Putting the services back together · Practitioner Field Guide

The territory

The problem, stated without naming a technology: an organisation broke one system into hundreds of independently owned pieces, and now has to make a single change across them without putting the pieces back into one program.

8×

Traffic growth through Airbnb's aggregation layer, 2020 to 2025

Airbnb, 2025-09-15

130+

Teams hosting their code inside one runtime

Airbnb, 2025-09-15

1.5M

Lines of application code in that runtime, plus about the same again in tests

Airbnb, 2025-09-15

2018

Last release of the service-discovery layer that made the split possible

RubyGems, 2018-11-01

Airbnb spent the second half of the 2010s doing what the industry told it to do. It published a client-side service-discovery stack, gave two data tools to the Apache Software Foundation, shipped a distributed job-queue cluster, and built a web platform of its own testing, rendering and linting libraries. Almost all of that is now dead, and the registries date the deaths precisely. The routing half of SmartStack last shipped a gem on 1 November 2018 and the registration half on 4 September 2017, after which the repositories sat untouched and unlabelled. Dynein, the distributed delayed job queue, was archived on 16 December 2021. Hypernova, the server-side rendering service, published its last npm version on 2 January 2019 and was archived nearly five years later.

What replaced them is the interesting part, and it is not what the usual narrative predicts. Airbnb did not merge its services. It built a place for business logic to live that is not a service at all, and then spent five years moving logic into it. The project is called Viaduct, it was started in 2020, and Airbnb's own description of why is worth reading twice: it exists "to address the complexity and inefficiencies caused by an ever-growing dependency graph of microservices at Airbnb", and its method is "organizing service interactions around data rather than remote procedure calls". By September 2025 it was carrying over 1.5 million lines of code owned by more than 130 teams, and more than three quarters of the requests hitting it came from other internal systems rather than from a phone or a browser.

The surprise

The remedy decayed the same way the disease did. Four years after Viaduct started, Airbnb rebuilt it from the ground up, and the stated reasons are the microservice complaint in miniature: the system "had become complex, with multiple ways to implement functionality and weak abstraction boundaries, making it hard to evolve without disrupting users". Centralising the code did not, by itself, produce a boundary. It moved the boundary problem from the network to the codebase, where it was invisible until it was expensive.

This guide covers that arc: what Airbnb split, what it stopped publishing, what it now forks instead of building, and the mechanics of the layer it built to re-aggregate. It deliberately does not cover Airbnb's data platform, its search and pricing systems, its mobile client architecture beyond what the registries show, or its costs, because no artefact in this corpus carries a cost figure. It is a single-company guide, which is the trade it makes: depth on one decade instead of breadth across five organisations.

Figure 1 · A decade, dated from artefacts rather than announcements

The 2015 cohort of published infrastructure is gone and the 2025 cohort is a programming model rather than a cluster. Dates are release timestamps from RubyGems, npm and Maven Central, and archive notices from the repository listing.

Diagram source

How it is actually built

The shape of a re-aggregation layer, reconstructed from Airbnb's implementation documents, its bootstrap code and its roadmap. Every box below is attributable to a document in the evidence wall.

The first thing to understand is that Viaduct is not deployed next to your services. It is deployed inside one. The repository's own architecture note for contributors puts it plainly: "a systems builder embeds viaduct.service.api.Viaduct in their server and routes requests to Viaduct.execute". The GraphQL schema is the integration contract, the resolvers that implement it are ordinary Kotlin classes compiled into the same binary, and the teams that own them are called tenants. A tenant module is, in Airbnb's definition, "a unit of schema together with the code that implements that schema, and crucially, is owned by a single team".

The second thing is that the composition rule is not a function call. Modules are forbidden from depending on each other's code; they compose by asking the graph for data. Airbnb calls this re-entrancy, and the example in its own write-up is precise: a Messaging team that wants a displayName on User declares @Resolver("firstName lastName") and receives those fields, without importing anything from the team that owns User. Three teams could own three fields on one object and never share a symbol. That is the replacement for the RPC boundary, and it is the whole architectural bet: a declarative data dependency is cheaper than a network hop and more enforceable than a coding convention.

Figure 2 · Reference architecture of a re-aggregated estate

The boundary that used to be a network hop is now the line between a dynamically typed engine and a statically typed tenant API inside one process. Reconstructed from the repository's architecture note, the access-check design document and Airbnb's five-year retrospective. The dashed path is marked experimental in the source tree.

Diagram source

The dispatcher

Putting 130 teams in one program concentrates blast radius, so the fleet is not one fleet. A dispatcher routes operations to deployment shards using shuffle sharding, which also isolates offline traffic from online traffic and lets experimental framework builds run beside stable ones. Airbnb says it does not plan to open-source this piece because it is tied to its own serving framework, which is the honest signal that the published artefact is a runtime and not a deployment story.

