An Arch maintainer that I personally know once admitted that he rarely review upstream changes when bumping package versions. He only does that when the build breaks.
I can't blame him for what he did, since it's not reasonable to ask package maintainers to spend all their time on those stuff, especially in this "Age of AI" where more and more software are being aggressively refactored (or rather rewritten) and added more features.
What we can do is choosing a stable distro (like Debian) where packages are more thoroughly reviewed, and apply security practices (such as TOTP, sandboxing browsers and video players, etc.) even though they cause inconvenience.
Hello, I'm a computer enthusiast who recently started coding as a hobby.Sometime mid 2024, I opened my first pull request to a popular open source project that I use daily. The patch adds a small feature to the software, which is rather trivial (~200 loc, and does not affect other features).At first, the project maintainer actively reviewed my patch. But sometime later, he suddenly stopped...