One of my takeaways from the log4j issue is that the log4j devs should have never accepted the patches to add LDAP urls in the first place. Or perhaps, they should have removed that feature when it became burdensome. I would have. There’s a pressure to accept whatever patches come your way as an opensource developer, but actually, you’re under no obligation to do any such thing. Open source also means the source is available - so people are free to take your code, mix in their patches and maintain it themselves. And if they can’t be bothered doing that, why should I shoulder that burden?

I think us opensource devs should get more comfortable saying no. “I hear that this feature is important to you but it doesn’t solve a problem I (or anyone else I know) cares about. Please maintain those patches in your own fork.”