Porchlamp
Find the projects that leave the light on.
A porch lamp left on tells a visitor they are expected. Porchlamp ranks open-source projects the same way: by what happens to a stranger's pull request, not by how many stars the project has.
Stars don't review pull requests
- More than a third of active projects are black holes. Of the 4,358 licensed, maintained software projects that received at least ten outside pull requests in six months, 1,610 (36.9%) left most of them with no human reply, review or merge for two weeks. Counting only pull requests opened by people, not bots, gives 56.3%.
- More stars, more silence. The black-hole share rises with popularity: 33% of projects with 1k–10k stars, 40% at 10k–50k, and 48% at 50k or more.
- Stars barely predict the ranking. Across the 3,407 ranked projects the rank correlation between stars and the Porchlamp score is 0.13, and 9 of the 100 most-starred projects make the top 100.
Where the numbers come from
We followed 212,390 pull requests from 110,605 outside contributors to 11,000 projects over six months across npm (JavaScript/TypeScript), PyPI (Python), crates.io (Rust), Go, Maven (Java), and systems software: who got an answer, how fast, how many reached a decision, whether first-time contributors came back, and how much other software depends on each project. Black holes, and projects that are archived, unmaintained, unlicensed or not software, are listed but never ranked. Every number traces back to a recorded GitHub response and its content hash (by Rahul Kumar, pctablet505).
18 parameters across 5 pillars and 5 contributor personas
- Responsiveness (25%): Time to First Response (TTFHR), Decision Rate (90d), First-timer Merge Rate, PR Ghost Rate (14d), and Time to Merge (p90).
- Criticality (25%): Deduplicated Dependents, OpenSSF Criticality Score, and Monthly Registry Downloads.
- Governance (20%): Legal IP Regime (OSI license & CLA/DCO), Elephant Factor, Promotion Ladder, and Bus Factor.
- Rigor (15%): OpenSSF Scorecard Pipeline Defenses, AI Policy Posture, and Substantive Review Rate.
- Accessibility (15%): Active Good First Issues, Newcomer Conversion, Newcomer Return Rate (90d), and Developer Experience.
Explore rankings by contributor lens: Balanced Leaderboard · Best Open-Source Projects for First-Timers · Career Capital · Senior Systems · AI-Assisted Contributors · Leverage vs. Friction Matrix · Full Methodology & Verification Hashes
Filter by language & package ecosystem: Python (PyPI) · JavaScript & TypeScript (npm) · Rust (crates.io) · Go · Java (Maven) · Systems (C/C++/Zig)
Top ranked open-source repositories (Balanced snapshot 2026-10-13c, 3,407 ranked of 11,000 evaluated)
| Rank | Repository | Ecosystem | Porchlamp Score | Quadrant |
|---|---|---|---|---|
| 1 | meshery/meshery | npm | 81.09 | Sweet Spot |
| 2 | WordPress/gutenberg | npm | 80.80 | Sweet Spot |
| 3 | ggml-org/llama.cpp | systems | 80.78 | Sweet Spot |
| 4 | rust-lang/rust | crates | 80.69 | Sweet Spot |
| 5 | prometheus/prometheus | go | 79.11 | Sweet Spot |
| 6 | servo/rust-smallvec | crates | 78.98 | Sweet Spot |
| 7 | kornia/kornia | pypi | 78.62 | Sweet Spot |
| 8 | rust-lang/libc | crates | 78.07 | Sweet Spot |
| 9 | freeCodeCamp/freeCodeCamp | npm | 77.50 | Sweet Spot |
| 10 | ant-design/ant-design | npm | 77.49 | Sweet Spot |
| 11 | kedacore/keda | go | 77.00 | Sweet Spot |
| 12 | external-secrets/external-secrets | go | 76.61 | Sweet Spot |
| 13 | organicmaps/organicmaps | systems | 76.39 | Sweet Spot |
| 14 | webdriverio/webdriverio | npm | 76.31 | Sweet Spot |
| 15 | apache/airflow | pypi | 76.09 | Sweet Spot |
| 16 | onnx/onnx | pypi | 75.87 | Sweet Spot |
| 17 | matplotlib/matplotlib | pypi | 75.83 | Sweet Spot |
| 18 | kubernetes-sigs/cluster-api | go | 75.37 | Sweet Spot |
| 19 | biomejs/biome | crates | 75.21 | Sweet Spot |
| 20 | moby/moby | go | 74.85 | Sweet Spot |