Source: Airbnb, 2025-09-15

The typed and untyped halves

The engine works on "a dynamically-typed representation of GraphQL values", plain maps from field name to value. The tenant API is generated Kotlin classes for every type in the central schema, and those classes are thin wrappers over the dynamic representation. The reason is evolution speed: the engine can change for latency and reliability without touching a million lines of application code, and the developer API can change without touching the engine.

Source: Airbnb, 2025-09-15

Authorisation inside the engine

Access checks are not a call to a permissions service per field. A CheckerExecutorFactory produces a checker for each field coordinate at bootstrap; the query plan embeds the data each checker needs as a child plan; and every field result carries two memo slots, one for the resolver result and one for the check. For queries the checker runs in parallel with the resolver, for mutations it runs first and the resolver only runs if it passes.

Source: Access-check design document, 2026

The component that most clearly marks the decade's inversion is the one labelled experimental. core/x/remoteresolvers lets a resolver run in a different process, reached by gRPC, with a callback channel so it can still issue graph queries. In 2016 that arrangement was simply called having services. In 2026 it is an experiment in a directory prefixed x, and its own design document lists the bill: "the two processes do not share an engine, injector, schema object, executor instance, or registry. They must independently load compatible tenant code and schemas." That sentence is the clearest statement of the cost of a process boundary I found anywhere in this corpus, and it was written by the people who spent five years removing them.

Figure 3 · What a process boundary costs, in one request

Splitting one resolver across processes adds a second bootstrap, a second schema load, a wire format and a callback channel, and the main server still owns planning, checking and completion. Reconstructed from the remote-resolver architecture document.

Diagram source

The decisions that matter

Each fork in the road, with the option Airbnb rejected, the reason it gave, and the condition under which the rejected option becomes the right one for you.

Decision: where should business logic live once you have too many services?

Chosen

Host it inside the aggregation layer, as tenant modules in one runtime
Teams retire standalone services by migrating their APIs in

Rejected

A thin graph over microservices that keep the logic
Airbnb names this as the orthodoxy it is breaking with

Flips when

The logic needs a runtime the host cannot give it: another language, a GPU, a different release cadence, or hard tenant isolation
Below roughly a dozen services the coordination cost the layer removes does not exist yet, and the layer is pure overhead

Decision: what enforces modularity once the process boundary is gone?

Chosen

A formal tenant module: schema plus implementing code, one owning team
Cross-module composition only through graph fragments and queries
Module configuration generated at build time into META-INF

Rejected

Team-owned directories and naming conventions, which is what the first four years actually had
Runtime classpath scanning to discover resolvers, removed outright

Flips when

You cannot generate and validate the module graph at build time. Without a build-time check the convention is decoration, and Airbnb's own first attempt is the evidence

Decision: how do you replace a platform carrying a million lines of other people's code?

Chosen

New engine underneath immediately, two developer APIs on top of it
Classic and Modern ship side by side; teams take the engine wins first and the ergonomic wins later

Rejected

A step-function migration, which Airbnb says would have made the rebuild "a non-starter"

Flips when

The two APIs cannot sit on one engine. Airbnb reports the opposite effect, that building two runtimes at once forced the engine interface to stay general, so the second API paid for itself as a design constraint

Decision	Chosen	Rejected	Because	Evidence
Unit of ownership	Tenant module inside a shared runtime	One service per team	Service definitions and RPC boundaries were replaced by "modules plus re-entrancy"	Retrospective, 2025
Resolver discovery	Build-time generated config	Runtime classpath scanning	Scanning bootstrappers "have been removed"; startup validation replaces them	AGENTS.md, 2026
Engine interface	Dynamically typed values	One statically typed model end to end	Lets engine and developer API evolve independently; the old boundary "hardly existed"	Retrospective, 2025
Authorisation	Per-field checkers inside the engine, with their own data needs	Checking after the resolver returns	Mutations must not run before the check; queries can overlap the two	Design doc, 2026
Blast radius	Dispatcher plus shuffle sharding across deployment shards	One fleet for one program	Concentrating 130 teams in one binary concentrates failure unless the deployment is partitioned	Retrospective, 2025
Durable execution	A library embedded in the calling service, on its existing database	A dedicated workflow cluster	Skipper removes "the need for dedicated workflow orchestration clusters"; Dynein, the cluster, was archived in 2021	Skipper, 2026
Infrastructure	Fork an upstream project and track it	Build and publish your own	The mesh is a fork of Istio and log search is a fork of Slack's Astra; SmartStack, the in-house predecessor, last shipped in 2018	kaldb fork

Figure 4 · Where a new piece of logic should go

The question that decides a service boundary is not team ownership, which the module already carries, but whether the code needs a runtime of its own. Derived from the decisions above; the terminal costs are quoted from the remote-resolver document.

