and security.
What DevOps Teams Should Do
The core takeaway from this research is that passive consumption of open source components is a liability. High-performing DevOps organizations treat open source governance as a first-class engineering discipline. Practically, this means:
- Automate component analysis in your CI/CD pipeline using tools that check against known vulnerability databases (such as the NVD) at build time.
- Establish a trusted component policy that defines which versions and projects are approved for use, and enforce it automatically rather than relying on manual code review.
- Track your software bill of materials (SBOM) so you know exactly which OSS components are in each application and can respond quickly when new vulnerabilities are disclosed.
- Set upgrade policies that prioritize patching vulnerable components promptly, rather than waiting for the next major release cycle.
- Monitor for new disclosures against the components already in production, not just at build time.
Summary
Open source components are a foundational part of modern software delivery, but they represent a significant and often underestimated attack surface. Sonatype’s research demonstrates that DevOps teams which actively automate open source governance — rather than treating it as a manual, periodic audit — achieve substantially better outcomes in productivity, cost, and application quality. As component consumption volumes continue to grow, the case for integrating supply chain security directly into DevOps pipelines only becomes stronger.