Maintenance mode: a decade of Netflix retiring code that runs in other people's processes

The territory

You published part of your platform. Other teams compiled it into their applications. Now you want to stop maintaining it, and you control neither their deploys, their configuration, nor the version they are running.

That is the problem this guide is about, and Netflix has the longest public record of living inside it. From roughly 2012 the company shipped its mid-tier platform as JVM libraries: a service-discovery client, a client-side load balancer, a circuit breaker, a dynamic-configuration layer, a metrics library, a dependency-injection toolkit. The choice was deliberate and, for a while, industry-defining: Spring Cloud repackaged four of those libraries and handed them to everybody building microservices on the JVM.

Then Netflix began switching them off. Hystrix went to maintenance mode with a final release cut on 2018-11-16. Ribbon's README was rewritten into a module-by-module confession of what Netflix actually still ran. Servo was marked deprecated and its default registry turned into a no-op. Conductor was archived on 2023-12-13 with the maintenance explicitly discontinued. Lemur, the certificate authority front end, went read-only in July 2026 with the instruction to fork it.

The finding that reorganised this guide: survival does not track age, popularity or even how much Netflix uses the thing. It tracks what kind of component it is. Every library that made a decision the application had to configure is frozen. Every library that only carries data across a boundary is still shipping. The oldest artefact in the set, the Eureka client first published to Maven Central on 2012-09-04, released version 1.10.19 on 2026-08-24, years after the 2.0 rewrite meant to replace it was discontinued in public.

2018-11-16

Last Hystrix release, and the day the circuit breaker in thousands of applications stopped getting fixes

Maven Central listing, checked 2026-09-16

Open pull requests on Hystrix today, against 24.5k stars and no maintainer

Repository page, 2026-09-16

2026-08-24

eureka-client 1.10.19, the fourteen-year-old library that outlived its own rewrite

Maven Central listing, 2026-09-16

2021-11-17

The day Spring Cloud shipped its final Hystrix, Ribbon and Zuul starters, three years downstream of Netflix's decision

Maven Central listing, 2026-09-16

Figure 1 · What survived, sorted by what the component does

Notice that the split is not chronological. Components that decided something the application had to tune are frozen; components that carry data across a boundary, and components that run as a service someone else operates, are still releasing in 2026. Dates from the Maven Central listings for hystrix-core, ribbon-core, servo-core, spectator-api, eureka-client and zuul-core, all checked 2026-09-16.

Diagram source

Scope

This guide covers how a platform organisation withdraws code that runs inside other people's applications, using Netflix between 2015 and 2026 as the worked example, and it covers the downstream consequences in the Spring Cloud, Steeltoe and Conductor ecosystems. It does not cover Netflix's streaming architecture, its data platform, its content delivery network, or the internal systems that replaced these libraries, because Netflix has not published those and this session's network policy reached only code hosts and package registries. Every motive quoted here is Netflix describing itself in its own repository.

How it is actually built

The 2015 shape put six cross-cutting concerns inside every application process. The 2026 shape keeps two of them there and moves the rest behind boundaries the platform team can change alone.

Read the Ribbon README and you can see the old architecture from the inside, because Netflix published which of its own modules were real. All nine modules are annotated. Three are marked deployed at scale in production, four are marked not used, and one carries the sentence that explains the whole decade: "we use everything not under com.netflix.http4.ssl. Instead, we use an internal solution developed by our cloud security team". The published library and the running library had already diverged, and the README is the moment somebody wrote that down.

Even for the components deployed in production we have wrapped them in a Netflix internal http client and we are not adding new functionality since they've been stable for a while. Any new functionality has been added to internal wrappers on top of Ribbon. Ribbon README, project status section

That is the mechanism by which a shared library dies, and it is not a decision anybody makes on a Tuesday. A team needs request tracing, so they add it to the wrapper rather than the library, because the wrapper does not need a release, a version bump across hundreds of applications, or a discussion with external contributors. Two years of that and the public artefact is a shell around which the real system has grown. Netflix's stated replacement makes the same point from the other side: the RPC solution is built "on top of gRPC", with load-balancing and discovery moved into interceptors, and the reasons given are "multi-language support and better extensibility/composability through request interceptors". An interceptor chain owned by the platform team is a place to put policy that does not require every application to agree.

Figure 2 · Where the cross-cutting concerns moved

The 2015 application linked six Netflix libraries and configured all of them. In the shape Netflix describes in 2026, discovery and metrics remain in-process because they carry data, while retry, timeout, load balancing and shedding move into an interceptor chain and a gateway. Reconstructed from the Ribbon and Hystrix status blocks and the concurrency-limits README; the interceptor tier is Netflix's own description of unpublished code.

