Critical open-source dependency loses maintainer support

Risk statement. The job-scheduling library at the centre of our background processing has had one maintainer for three years. Last commit was five months ago and there are 40 open issues. If it is abandoned, security patches stop.

Trigger / early warning. No commit activity for nine months, or an unpatched CVE published against it.

Consequence if realised. We either fork and maintain it ourselves or migrate to an alternative. Both are multi-week efforts, neither is urgent today.

Current response. Mitigate cheaply. Vendor the dependency so we can patch it ourselves, and keep a shortlist of alternatives current.