Google study details hidden engineering cost of open-source updates
A Google case study examined the effort needed to maintain internal copies of open-source packages, tracking 54 updates from April to December 2024. Most updates should take four engineering hours or less, but complex ones can require days or months, with local patches, dependencies, and repairs driving the workload. Packages with company-specific patches had median update effort three times higher than those without.
Google examined 54 internal package updates from April through December 2024. Most should need no more than four engineering hours, yet harder cases stretched into days or months. Median total effort was 2.2 hours; average 13.9, and one update was estimated at 400 hours.
Among 47 packages with usable patch data, company-specific modifications tripled median update effort. More external dependencies and upstream contributors tracked with greater effort. For updates exceeding two days, remediation dominated. The sample covered under 1% of Google’s updates, and 52 packages used Go.
This finding may influence how organizations weigh open-source adoption versus maintenance. Developers and platform teams could face hidden workloads when local patches, dependencies, or breakage require remediation, potentially delaying other engineering work. Managers may use such data to budget engineering time and decide when customization is worth the long-term cost. Because Google’s sample is narrow, broader effects remain uncertain.