Diagram source

Three kinds of component, and only one of them dies

Sorting the twelve components in the ledger by outcome produces a clean split, and it is worth naming because the sources never do. I am calling them deciders, carriers and services.

Deciders

They hold policy the application must tune: a circuit-breaker threshold, a load-balancing rule, an injector lifecycle. Every one of them in this corpus is frozen. The tell is that the correct setting depends on the caller's traffic, so the library cannot ship a default that is right, and the platform team cannot change the setting without a redeploy of somebody else's code.

Frozen: Hystrix, Ribbon, Governator

Carriers

They move data across a boundary and make no decisions: a registry client, a metrics recorder, a dynamic property. All three are still publishing in 2026. Archaius is the interesting case, because its whole purpose is to take configuration out of the binary, which is exactly the property that lets a platform team change behaviour without a release.

Alive: eureka-client, spectator-api, archaius2-core

Services

Somebody operates them, so a change reaches production without anyone else recompiling. Zuul shipped zuul-core 4.1.7 on 2026-09-10, six days before this page was written. Netflix's newer open-source output is almost entirely of this kind: Maestro describes itself as a workflow-as-a-service scheduling "hundreds of thousands of workflows, millions of jobs every day".

Alive: zuul-core, Maestro, Metaflow

The classification is mine, and it is a reconstruction rather than a reported fact: no Netflix document groups its libraries this way. What the documents do report is the reason each individual component was retired, and those reasons line up with the split. Hystrix was retired because pre-configured settings stop being right, which is the decider problem stated exactly. Ribbon was retired because the interesting functionality had migrated into wrappers, which is the decider problem observed from the maintenance side. Servo was retired because a better instrumentation API existed, and its replacement, a carrier, is still going.

The replacement that never shipped

The Ribbon README, written when the decision was made, ends with an intention: "The interceptors are Netflix-internal at the moment. When we reach that level of confidence we hope to open-source this new approach." Searching the Netflix organisation for repositories matching gRPC on 2026-09-16 returns one result, the archived Conductor repository. The interceptors were never published. Whether that is a decision or an omission is not something the public record settles, but the effect on a reader is concrete: the generation of Netflix's RPC stack that replaced Ribbon is the first generation nobody outside Netflix can read. The libraries got published while they were the industry's problem too; the replacement stayed in because it encodes how Netflix specifically runs.

The same shape appears in the successor Netflix did point people at. concurrency-limits implements the adaptive approach the Hystrix README recommends, borrowing Vegas and a gradient algorithm from TCP congestion control, and its README states the case against fixed thresholds plainly: in an autoscaling system a tested requests-per-second limit "quickly goes out of date and the service falls over by becoming non-responsive as it is unable to gracefully shed excess load". It is a good argument. The artefact carrying it published 0.5.2 in September 2024, 0.5.3 in November 2024 and 0.5.4 in December 2025, and has never reached 1.0. A reader deciding what to adopt should weigh that cadence against the argument.

The decisions that matter

Five distinct retirement mechanics appear in this corpus, each used at least once, each with a condition that makes it the right one. None of the sources name them; the names are mine.

Decision: how do you stop maintaining a library thousands of teams compile in?

Chosen: freeze and align

Hystrix, 2018. Cut a final release that matches the version running internally, then stop.
Netflix states the reason for the version choice: 1.5.18 exists "so that the latest version in Maven Central is aligned with the last known stable version used internally at Netflix (1.5.11)".
The declaration is explicit about what stops: no issue review, no merged pull requests, no releases.

Rejected

Handing the project to the community. The README offers it, with an email address, and nobody took it in eight years.
Continuing to ship fixes for external users, which would have meant maintaining a code path Netflix had stopped evolving.

Flips when

The library holds a security-relevant surface. Freezing then leaves consumers with no patch channel, which is the Lemur outcome below.
A credible successor exists in another organisation. Hystrix could point at resilience4j; that is what made the freeze defensible.

Decision: what do you tell people about the modules you no longer use?

Chosen: per-module truth

Ribbon, in an undated status block. Publish a table of every module with its real internal status, from "deployed at scale in production" to "not used".
It tells an adopter exactly which parts have production pressure behind them.

Rejected

A single project-level status, which would have been either a lie about the three live modules or a needless scare about them.
Splitting the repository so the dead modules could be archived separately, which would have broken every coordinate downstream.

Flips when

The modules share a release train and a version number, as Ribbon's do. Then a per-module status is the only honest signal available, because the version number says everything is equally alive.

Decision: remove the library, or make it harmless?