Diagram source

What broke in production

Airbnb publishes no incident postmortems. This section says what the public record does contain, which is two vulnerabilities, one self-reported architectural failure, and a pattern of software that stopped working on without anyone saying so.

The gap is the finding

Searching the GitHub Advisory Database for Airbnb's npm packages returns exactly one advisory, and it is against a community package with a similar name rather than Airbnb's own. Searching for lottie in the npm ecosystem returns none, for a renderer embedded in a large share of the industry's mobile applications. Read that two ways at once: the published surface has a genuinely clean record, and the public record cannot tell you anything about how Airbnb's production systems fail, because none of that is published. If you are evaluating this architecture, the operational claims in section 5 are the company's own and nobody has checked them.

Postmortem

The internal tool with the external threat model

AssumptionA knowledge-sharing tool used by employees does not need the escaping discipline of a public application.

What happenedComments on posts in Airbnb's Knowledge Repo were not neutralised, so any commenter could inject script or HTML into every later reader's page.

Blast radiusCVE-2018-12104, CVSS 6.1, all versions before 0.9.0. Filed against the NVD in June 2018 and only added to the GitHub advisory database in May 2022, nearly four years later.

FixEscaping in the comment path, shipped in 0.9.0.

Design ruleAny internal tool that stores text written by one user and renders it to another has the threat model of a public forum. The word "internal" is a statement about the network, not about the content.

SourceGHSA-xmw7-848p-p95w

Postmortem

The style guide as an attack surface

AssumptionA linting configuration is inert, so the package that carries it does not need supply-chain scrutiny.

What happenedVersion 2.0.0 of eslint-config-airbnb-standard, a community package trading on Airbnb's name, shipped a bundled copy of a compromised eslint-scope that read the developer's .npmrc and sent it to a remote server.

Blast radiusCVSS 9.8. Every install leaked npm publish tokens; the advice was to revoke all npm tokens, not merely upgrade.

Fix2.1.0 without the bundled dependency, and token revocation by every consumer.

Design ruleA popular name is an attack surface you do not control. The blast radius of a lint config is your CI credentials, because that is where it runs and what is in scope there.

SourceGHSA-m852-866j-69j8

Self-reported

The aggregation layer became what it replaced

AssumptionOnce the code is in one program, modularity follows from owning directories and agreeing on conventions.

What happenedAirbnb's account: "all we had was a vague set of conventions for organizing code into team-owned directories. There was no formal concept of a module", with schema and code in separate trees connected by unenforced naming. Capabilities accreted, producing "multiple ways to accomplish similar tasks" and "a lack of architectural integrity".

Blast radiusNo outage, which is why it ran for four years. The symptom was that the platform team could no longer change the platform "without disrupting our customer base", with more than 130 teams and a million lines on top of it.

FixA ground-up rebuild starting in early 2024: a formal tenant module, a strong engine API boundary, build-time module config, two developer APIs side by side, and on the current roadmap a @visibility directive and build-time schema validation.

Design ruleA boundary that is not mechanically checked is not a boundary. Moving code into one process removes the network's enforcement and gives you nothing in return unless you replace it with a build-time check on the same day.

SourceAirbnb, 2025-09-15 and project history

Artefact

The silent stop

AssumptionA dependency that is not archived and carries no deprecation notice is maintained.

What happenedEnzyme's last release was 3.11.0 on 20 December 2019; the repository has 19.8k stars and 251 open issues, is not archived, is not deprecated on npm, and documents adapters up to React 16. Synapse's README still opens "Synapse is Airbnb's new system for service discovery" eight years after its last gem. StreamAlert describes itself in the present tense with 2.9k stars and no notice.

Blast radiusEvery consumer who read the repository rather than the registry. Where notices did arrive they arrived late: Hypernova stopped publishing in January 2019 and was archived in October 2023, a gap of four years and nine months.

FixNone was published. The one package that was formally deprecated on npm is Hypernova; the one that was renamed is airbnb-prop-types, handed to prop-types-tools in June 2020.

Design ruleAudit dependencies against the registry timestamp, never the repository. Last publish date and the version range of the framework it supports are the two signals that do not lie; stars, open issues and an unarchived repository are not evidence of anything.

Sourcenpm, synapse, archive listing

One more failure class is visible without being written down. Viaduct ships roughly weekly, and two numbers in the sequence never reached Maven Central: 0.15.0 and 0.21.0 are missing from the published artefacts, and the repository's release-notes posts skip the same two. Neither account says why. The inference, which is mine and not reported, is that a release was cut and withheld twice in nine months, which is a healthy rate for a weekly train rather than an alarming one. It is included here because it is the only visible trace of something going wrong in the platform's own delivery, and because counting gaps in a public release sequence is a cheap diagnostic you can run on any vendor you are evaluating.

