Porchlamp's symbol: a porch lamp with its light on

Porchlamp

Find the projects that leave the light on.

A porch lamp left on tells a visitor they are expected. Porchlamp ranks open-source projects the same way: by what happens to a stranger's pull request, not by how many stars the project has.

Stars don't review pull requests

  • More than 1 in 4 active projects are black holes. Of the 4,297 licensed, maintained software projects that received at least ten outside pull requests in six months, 1,133 (26.4%) left most of them with no human reply, review or merge for two weeks.
  • More stars, more silence. The black-hole share rises with popularity: 21% of projects with 1k–10k stars, 31% at 10k–50k, and 39% at 50k or more, nearly 4 in 10 of the most-starred.
  • Stars barely predict the ranking. Across the 3,833 ranked projects the rank correlation between stars and the Porchlamp score is 0.13, and 9 of the 100 most-starred projects make the top 100.

Where the numbers come from

We followed 212,390 pull requests from 110,605 outside contributors to 11,000 projects over six months across npm (JavaScript/TypeScript), PyPI (Python), crates.io (Rust), Go, Maven (Java), and systems software: who got an answer, how fast, how many reached a decision, whether first-time contributors came back, and how much other software depends on each project. Black holes, and projects that are archived, unmaintained, unlicensed or not software, are listed but never ranked. Every number traces back to a recorded GitHub response and its content hash (by Rahul Kumar, pctablet505).

18 parameters across 5 pillars and 5 contributor personas

  • Responsiveness (25%): Time to First Response (TTFHR), Decision Rate (90d), First-timer Merge Rate, PR Ghost Rate (14d), and Time to Merge (p90).
  • Criticality (25%): Deduplicated Dependents, OpenSSF Criticality Score, and Monthly Registry Downloads.
  • Governance (20%): Legal IP Regime (OSI license & CLA/DCO), Elephant Factor, Promotion Ladder, and Bus Factor.
  • Rigor (15%): OpenSSF Scorecard Pipeline Defenses, AI Policy Posture, and Substantive Review Rate.
  • Accessibility (15%): Active Good First Issues, Newcomer Conversion, Newcomer Return Rate (90d), and Developer Experience.

Explore rankings by contributor lens and screen: Balanced Leaderboard · Best Open-Source Projects for First-Timers · Career Capital · Senior Systems · AI-Assisted Contributors · Not Ranked (Gated & Unrated) · Leverage vs. Friction Matrix · Compare Repositories · Configure Custom Weights · Full Methodology & Verification Hashes

Filter by language & package ecosystem: Python (PyPI) · JavaScript & TypeScript (npm) · Rust (crates.io) · Go · Java (Maven) · Systems (C/C++/Zig)

Top ranked open-source repositories (Balanced snapshot 2026-10-14)

3,833 ranked, 5,790 gated, and 1,377 unrated of 11,000 evaluated repositories (Not ranked lists every gated and unrated repository with its plain-English reason). Tier is capped when parameter coverage is below 95%.

RankRepositoryEcosystemPorchlampCoverageTierQuadrant
1meshery/mesherynpm81.1665%B (capped)Sweet Spot
2WordPress/gutenbergnpm80.9361%B (capped)Sweet Spot
3ggml-org/llama.cppsystems80.8378%B (capped)Sweet Spot
4rust-lang/rustcrates80.7961%B (capped)Sweet Spot
5prometheus/prometheusgo79.1181%A (capped)Sweet Spot
6servo/rust-smallveccrates78.9994%A (capped)Sweet Spot
7kornia/korniapypi78.4781%A (capped)Sweet Spot
8rust-lang/libccrates78.1493%A (capped)Sweet Spot
9freeCodeCamp/freeCodeCampnpm78.0265%B (capped)Sweet Spot
10ant-design/ant-designnpm77.5165%B (capped)Sweet Spot
11kedacore/kedago76.9993%A (capped)Sweet Spot
12external-secrets/external-secretsgo76.8093%A (capped)Sweet Spot
13organicmaps/organicmapssystems76.4993%A (capped)Sweet Spot
14webdriverio/webdriverionpm76.2381%A (capped)Sweet Spot
15apache/airflowpypi76.1561%B (capped)Sweet Spot
16onnx/onnxpypi75.8693%A (capped)Sweet Spot
17matplotlib/matplotlibpypi75.8193%A (capped)Sweet Spot
18kubernetes-sigs/cluster-apigo75.3893%A (capped)Sweet Spot
19biomejs/biomecrates75.2765%B (capped)Sweet Spot
20moby/mobygo74.9081%A (capped)Sweet Spot

Snapshot 2026-10-14 · benchmark 2.0.0-rc1 · constants 6e4f3e8e1d0c… · manifest 85d93789d7a5… · reproduce: python -m porchlamp.snapshot reproduce 2026-10-14