Chosen: neutralise in place

Servo, version 0.13.0. The library keeps working and keeps being published, but "the default monitor registry is a no-op implementation to minimize the overhead for legacy apps that still happen to have some usage of Servo".
The old behaviour is still reachable through a system property, so a team that needs it can turn it back on without a code change.

Rejected

Deleting the artefact, which breaks builds for transitive consumers who never chose the dependency.
Leaving it fully active, which taxes every application that still links it through a dependency it forgot about.

Flips when

The library's work is observable and someone might be relying on it. A no-op metrics registry loses metrics silently, which is acceptable for a deprecated path and not acceptable for, say, an authorisation check.

Decision: who owns the name after you leave?

Chosen: hand over the coordinates

Conductor, archived 2023-12-13, with the README pointing at community forks in general rather than naming a successor.
The fork took new Maven coordinates, org.conductoross:conductor-core, and has shipped continuously since; the release visible on 2026-09-15 is 3.33.0-rc4 against Netflix's final 3.15.0.

Rejected

Transferring the repository itself, which would have moved Netflix's name and history to a third party.
Continuing to publish under com.netflix.conductor, which would have implied a maintenance relationship that had ended.

Flips when

The project has a live user base that will fork anyway. Then the choice is not whether a fork exists but whether the handover is legible, and a named successor beats "the community has been active in promoting alternative forks".

Decision: when do you tell people the end date?

Chosen: a dated support window, in advance

The DGS framework publishes a compatibility table in its README: version 11 and above actively maintained, 10.x with "most features will be backported until the second half of 2026", 5.x "no longer maintained".
This is the current Netflix practice and it is the opposite of the 2018 one: the window is stated while the version is alive rather than announced when it dies.

Rejected

Status by README edit, which is what Hystrix, Ribbon and Servo got. A consumer only learns the news if they revisit the page.
Machine-readable lifecycle alone. Netflix's own OSSMETADATA file still says osslifecycle=active inside the Conductor repository that was archived in 2023.

Flips when

You cannot predict the window. A dated promise you break is worse than no promise, so use it where support tracks something you control, such as a framework's major version.

Mechanic	Used on	What the consumer gets	What it costs you	Evidence
Freeze and align	Hystrix, 2018	A final version that matches what the author runs	A permanent backlog of pull requests you will not merge	Hystrix README
Per-module truth	Ribbon, undated notice	Knowledge of which parts have production pressure	Publishing that most of your library is unused	Ribbon README
Neutralise in place	Servo, 0.13.0, 2020-04-29	Builds keep working, overhead goes to zero	Silent loss of the behaviour, and an artefact you still publish	Servo README
Hand over the coordinates	Conductor, 2023-12-13	A live release train under a new group id	The fork inherits the vulnerabilities and the trust	Archive banner and notice
Dated support window	DGS framework, current	Time to plan a migration before support ends	A commitment you have to keep	DGS README
Retirement by drift	Dynomite, branch policy	Nothing; the reader has to infer it	Users discover the state by reading a paragraph about branches	Dynomite README

Figure 3 · Choosing a retirement mechanic

The tree is derived from the five mechanics above and their stated reasons, not from any published Netflix decision process. The question that does most of the work is the first one, because a security surface removes the freeze option entirely.

Diagram source

What broke in production

Four failure classes show up once a library outlives its maintainer. Three of the five records below are security advisories rather than outage postmortems, which is a limit of what this corpus could reach and also a fact about the domain: the failures of abandoned code surface as vulnerabilities, not as pages.

Class 1 · The protocol outlives the implementation

When a client library is the only specification of a wire format, retiring the library freezes the specification in a form nobody wrote down. Fourteen years after the Eureka client first shipped, a reimplementation of it in another language hit exactly that.

Advisory

A registry entry that says "Netflix" empties a .NET service's view of the world

AssumptionThat the Eureka registry's DataCenterInfo.name field takes one of two values, MyOwn or Amazon, which is what the Steeltoe client accepted.

What happenedThe Java implementation also emits Netflix. Deserialising it threw, the exception "propagates through the entire registry deserialization chain and is swallowed by the periodic cache refresh task", and the client kept running with an empty or stale registry.

Blast radiusAny Steeltoe Eureka client in a registry containing one such registration: discovery disabled until the offending registration is removed. Rated High, CVSS 7.5. Versions up to 3.3.0 and 4.0.0 through 4.1.0, patched in 3.4.0 and 4.2.0, published 2026-05-29.

FixAccept unrecognised values rather than throwing, and stop letting a per-record parse failure abort the whole refresh.