Figure 5 · The states a published artefact actually passes through

Only two of these transitions are announced, and the one that matters to a consumer is the unannounced one. Measured from Airbnb's npm, RubyGems and Maven Central histories.

Diagram source

Numbers you can plan against

Everything quantitative in this guide, with where it came from and when. Registry timestamps are facts; the operational figures are Airbnb reporting on itself.

Metric	Value	At	Context	As of	Source
Traffic growth through the aggregation layer	8×	Airbnb	Reported, over five years; no absolute QPS published	2025-09	Retrospective
Teams hosting code in one runtime	130+	Airbnb	Doubled since 2020; hundreds of weekly active developers	2025-09	Retrospective
Application code hosted	1.5M lines	Airbnb	Tripled since 2020, plus about the same again in test code	2025-09	Retrospective
Share of requests that are internal	>75%	Airbnb	Service-to-service, not client-facing	2025-09	Retrospective
Incident-minutes	halved	Airbnb	Claimed alongside constant operational overhead and cost linear in QPS; no baseline given	2025-09	Retrospective
Public release train, first to 1.0	251 days	Viaduct	0.1.0 on 2025-09-04, 1.0.0 on 2026-05-13, roughly weekly minors between	2026-05	Maven Central
Newest platform artefact	8 days old	Skipper	First publish 2026-09-08, 0.9.0 on 2026-09-16, eight releases in nine days	2026-09	Maven Central
Android library release rate	28 → 1 per year	Epoxy	104 versions since 2016; peak 28 in 2017, one per year in 2024, 2025 and 2026	2026-01	Maven Central
Service discovery, last release	2018-11-01	Synapse	24 gem versions from 2012-11-09; 115,628 downloads	2026-09	RubyGems
Service registration, last release	2017-09-04	Nerve	11 versions; 59,678 downloads; stopped 14 months before its routing counterpart	2026-09	RubyGems
Gap between last release and archive notice	4 yr 9 mo	Hypernova	Derived: last npm publish 2019-01-02, repository archived October 2023	2026-09	npm
Test library still downloaded, last shipped	2019-12-20	Enzyme	19.8k stars, 251 open issues, not archived, not deprecated, React 16 adapters	2026-09	npm
Style-guide enforcement, last shipped	2021-12-25	eslint-config-airbnb	The prose repository was updated in April 2026; the package was not	2026-09	npm
Previous ML platform build image, last push	2024-04-04	Bighead	302,937 pulls; its successor's Python client shipped through 2026-08-12	2026-09	Docker Hub
Feature platform public lifespan	103 releases	Chronon	2022-06-07 to 2026-08-12 on PyPI; README lists Stripe, OpenAI, Netflix, Uber and Monzo as users	2026-08	PyPI

Read these carefully

The first five rows are Airbnb reporting on Airbnb, with no absolute baseline: "8×" and "halved" are ratios against unpublished starting points, and nobody outside the company has verified them. Every other row is a timestamp from a package registry, which is as close to a fact as this corpus gets, but a registry records publication and not use. Two quantities that matter here are unknown and nobody has published them: what the runtime costs per request compared with the services it absorbed, and what the p99 latency of a re-entrant resolver chain looks like under load.

The evidence wall

Every source behind this page, graded. The egress policy for this session blocked medium.com, which hosts the Airbnb Tech Blog, and also blocked arxiv.org, usenix.org and sec.gov, so there are no papers and no talks here and the blog tier is limited to posts Airbnb keeps inside its own repository. Where a blog would normally corroborate a date, a registry timestamp does instead.

Eng blog Airbnb2025-09

Viaduct, Five Years On: Modernizing the Data-Oriented Service Mesh

The single densest source in this corpus. Gives the scale figures, the three anchoring principles, the account of how the first version decayed, the engine and tenant API split, the two-API migration strategy and the shuffle-sharded dispatcher.

Carry forwardHosting logic in the aggregator is a stated break with GraphQL orthodoxy, made deliberately and defended with operational numbers.

raw.githubusercontent.com/airbnb/viaduct … 2025-09-15-viaduct-five-years-on

Decision record Airbnb2025-09

About Viaduct: why it was started and why it was rebuilt

Four sentences of project history that name both decisions: started in 2020 against "an ever-growing dependency graph of microservices", rebuilt from the beginning of 2024 because the result had "weak abstraction boundaries".

Carry forwardThe written reason for a rebuild is usually more useful than the architecture that came out of it.

raw.githubusercontent.com/airbnb/viaduct/main/docs/docs/about/index.md

Decision record Airbnb2026

Remote Resolver Architecture

Design document for the experimental path that puts a resolver in another process: bootstrap, gRPC dispatch, wire formats, the callback channel for re-entrancy, and an explicit list of what the two processes cannot share.

