Google study finds custom patches can make open-source updates harder

• 

  Google’s case study found that company-specific patches were linked to higher median effort for updating open-source packages.

• 

  Across 54 package updates tracked from April to December 2024, median effort was 2.2 engineering hours and average effort was 13.9 hours.

• 

  Among 47 packages with usable patch-detection results, the median effort for packages with company-specific patches was three times that for packages without patches.

• 

  Some updates took days or months, with remediation, local modifications and dependencies contributing to the workload.

• 

  Google said the findings may not apply broadly because the observed updates represented less than 1% of its package updates during the collection period.

Who

Google researchers studied engineers’ efforts to update open-source packages.

What

The study found that company-specific patches were associated with higher median update effort.

When

Google tracked updates from April to December 2024. Help Net Security published its article on October 12, 2026.

Where

At Google.

Why

Local patches, dependencies and repairs to affected software can add work when packages are updated.

This story does not have two clearly opposing sides.