Design ruleThe day you stop maintaining a client library, its wire format becomes your public contract whether you document it or not. Write the format down, including the values your own implementation emits but never explains, and make every consumer's parser fail per record rather than per fetch.

SourceGHSA-j8ph-6fxj-g533, CVE-2026-50196, published 2026-05-29

Repository

The abandoned rewrite, and the coordinates reused a decade later

AssumptionThat Eureka 1 would be replaced by Eureka 2, which is why teams treated the 1.x line as the outgoing generation.

What happenedNetflix wrote: "The existing open source work on eureka 2.0 is discontinued. The code base and artifacts that were released as part of the existing repository of work on the 2.x branch is considered use at your own risk." No artefact from that effort reached Maven Central: the 2.0 coordinates first appear there on 2022-12-14.

Blast radiusEvery team that deferred work on a discovery client waiting for a 2.0 that never arrived. The 1.x line shipped 1.10.19 on 2026-08-24.

FixThe coordinates 2.0.x were reused in 2023 for something else entirely: a Jakarta namespace port of the 1.x code, visible in the 2.x branch build file as jakarta.ws.rs and a Jersey 3 exclusion. First publication 2.0.1 on 2023-06-21.

Design ruleA version number is a promise about compatibility, not a slot to reuse. If a major version is abandoned in public, retire the number with it, because six years later nobody will remember that 2.0 means two different things.

SourceEureka wiki, Maven listing, 2.x build file

Figure 5 · How one registration disables a client's whole view

The failure is not the parse error, it is the two design choices around it: the loop parses the whole payload as a unit, and the scheduled refresh swallows what the parse throws, so the client keeps serving from an empty registry with no error anywhere. Sequence reconstructed from the advisory text in GHSA-j8ph-6fxj-g533.

Diagram source

Class 2 · The fix nobody can merge

Maintenance mode transfers the runtime risk to the consumer, and the consumer cannot discharge it upstream. The clearest artefact of that transfer is a pull request that fixes a real incompatibility and sits for years.

Pull request

A Java 11 incompatibility in Hystrix, open for three years and nine months

AssumptionThat a frozen library stays correct as long as nobody changes it.

What happenedThe platform moved instead. "Java 11 ThreadPoolExecutor.setCorePoolSize() throws an IllegalArgumentException if the new coreSize is larger than the current maximumPoolSize", which Hystrix's dynamic thread-pool resizing hits. The fix was offered on 2022-11-12 and closed unmerged on 2026-08-11 when the contributor's fork disappeared, with no maintainer comment on the thread.

Blast radiusUnquantified in public. The repository shows 24.5k stars, 4.7k forks and 52 open pull requests, which are weak proxies for the population still running it. 87 pull requests are closed unmerged.

FixNone upstream. Consumers patch a fork, pin to an older JDK behaviour, or migrate.

Design ruleFreezing a library freezes it against a runtime that keeps moving. Budget for the fact that your consumers will need a build of it after you stop, and leave them a supported way to produce one, such as a maintained branch or a documented fork policy.

SourceNetflix/Hystrix pull request 2033, closed-unmerged list

Advisory

The security burden moves with the fork

AssumptionThat archiving a repository ends the maintainer's exposure, and that the users go somewhere safe.

What happenedConductor was archived on 2023-12-13. The community fork continued under org.conductoross, and in 2025 it carried a critical remote code execution: "Orkes Conductor v3.21.11 allows remote attackers to execute arbitrary OS commands through unrestricted access to Java classes", CVSS 9.8.

Blast radiusAll fork users below 3.21.13, patched in 3.21.13, published 2025-06-30. The fork is now 18 minor versions past Netflix's final 3.15.0 of 2023-11-26.

FixThe fork shipped the patch. The class of defect, unrestricted access to Java classes from workflow definitions, is inherited design surface rather than something the fork introduced.

Design ruleWhen you hand a project over, hand over the threat model too. A fork inherits your design decisions and your users' trust, and the first people to find that out are usually attackers.

SourceGHSA-8gqp-hr9g-pg62, CVE-2025-26074, fork release listing

Class 3 · The archived security service

The worst version of this problem is a service that issues credentials. Lemur, Netflix's certificate-authority front end, went read-only in July 2026 after a run of authorisation findings.

Advisory

A certificate authority front end, twenty advisories, then "please fork"

AssumptionThat publishing an internal security tool is a contribution with no ongoing obligation.

What happenedIn June 2026 a chained finding was published against Lemur: "any SSO-authenticated user achieves AWS IAM compromise and permanent PKI key access via ACME acme_url SSRF and creator-equality IDOR", patched in 1.9.2. A further advisory, patched in 1.9.3, was published on 2026-07-06, the date the README gives for the archive. Twenty advisories are recorded against the package.