Carry forwardThe clearest itemised bill for a process boundary in this corpus, written by a team that removed most of theirs.

raw.githubusercontent.com … remoteresolvers/impldocs/architecture.md

Decision record Airbnb2026

Access Checks in the Viaduct engine

How authorisation became an engine concern: a checker factory per field coordinate at bootstrap, checker data requirements embedded in the cached query plan, and two memo slots per field so checker prerequisites can bypass checking.

Carry forwardIf you centralise logic, centralise the authorisation model with it, or every tenant reinvents it.

raw.githubusercontent.com/airbnb/viaduct/main/impldocs/modern-access-check.md

Decision record Airbnb2026

Viaduct roadmap

What the platform team is building next, which is almost entirely boundary enforcement: build-time schema validation, a @visibility directive, and factory types designed so teams can share functions "without breaking our principle of interacting only through the graph".

Carry forwardA roadmap full of enforcement mechanisms is a platform that has already been burned by conventions.

raw.githubusercontent.com/airbnb/viaduct/main/docs/docs/roadmap/index.md

Source Airbnb2026

AGENTS.md, the repository's own architecture map

States that a builder embeds the runtime in their own server, and records that runtime scanning for resolvers was removed in favour of build-time generated module config. Also indexes the entire impldocs set.

Carry forwardContributor-facing orientation files are often the best architecture documentation a project has.

raw.githubusercontent.com/airbnb/viaduct/main/AGENTS.md

Source Airbnb2026-09

airbnb/viaduct

1,617 commits, 173 stars, Apache-2.0. The README warns that the engine is production proven while the developer API is still changing, which is an unusually honest maturity statement for an open-sourced internal platform.

Carry forwardCheck whether the stable half of a platform is the half you would depend on.

github.com/airbnb/viaduct

Source Airbnb2026-09

Closed and unmerged pull requests on airbnb/viaduct

The eighteen most recent closed-unmerged pull requests are build, CI and release plumbing from a single contributor, none with a stated reason for closing. One is titled "fix(ci): run Copybara on Java 25", naming the tool that mirrors an internal monorepo outward.

Carry forwardIf a company's platform is mirrored from an internal repository, the public pull-request queue is not where your patch lands. Ask before you plan around it.

github.com/airbnb/viaduct/pulls (closed, unmerged)

Source Airbnb2026-04

Open issues on airbnb/viaduct

Three open issues, all feature work, and the oldest is the revealing one: adding static-analysis rules "to enforce Viaduct's tenant/framework error attribution protocol".

Carry forwardWatch for the moment a platform starts enforcing its conventions with a linter. That is the admission that documentation was not working.

github.com/airbnb/viaduct/issues

Source Airbnb2025-09 → 2026-05

com.airbnb.viaduct on Maven Central

Dated proof of the release train: 0.1.0 on 4 September 2025, 1.0.0 on 13 May 2026, roughly weekly minor versions in between. Two numbers, 0.15.0 and 0.21.0, never appeared.

Carry forwardA registry listing dates a vendor's claims to the day, and gaps in a release sequence are a free reliability signal.

repo1.maven.org/maven2/com/airbnb/viaduct/runtime/

Source Airbnb2026-09

airbnb/skipper and com.airbnb.skipper on Maven Central

Durable workflow execution as an embedded JVM library that persists to a database the service already has, explicitly removing "the need for dedicated workflow orchestration clusters". First artefact 8 September 2026, eight releases in nine days.

Carry forwardThe 2026 answer to durable execution is a library in your process, not another cluster to operate.

repo1.maven.org/maven2/com/airbnb/skipper/skipper-core/

Source Airbnbarchived 2021-12-16

airbnb/dynein

"Airbnb's Open-source Distributed Delayed Job Queueing System", 391 stars, archived on 16 December 2021. The cluster-shaped predecessor of Skipper, retired four and a half years before the library-shaped successor appeared.

Carry forwardWhen a capability comes back in a different shape, the shape change is the decision; the gap is how long the company ran without it.

github.com/airbnb/dynein

Source Airbnb2012 → 2018

synapse and nerve on RubyGems

SmartStack's two halves, dated exactly: nerve's last gem on 4 September 2017, synapse's on 1 November 2018. Registration stopped fourteen months before routing did, which is the order you would expect if the replacement took over registration first.

Carry forwardIn a two-part system the halves die in an order, and the order tells you how the migration ran.

rubygems.org/api/v1/versions/synapse.json

Source Airbnb2026-09

airbnb/synapse, unarchived and unlabelled

2.1k stars, no archive notice, and a README that still opens "Synapse is Airbnb's new system for service discovery" eight years after the last release.

