{"id":96261,"date":"2024-06-27T08:00:00","date_gmt":"2024-06-27T15:00:00","guid":{"rendered":"https:\/\/opensource.microsoft.com\/blog\/?p=96261"},"modified":"2025-05-30T17:21:05","modified_gmt":"2025-05-31T00:21:05","slug":"5-things-we-learned-from-sponsoring-a-sampling-of-our-open-source-dependencies","status":"publish","type":"post","link":"https:\/\/opensource.microsoft.com\/blog\/2024\/06\/27\/5-things-we-learned-from-sponsoring-a-sampling-of-our-open-source-dependencies\/","title":{"rendered":"5 things we learned from sponsoring a sampling of our open source dependencies\u00a0"},"content":{"rendered":"\n

Microsoft supports and invests in the open source\u00a0ecosystem in many ways. One\u00a0such effort has\u00a0been the\u00a0Free and Open Source Software Fund Program (FOSS) Fund program<\/a>, which\u00a0has historically relied on employee nominations and voting to determine\u00a0sponsorships of our dependencies.\u00a0 This month, we were excited to experiment with advancements in this program\u00a0and of our capabilities through a\u00a0data-driven\u00a0approach. \u00a0<\/p>\n\n\n\n

This experiment focused on programmatically selecting a sampling of dependencies for bulk sponsorship through GitHub Sponsors<\/a>.<\/p>\n\n\n\n

Our experiment’s goal was to identify open source projects for sponsorship through deep analysis of our dependencies leveraging, metadata from Ecosyste.ms<\/a>, an external supplier of open data about packages and source repositories, our inventory of our internal dependencies, as well as application of CHAOSS metrics for sustainability<\/a>. We made room for nominations from employees as well.\u00a0Ultimately, we sponsored 175 open source sponsorable entities (either maintainers or organizations that met criteria detailed below) representing 266 open source repositories and 396 unique packages with grants that ranged from USD1,000 to USD12,500\u2014here are five things we learned, and are quite honestly still figuring out:\u00a0<\/p>\n\n\n\n

#1 Inventory and metadata of dependencies is critical to isolating projects for sponsorship with a lens for sustainability<\/h2>\n\n\n\n

Free and Open Source Software Fund Program (FOSS) Fund program<\/a>,\u00a0which\u00a0has historically relied on employee nominations and voting to determine\u00a0sponsorships of our dependencies.\u00a0 This month, we were excited to experiment with advancements in this program\u00a0and of our capabilities through a\u00a0data-driven\u00a0approach. \u00a0<\/p>\n\n\n\n

Candidates for sponsorship were derived from metadata analysis of tens of thousands of dependencies. The analysis combined our internal inventory of Microsoft dependencies with package and source repository metadata, largely from Ecosyste.ms<\/a> (whose main developer, @andrew<\/a> was sponsored this round). If you don\u2019t already have an inventory of your dependencies but use GitHub, we recommend using the GitHub dependency graph<\/a> to find all the dependencies used across an entire GitHub Organization.\u00a0<\/p>\n\n\n\n

By placing all the related metadata fields into tables in Microsoft Azure Data Explorer<\/a>, we were able to use the Kusto Query Language<\/a> (KQL) to analyze tens of thousands of dependencies and repositories. This approach allowed us to drill down to the individual packages meeting our criteria (described further in this post), and to map those packages to source repositories where a second set of criteria could be applied.\u00a0<\/p>\n\n\n\n

#2 Setting quantitative criteria for sponsorship beyond number of use and popularity was massively helpful in zooming in on problems we want to help solve\u00a0<\/h2>\n\n\n\n

There were five types of criteria we applied to data-driven nominations and qualitative alike:\u00a0<\/p>\n\n\n\n