Blast radiusEvery operator running it. The repository banner reads "This repository was archived by the owner on Jul 7, 2026", and the README tells users "If you need to continue making changes, please fork this repository."

FixFor Netflix, exit. For operators, fork and maintain, or migrate to a managed certificate authority.

Design ruleDo not open-source a component on the credential path unless you are willing to run a patch channel for it indefinitely, or to name the organisation that will. "Fork it" is not a security response.

SourceGHSA-v2wp-frmc-5q3v, GHSA-pxmc-2ffp-8j67, repository banner

Advisory

The control case: a maintained service ships the patch

AssumptionThat the advisory record simply reflects how risky a component is.

What happenedGenie, still maintained, had a critical path traversal through multipart uploads: "attackers with low privileges to manipulate user-supplied filenames", CVSS 9.9, affecting com.netflix.genie:genie-web below 4.3.18.

Blast radiusDeployments storing attachments on local disk, patched in 4.3.18, published 2024-05-09.

FixA patched release, which is the entire difference between this card and the one beside it.

Design ruleJudge a dependency by whether a patch can reach you, not by its vulnerability count. A maintained component with more findings is safer than a frozen one with fewer.

SourceGHSA-wpcv-5jgp-69f3, CVE-2024-4701

Class 4 · The cost lands three years downstream

Netflix's 2018 decision was not felt by Netflix. It was felt by the ecosystem that had repackaged the libraries, and the dates show how long the wave took to arrive.

Figure 4 · One decision, propagating through a dependent ecosystem

Three years separate Netflix's final Hystrix release from Spring Cloud's final Hystrix starter, and the ecosystem then had to write and maintain replacements. Dates from the Maven Central listings for hystrix-core, spring-cloud-starter-netflix-hystrix and spring-cloud-starter-circuitbreaker-resilience4j.

Diagram source

Release record

Spring Cloud Netflix went from six features to two

AssumptionThat adopting a vendor's client libraries through a framework insulates you from the vendor's roadmap.

What happenedAt tag v2.2.10.RELEASE the README advertises Eureka client and server, Hystrix clients and dashboard, Ribbon load balancing, an Archaius bridge and Zuul filters. The current README lists two bullets, both Eureka.

Blast radiusThe Hystrix, Ribbon and Zuul starters all stop at 2.2.10.RELEASE, published 2021-11-17. Every application using them faced a migration it did not initiate.

FixSpring wrote replacements it now maintains: spring-cloud-starter-loadbalancer and spring-cloud-starter-circuitbreaker-resilience4j, both at 5.0.3 on 2026-08-20.

Design ruleWhen you depend on a repackaged library, your real dependency is the repackager's willingness to keep absorbing the original author's decisions. Ask how many upstreams that team currently carries, and what happened the last time one stopped.

SourceREADME at v2.2.10.RELEASE, current README

Metadata

The status field that was wrong about the one project that mattered

AssumptionThat machine-readable lifecycle metadata tells a consumer whether a project is alive.

What happenedNetflix repositories carry an OSSMETADATA file. Hystrix reads osslifecycle=maintenance and Eureka reads osslifecycle=active, both correct. Conductor, archived since 2023-12-13, still reads osslifecycle=active.

Blast radiusAny dependency scanner trusting that field on a repository that has been read-only for nearly three years.

FixNone visible; the file is frozen with the rest of the archive, which is the point.

Design ruleMetadata inside a repository cannot describe the repository's own end, because the end stops the commits. Derive liveness from publication timestamps and archive state, which are outside the artefact's control.

SourceConductor OSSMETADATA, Hystrix OSSMETADATA

Numbers you can plan against

Publication timestamps are the only hard measurements available here, and they are unusually good ones: a registry entry cannot be edited after the fact, and it records the day an organisation last thought a piece of code was worth shipping.