Carry forwardA README is a snapshot of the day it was written. Never treat one as a statement about the present.

github.com/airbnb/synapse

Source Airbnb / Istio2026-01

airbnb/istio

A fork of istio/istio with 25,771 commits on master, whose recent history is upstream synchronisation rather than Airbnb-specific change. The mesh that replaced SmartStack is somebody else's project, tracked rather than authored.

Carry forwardAn organisation's forks tell you what it decided to stop writing. That is usually a better list than the one it publishes.

github.com/airbnb/istio

Source Airbnb / Slack2026-09

airbnb/kaldb, forked from slackhq/astra

Log, trace and audit search, carrying a licence notice that reads "Copyright (c) 2024 Slack". Airbnb once published its own tools in this space, including Airpal, which was archived in 2021 with 2.7k stars.

Carry forwardBuying the substrate and building the programming model is a coherent strategy, and the fork list is where you can see a company adopt it.

github.com/airbnb/kaldb

Source Airbnb2022 → 2026

airbnb/chronon and chronon-ai on PyPI

The feature platform for machine learning, 103 PyPI releases between 7 June 2022 and 12 August 2026, with a README that lists Stripe, OpenAI, Netflix, Uber and Monzo as production users. Its predecessor's build image on Docker Hub stopped moving in April 2024.

Carry forwardAirbnb publishes the software that shapes how its own application code is written, and forks the software that merely runs it.

pypi.org/pypi/chronon-ai/json

Source Airbnb2016 → 2026

com.airbnb.android:epoxy on Maven Central

104 published versions, 28 of them in 2017 and one each in 2024, 2025 and 2026. The cleanest measured example in this corpus of a platform library's life curve.

Carry forwardPlot releases per year before adopting a library. The shape of the curve predicts the next three years better than the star count.

repo1.maven.org/maven2/com/airbnb/android/epoxy/

Source Airbnb2019 → 2022

The web platform, dated from npm

Enzyme last published 20 December 2019, react-dates 29 January 2020, airbnb-prop-types renamed away in June 2020, eslint-config-airbnb 25 December 2021, ts-migrate 8 November 2022. Over the same period the Android libraries kept shipping into 2026.

Carry forwardA company stops publishing in one area while continuing in another; read the freeze as a statement about that area, not about the company.

registry.npmjs.org/enzyme

Source Airbnb2018-11-27

The vacated airflow name on PyPI

A single release whose summary reads "Placeholder for the old Airflow package", pointing at apache/incubator-airflow. Airbnb gave away the name as well as the code.

Carry forwardA donation is complete when the namespace moves. Until then the original owner still controls what installs.

pypi.org/pypi/airflow/json

Postmortem GitHub Advisory DB2022-05

GHSA-xmw7-848p-p95w, Airbnb Knowledge Repo XSS in comments

CVE-2018-12104, CVSS 6.1, fixed in 0.9.0. Filed with the NVD in June 2018 and only added to the GitHub advisory database in May 2022, which is itself a lesson about dependency scanning coverage.

Carry forwardAn advisory's appearance in your scanner's database can lag the CVE by years. Absence from a scan is weak evidence.

github.com/advisories/GHSA-xmw7-848p-p95w

Postmortem GitHub Advisory DB2020-09

GHSA-m852-866j-69j8, malicious package in eslint-config-airbnb-standard

CVSS 9.8. A lookalike of an Airbnb package bundled a compromised eslint-scope that exfiltrated the developer's .npmrc. The remediation was token revocation, not an upgrade.

Carry forwardPin and verify lint and build configuration with the same discipline as runtime dependencies; they execute where your credentials are.

github.com/advisories/GHSA-m852-866j-69j8

Postmortem GitHub Advisory DB2026-09

The advisory database, searched for Airbnb's own packages

One npm advisory matches, and it is the lookalike above. A search for lottie in the npm ecosystem returns zero, for a renderer shipped inside a very large number of production applications. This is the whole published failure record for a decade of Airbnb code.

Carry forwardWhere the incident record is empty, your first production rollout is the experiment that produces the missing evidence. Plan the instrumentation accordingly.

github.com/advisories?query=ecosystem:npm airbnb

Source Airbnb2026

Viaduct CONTRIBUTING.md and OWNERS, and the Gradle Plugin Portal listing

Governance stays with Airbnb: four named approvers, the internal airbnb/ductworks team as watchers, and security reports routed to Airbnb's bug bounty programme. The build plugin is published under "Viaduct Maintainers at Airbnb" at version 2.0.0.

