Deciding what to stop building: ten years of Spotify, read from its own archive notices

Reconstructs a decade of platform decisions at Spotify from 289 public repositories and the dated notices attached to them, the package registries that record when software actually stopped shipping, and the 69 security advisories filed against the developer portal it open sourced. A reader leaves able to run the same census on any organisation, to read an archive notice as the decision record it usually is, and to plan a portal deployment against the scale limits and failure classes that adopters have already reported.

What you get out of it

• Every in-house infrastructure component in the public record was replaced by a managed service from one vendor, so the architecture became less visible as the migration succeeded: the DNS library, the secret distribution service and the metrics stack have no public successors because the successors are configuration.
• Software leaves an estate by five doors, not two: replaced upstream, donated, withdrawn from publication while still in production, declared finished (dbeam: in production since August 2017, no features planned), or archived with no reason given; and the archive date is the paperwork date, years after the engineering one, so the package registry rather than the archive flag is what dates the real ending.
• Archiving ends maintenance without ending deployment: Heroic was frozen on 27 March 2021 with log4j-core 2.13.3 pinned in its final build file, 258 days before CVE-2021-44228 was published against that exact range, and its container image has been pulled 6,462 times.
• The one component Spotify kept building is the only one whose defect record is public, and that record is concentrated in the two features where the portal executes text a user committed to a repository: template rendering and documentation configuration, from a 2021 remote code execution through the August 2026 batch.
• Adopters find the scale ceiling that the owner never hits: fetch timeouts at 21,000 catalogue entities of which 14,000 were users, and facet queries taking one to six seconds at just over 2,000 components, both closed as not planned.

Scope

Why this, now. Thirty-seven security advisories against Backstage were published on a single day, 28 August 2026, five and a half years after Spotify open sourced it, and they concentrate in exactly the two features that made an internal tool valuable inside a trusted network.

What it does not cover. Anything Spotify never published: the audio serving path, recommendation and personalisation systems, the storage behind them, internal cost figures and the internal size of its own catalogue. It also contains no outage postmortem, no conference talk and no peer-reviewed paper, because this session's network policy reached code hosts, package registries and one cloud vendor's blog and nothing else.