Measure	Value	Component	Context	As of	Source
Last publication	2018-11-16	hystrix-core 1.5.18	Final release, cut to match the internal 1.5.11	2026-09-16	Maven Central
Last publication	2021-08-05	ribbon-core 2.4.8	A patch on an older line, sixteen months after 2.7.18	2026-09-16	Maven Central
Last publication	2021-03-03	servo-core 0.13.2	Deprecated, default registry a no-op since 0.13.0 on 2020-04-29	2026-09-16	Maven Central
Last publication	2023-03-20	governator 1.17.13	Third release in five years	2026-09-16	Maven Central
Still publishing	2026-08-24	eureka-client 1.10.19	192 versions since 1.1.7 on 2012-09-04	2026-09-16	Maven Central
Still publishing	2026-09-09	spectator-api 1.10.7	The carrier that replaced Servo	2026-09-16	Maven Central
Still publishing	2026-09-10	zuul-core 4.1.7	Three releases in the six weeks before this page	2026-09-16	Maven Central
Still publishing	2026-06-02	archaius2-core 2.8.8	While archaius-core 1.x, described as unmaintained, last shipped 0.7.12 on 2024-03-28	2026-09-16	Maven Central
Successor cadence	3 releases	concurrency-limits-core	0.5.2 on 2024-09-03, 0.5.3 on 2024-11-20, 0.5.4 on 2025-12-08; never reached 1.0	2026-09-16	Maven Central
Handover gap	18 minor versions	Conductor	Netflix ends at 3.15.0 on 2023-11-26; the fork ships 3.33.0-rc4 on 2026-09-15	2026-09-16	Maven Central
Downstream lag	3 years 1 month	Spring Cloud Hystrix starter	From Netflix's final release on 2018-11-16 to the starter's final 2.2.10.RELEASE on 2021-11-17	2026-09-16	Maven Central
Downstream survival	2026-06-11	spring-cloud-starter-netflix-eureka-client	Versions 4.3.3 and 5.0.2 on the same day; the only Netflix component the ecosystem kept	2026-09-16	Maven Central
Unmergeable backlog	52 open, 87 closed unmerged	Hystrix pull requests	Against 24.5k stars and 4.7k forks	2026-09-16	Repository
Time a real fix stayed open	1,368 days	Hystrix pull request 2033	Opened 2022-11-12, closed unmerged 2026-08-11; derived from the two dates	2026-09-16	Pull request
Advisories against an archived project	20	lemur	Archived read-only 2026-07-07; last patch 1.9.3 published 2026-07-06	2026-09-16	Advisory database
Release cadence of the modern artefact	80 in 2025	metaflow	267 releases since 2.0.0 on 2019-12-03, latest 2.19.39 on 2026-09-02	2026-09-16	PyPI

Read these carefully

Measured: every date above is a registry or repository timestamp read on 2026-09-16. Derived: the 1,368 days, the three years one month, and the eighteen minor versions are arithmetic on those dates, shown so you can check them. Weak proxies: stars, forks and pull-request counts stand in for how many teams still run this code, because dependent counts and download statistics live on hosts this run could not reach. Treat them as evidence that the population is large, not as a measurement of it. Unknown: how many services inside Netflix still link Hystrix, what the migration to interceptors cost, and what the adaptive limiter does to tail latency in production. Netflix has published none of that in a place reachable from here.

What an architect should take from the table is the gap between the two halves. The components that stopped did not stop because they were old: eureka-client is older than every one of them and shipped three weeks before this page. They stopped when the thing they decided moved somewhere else. If you are holding a library and want to know how long you have, the question is not how many stars it has; it is whether the author still lets it make the decision, or has quietly moved that decision into a wrapper, a sidecar or an interceptor.

The evidence wall

Every source behind this page, graded. Filter by kind. The full ledger, with one row per claim and the quote that supports it, ships beside this file as sources.md.

What is not here

There are no engineering-blog, paper or talk sources in this corpus. This session's egress policy reached code hosts and package registries only, so the Netflix technology blog, conference video, arxiv.org, usenix.org and the archive were all unreachable. Everything below is either a primary artefact from the repository that owns the code or a record in the GitHub Advisory Database. The consequence to keep in mind: every statement of motive is the deciding team describing its own decision, with no outside account to check it against.

Decision record Netflix2018-11

Hystrix README, "Hystrix Status"

The decision, the reason and the successor in four paragraphs: maintenance mode, a final release aligned to the internally running version, and a recommendation to use another organisation's library for new work. It also says Netflix will keep using Hystrix for existing applications, which is the asymmetry the rest of this page is about.

Carry forwardSay which version matches what you run. It is the single most useful sentence a retirement notice can contain.

raw.githubusercontent.com/Netflix/Hystrix/master/README.md

Decision record Netflixundated

Ribbon README, project status

A module-by-module statement of what Netflix actually runs, with four modules marked not used and one marked partially replaced by an internal security-team implementation. It names the replacement direction, gRPC with discovery and load-balancing interceptors, and states the two reasons: multi-language support and composability.

