Google can update third party open source dependencies in two hours or so, but forked code takes much longer.

But, forks take longer:

On predictors: custom patches matter most. Packages Google had patched took three times longer at the median than unpatched ones, and “Google-specific patches or customization” was also the single most-cited reason engineers gave for a slow update. Volume of external dependencies, package size, and upstream change velocity tracked effort as well, while package age and how heavily a package was used internally showed no consistent relationship.

The practical reading is that forking and patching is where the maintenance bill accrues, not consumption itself.

Summarized by AI.

🔗 Google Measures the Cost of Keeping Open Source Up to Date: Half of Updates Take Under 2 Hours, Custom Patches Triple the Median