There's a funny bite here that seems long-term good.
The gov has a large culture of tapping integrators who do not give back to OSS, just use, basically the middle man, and leave behind fragile one-offs. Such abandonware should overwhelm recieving depts within 6-12mo, and bringing back integrators for the treadmill of patching superfluous npm CVEs would break their budgets.
So that means pressure to, well, not do that. Either the integrators get more involved, or part of the budgets finally goes to people who are.
The gov has a large culture of tapping integrators who do not give back to OSS, just use, basically the middle man, and leave behind fragile one-offs. Such abandonware should overwhelm recieving depts within 6-12mo, and bringing back integrators for the treadmill of patching superfluous npm CVEs would break their budgets.
So that means pressure to, well, not do that. Either the integrators get more involved, or part of the budgets finally goes to people who are.