Carry forwardPer-module status is the only honest signal when modules share a version number.

raw.githubusercontent.com/Netflix/ribbon/master/README.md

Decision record Netflixcurrent

Eureka wiki: the 2.0 work is discontinued

Two sentences retire a major version in public and keep the one it was meant to replace: the 2.0 code base and its artefacts are "use at your own risk", while 1.x "is a core part of Netflix's service discovery system and is still an active project".

Carry forwardAbandoning a rewrite in public is cheaper than letting consumers plan around it for another two years.

github.com/Netflix/eureka/wiki

Decision record Netflix2020-04

Servo README: deprecated, and defaulted to a no-op

Minimal maintenance "to keep software that relies on it working", plus the mechanism that makes that cheap: since 0.13.0 the default monitor registry does nothing, and the old behaviour is recoverable through a system property.

Carry forwardNeutralise in place rather than deleting, when the behaviour is observable only to you.

raw.githubusercontent.com/Netflix/servo/master/README.md

Decision record Netflix2023-12-13

Conductor: archive banner and discontinuation notice

Maintenance discontinued to realign resources with Netflix's internal fork, the repository read-only, and a gesture at community forks without naming one. The Maven coordinates moved to the fork's group id, which is where the release train continued.

Carry forwardIf a fork is going to inherit your users, name it. Ambiguity at handover is paid for by everyone downstream.

github.com/Netflix/conductor

Decision record Netflixcurrent

DGS framework: a version compatibility table

The current practice, and a visible change from 2018: support state published per major version while each is alive, including a dated backport window for the previous one.

Carry forwardPublish the end date while the version is healthy; a notice written on the last day is not a migration plan.

raw.githubusercontent.com/Netflix/dgs-framework/master/README.md

Decision record Netflixcurrent

Simian Army README: retired, with each capability rehomed

A retirement that splits rather than freezes: Chaos Monkey became a standalone service, the Janitor Monkey role went to Swabbie, and Conformity was folded into Spinnaker backend services. Each capability is named a destination.

Carry forwardA toolkit can be retired capability by capability; say where each one went, not just that the toolkit is over.

raw.githubusercontent.com/Netflix/SimianArmy/master/README.md

Decision record Netflixcurrent

concurrency-limits README: the case against fixed thresholds

The argument the Hystrix notice points at, written out: a tested requests-per-second limit goes out of date in an autoscaling fleet, so the limit should be inferred from latency the way TCP infers a congestion window, using Vegas or a gradient algorithm.

Carry forwardA threshold a human sets is a threshold that is wrong after the next capacity change. Measure the limit instead.

raw.githubusercontent.com/Netflix/concurrency-limits/master/README.md

Advisory Steeltoe2026-05-29

GHSA-j8ph-6fxj-g533: an unrecognised DataCenterInfo name empties the registry

A .NET reimplementation of the Eureka client throws on a value the Java implementation emits, the exception is swallowed by the periodic refresh, and the client runs on with an empty or stale registry. High, CVSS 7.5, patched in 3.4.0 and 4.2.0.

Carry forwardRegistry parsing must fail per record. One bad entry should never cost you the whole view.

github.com/advisories/GHSA-j8ph-6fxj-g533

Advisory Orkes, Conductor fork2025-06-30

GHSA-8gqp-hr9g-pg62: remote command execution in the forked Conductor

Unrestricted access to Java classes from workflow definitions, CVSS 9.8, in the fork that took over eighteen months after Netflix archived the original. Patched in 3.21.13.

Carry forwardHanding over a project hands over its threat model. Write the model down before you archive.

github.com/advisories/GHSA-8gqp-hr9g-pg62

Advisory Netflix2026-06

GHSA-v2wp-frmc-5q3v: chained authorisation flaws in Lemur

SSRF in ACME authority creation reaching instance metadata, combined with a creator-equality identity check on private key retrieval, giving an authenticated user cloud credentials and lasting key access. Patched in 1.9.2, a month before the repository was archived.

Carry forwardAnything on the credential path needs a patch channel with an owner, or it should not be published.

github.com/advisories/GHSA-v2wp-frmc-5q3v

Advisory Netflix2024-05-09

GHSA-wpcv-5jgp-69f3: path traversal in Genie, patched

The control case. A critical finding, CVSS 9.9, in a component Netflix still maintains, fixed in 4.3.18. The difference between this record and the Lemur ones is not severity, it is whether a patch could reach the operator.

Carry forwardRank dependency risk by patch reachability before vulnerability count.

github.com/advisories/GHSA-wpcv-5jgp-69f3

Source Netflix2022 to 2026

Hystrix pull request 2033, closed unmerged

A fix for a Java 11 ThreadPoolExecutor constraint that Hystrix's dynamic pool resizing violates. Opened 2022-11-12, closed 2026-08-11 when the contributor's fork was deleted, with no maintainer comment in between.