Carry forwardRead OWNERS and SECURITY before adopting an open-sourced internal platform. They tell you whose roadmap you are joining.

plugins.gradle.org … com.airbnb.viaduct.application-gradle-plugin

Source Airbnb2018 → 2024

The archived repository listing

Twenty-four archived repositories, and the notices cluster years after the code stopped: Hypernova and its four bindings in October 2023, superset-fork in September 2023, airpal in 2021, smartstack-cookbook in 2020, infinity in 2018 with "DEPRECATED" typed into the description rather than the archive flag.

Carry forwardArchive dates record when somebody did housekeeping, not when the software stopped working. Use the registry for the real date.

github.com/orgs/airbnb/repositories?q=archived:true

Source Airbnb2026-08

airbnb/agent-harness-optimizer

"A benchmark-agnostic framework for automatically optimizing LLM agent harnesses", Apache-2.0, one commit on main. The 2026 cohort of published Airbnb work is agent tooling, and the Viaduct roadmap carries a matching item for generating applications from its own example code and markdown.

Carry forwardThe categories a company publishes in shift years before its architecture posts do. Watch the repository list, not the blog.

github.com/airbnb/agent-harness-optimizer

Source Airbnb2023 → 2024

lottie-ios release notes

Where no postmortem exists, release notes still record shipped defects: "Fix parsing regression in 4.3.0 from addition of parsing layer effects" and "Fix crash in Main Thread rendering engine path interpolation implementation".

Carry forwardFor a library you embed, the patch-release notes are the closest thing to an incident history you will get.

github.com/airbnb/lottie-ios/releases

Source Airbnb2026-09

The com.airbnb group on Maven Central

The whole public JVM surface of a company with tens of thousands of employees is seven artefact families: android, deeplinkdispatch, okreplay, rxgroups, walkman, viaduct and skipper. Two of those seven are newer than September 2025.

Carry forwardA group listing on a registry is the cheapest inventory of what an organisation currently asks the outside world to depend on.

repo1.maven.org/maven2/com/airbnb/

Build a miniature, then productionise it

Six rungs. The line between a toy and something production-shaped is rung four, where you stop trusting convention and start failing the build.

Two modules, one schema

Stand up a single GraphQL server with two schema files owned by two notional teams, one defining a type and one extending it with a computed field. Resolve the extension using only data declared as a required selection, with no import between the two.

Done when: deleting the owning team's resolver breaks the extension at runtime but not at compile time. Teaches: a declarative data dependency is a real boundary, and it fails differently from a call.

Make the boundary mechanical

Add a build step that fails if module A's source imports a symbol from module B. A dependency rule in your build tool, a linter rule, or an architecture test.

Done when: a deliberate cross-module import fails CI with a message naming both modules. Teaches: the thing Airbnb spent four years learning, which is that a convention without a check is a wish.

Generate the wiring at build time

Replace any runtime scanning with a generated manifest of modules and resolvers, written into your artefact and validated at startup against the schema.

Done when: a resolver whose schema field was deleted fails at build, and startup time does not grow with module count. Teaches: why Airbnb removed classpath scanning outright rather than optimising it.

Put authorisation in the engine

Add a per-field check that declares its own data needs, runs in parallel with the resolver for reads, and runs strictly before it for writes. Memoise the result separately from the field value.

Done when: a check that needs a sibling field does not recurse into its own check, and a failing check on a mutation means the mutation never ran. Teaches: centralised logic needs a centralised authorisation model on day one.

Partition the deployment, not the code

Run the same binary as several shards and route operations to them, then take one shard down under load and measure what fraction of operations were affected.

Done when: you can state the measured blast radius of one shard as a percentage of operations, not of hosts. Teaches: the answer to concentrating teams in one process is partitioning the fleet, which is the step most in-process re-aggregations skip.

Run the boundary audit on your own estate

For every third-party dependency in one service, record last publish date from the registry, newest framework version supported, and whether the repository says anything about it. Sort by the gap.

Done when: you can name the three dependencies that have silently stopped, and none of them was flagged by an archive notice. Teaches: the registry is the source of truth about maintenance, and your scanner probably is not looking at it.

Keep hunting

The queries and endpoints that produced this page. The method outlives the page: it works on any company that publishes packages, and it does not depend on the company's blog being reachable.

