Methodology

Dataset scope

Based on the Exodos Labs provenance dataset.

The corpus supports research into contributors, maintainers, repositories, releases, package ecosystems, and software bills of materials. It does not represent every open-source project, and its findings should be read within the supplied coverage and caveats.

Dataset coverage

• 785,816 deduplicated contributors
• 8.8 million attributed commits
• 105,533 package maintainers
• 58,346 source repositories
• 21.2 million release versions
• 11 package ecosystems
• Growing enterprise SBOM corpus from production software

How records are interpreted

Identity deduplication

Contributor counts use deduplicated identities supplied by the provenance dataset. FOSS Data publishes aggregate findings rather than individual contributor records.

Inferred geography

Contributor geography is inferred in the provenance dataset, so geographic findings describe modeled patterns rather than a census of self-reported locations.

Maintainers and contributors

Maintainers and contributors are distinct roles in this research. Contributors author commits; registered package maintainers can publish releases. A person may appear in both populations, but the measures are not interchangeable.

Commit attribution

Commit attribution connects recorded activity to deduplicated contributor identities for aggregate analysis. The supplied 8.8 million records define the study coverage, not every open-source commit ever made.

Release coverage

Release coverage includes 21.2 million versions from 11 package ecosystems. Results about maintainership and release control refer to those observed ecosystems and versions.

SBOM findings

These findings use anonymized, aggregate SBOM data from production software. They describe population-level patterns only; customer files, names, and identifiable project records are not published.

Known limitations and freshness

Measured 25 June 2026. Published 2 August 2026. These dates come from the approved source-lock attestation and remain separate from deployment time.

The dataset is a bounded research corpus, geographic attributes are inferred, and SBOM observations come from a separate growing corpus. FOSS Data is a published research edition, not a live census or real-time risk feed.

Research editions

Edition labels identify the published research state. The current public material is the 2026 edition; citations and comparisons should retain that edition and its measured and published dates.