Date a company's decisions from its registries

https://repo1.maven.org/maven2/com/<org>/
https://registry.npmjs.org/<package>
https://pypi.org/pypi/<package>/json
https://rubygems.org/api/v1/versions/<gem>.json
https://hub.docker.com/v2/repositories/<org>/

Find what stopped, and what was never announced

https://github.com/orgs/<org>/repositories?q=archived:true&sort=updated
org:<org> "no longer maintained" OR "deprecated" in:readme
org:<org> fork:only sort:updated
https://github.com/advisories?query=ecosystem:npm+<org>

Read the design argument inside the repository

path:impldocs OR path:docs/adr OR path:**/DESIGN.md org:<org>
filename:AGENTS.md OR filename:CLAUDE.md org:<org>
repo:<org>/<repo> is:pr is:closed is:unmerged
repo:<org>/<repo> "experimental" path:impldocs

Find the decisions behind a re-aggregation

"hosted business logic" GraphQL "microservices" "we moved"
"macroservice" OR "modular monolith" postmortem "we merged"
"tenant module" OR "module boundary" enforce build-time lint
"shuffle sharding" deployment shards blast radius

The lesson to carry into your own design

Airbnb's decade says something narrower and more useful than "microservices were a mistake". It says that the service boundary was doing two jobs at once, isolating runtimes and enforcing modularity, and that only the first job needed a network. When you take a boundary away, name which of the two jobs you were relying on, and replace the enforcement on the same day you remove the process. Airbnb did not, ran on conventions for four years, and paid for a ground-up rebuild of the very layer that was supposed to fix the sprawl.

References

Miskiewicz, Chen and Stata, Viaduct, Five Years On: Modernizing the Data-Oriented Service Mesh Airbnb, in the airbnb/viaduct repository, 15 September 2025. Checked 2026-09-23.
About Viaduct Airbnb, project documentation, September 2025. Checked 2026-09-23.
Remote Resolver Architecture Airbnb, implementation document, 2026. Checked 2026-09-23.
Access Checks Airbnb, implementation document, 2026. Checked 2026-09-23.
Viaduct Roadmap Airbnb, 2026. Checked 2026-09-23.
AGENTS.md, Viaduct repository root Airbnb, 2026. Checked 2026-09-23.
airbnb/viaduct README Airbnb, 2026. Checked 2026-09-23.
Viaduct CONTRIBUTING.md Airbnb, 2026. Checked 2026-09-23.
airbnb/viaduct GitHub. Checked 2026-09-23.
airbnb/viaduct, closed and unmerged pull requests GitHub. Checked 2026-09-23.
airbnb/viaduct, open issues GitHub. Checked 2026-09-23.
com.airbnb.viaduct:runtime Maven Central. Checked 2026-09-23.
com.airbnb.viaduct:bom Maven Central. Checked 2026-09-23.
com.airbnb.skipper:skipper-core Maven Central. Checked 2026-09-23.
com.airbnb.android:epoxy Maven Central. Checked 2026-09-23.
com.airbnb.android:mavericks Maven Central. Checked 2026-09-23.
com.airbnb.android:airmapview Maven Central. Checked 2026-09-23.
com.airbnb group listing Maven Central. Checked 2026-09-23.
airbnb/skipper GitHub, 2026. Checked 2026-09-23.
airbnb/dynein GitHub, archived 16 December 2021. Checked 2026-09-23.
airbnb/synapse GitHub. Checked 2026-09-23.
synapse gem versions RubyGems. Checked 2026-09-23.
nerve gem versions RubyGems. Checked 2026-09-23.
airbnb/istio GitHub. Checked 2026-09-23.
airbnb/kaldb, forked from slackhq/astra GitHub. Checked 2026-09-23.
airbnb/chronon GitHub. Checked 2026-09-23.
chronon-ai release history PyPI. Checked 2026-09-23.
knowledge-repo release history PyPI. Checked 2026-09-23.
airflow, the vacated package name PyPI, 27 November 2018. Checked 2026-09-23.
enzyme package metadata npm. Checked 2026-09-23.
hypernova package metadata npm. Checked 2026-09-23.
eslint-config-airbnb package metadata npm. Checked 2026-09-23.
react-dates package metadata npm. Checked 2026-09-23.
airbnb-prop-types package metadata npm. Checked 2026-09-23.
airbnb/enzyme GitHub. Checked 2026-09-23.
airbnb/streamalert GitHub. Checked 2026-09-23.
Archived repositories in the airbnb organisation GitHub. Checked 2026-09-23.
GHSA-xmw7-848p-p95w, Airbnb Knowledge Repo XSS in comments GitHub Advisory Database, published 14 May 2022 (CVE-2018-12104, NVD 17 June 2018). Checked 2026-09-23.
GHSA-m852-866j-69j8, malicious package in eslint-config-airbnb-standard GitHub Advisory Database, 1 September 2020. Checked 2026-09-23.
GitHub Advisory Database, npm ecosystem, "airbnb" GitHub. Checked 2026-09-23.
Docker Hub, airbnb organisation images Docker Hub. Checked 2026-09-23.
com.airbnb.viaduct.application-gradle-plugin Gradle Plugin Portal. Checked 2026-09-23.
airbnb/agent-harness-optimizer GitHub, August 2026. Checked 2026-09-23.
airbnb/lottie-ios releases GitHub. Checked 2026-09-23.