Carry forwardFrozen code still rots, because the runtime under it keeps moving.

github.com/Netflix/Hystrix/pull/2033

Source Netflix2026-09-16

Hystrix closed-unmerged pull requests

87 closed without merge, 52 still open, on a repository with 24.5k stars. Contributions were still arriving in 2026, eight years after the maintenance notice.

Carry forwardA maintenance notice does not stop contributions; it converts them into unanswered work.

github.com/Netflix/Hystrix/pulls

Source Maven Central2012 to 2026

eureka-client publication history

192 versions. First 1.1.7 on 2012-09-04, most recent 1.10.19 on 2026-08-24. The 2.0 coordinates first appear on 2022-12-14, a decade after the rewrite that was supposed to carry them was abandoned.

Carry forwardRegistry timestamps are the cheapest liveness signal there is, and the hardest to fake.

repo1.maven.org/maven2/com/netflix/eureka/eureka-client/

Source Netflixcurrent

eureka-client build file on the 2.x branch

Jakarta namespace dependencies and a Jersey 3 exclusion, which is what the current 2.0.x line actually is: a namespace port of the 1.x code rather than the discontinued rewrite.

Carry forwardCheck what a major version number means before planning a migration around it.

raw.githubusercontent.com/Netflix/eureka/2.x/eureka-client/build.gradle

Source Spring Cloud2021-11

spring-cloud-netflix README at tag v2.2.10.RELEASE

The peak of the downstream footprint: Eureka client and server, Hystrix clients and dashboard, Ribbon load balancing, an Archaius bridge, Zuul filters.

Carry forwardReading an old tag's README is the cheapest way to date a dependency's decline.

raw.githubusercontent.com/spring-cloud/spring-cloud-netflix/v2.2.10.RELEASE/README.adoc

Source Spring Cloud2026-09-16

spring-cloud-netflix README today

Two feature bullets, both Eureka. Everything else that carried the Netflix name in this project has been replaced by Spring's own components.

Carry forwardThe repackager's feature list is a record of which of your libraries survived contact with a second maintainer.

raw.githubusercontent.com/spring-cloud/spring-cloud-netflix/master/README.adoc

Source Maven Central2021-11-17

Spring Cloud Netflix starters, final releases

The Hystrix, Ribbon and Zuul starters all end at 2.2.10.RELEASE on the same day, three years after Netflix's own final Hystrix release.

Carry forwardPlan for roughly three years between an upstream freeze and the moment your framework stops shipping it.

repo1.maven.org/maven2/org/springframework/cloud/spring-cloud-starter-netflix-hystrix/

Source Maven Central2026-08-20

The replacements Spring now maintains

spring-cloud-starter-loadbalancer and spring-cloud-starter-circuitbreaker-resilience4j, both at 5.0.3. The work Netflix stopped doing did not disappear; it moved to another maintainer's backlog.

Carry forwardRetiring a library relocates its maintenance cost rather than removing it. Know who is receiving it.

repo1.maven.org/maven2/org/springframework/cloud/spring-cloud-starter-circuitbreaker-resilience4j/

Source Maven Central2023 to 2026

Conductor coordinates before and after the handover

com.netflix.conductor ends at 3.15.0 on 2023-11-26; org.conductoross ships 3.33.0-rc4 on 2026-09-15. The group id is where the handover is legible.

Carry forwardTrack a handed-over project by its coordinates, not its repository. The repository stops; the artefacts continue somewhere else.

repo1.maven.org/maven2/org/conductoross/conductor-core/

Source Netflixcurrent

OSSMETADATA lifecycle files

Machine-readable per-repository status. Hystrix reads maintenance, Eureka reads active, and Conductor, read-only since 2023, still reads active.

Carry forwardLiveness metadata inside an artefact cannot record the artefact's own end.

raw.githubusercontent.com/Netflix/conductor/master/OSSMETADATA

Source Netflix2026-09-16

Netflix organisation search for gRPC repositories

One result, the archived Conductor repository. The discovery and load-balancing interceptors the Ribbon README hoped to open-source are not public.

Carry forwardAn intention to open-source a replacement is not a migration path. Plan against what exists.

github.com/orgs/Netflix/repositories?q=grpc

Source Netflix2026-07

Lemur repository, archived read-only

"This repository was archived by the owner on Jul 7, 2026", with a README instruction to fork if changes are needed. Twenty advisories are recorded against the package.

Carry forward"Fork it" is an acceptable ending for a developer tool and not for a certificate authority front end.

github.com/Netflix/lemur

Source Netflixcurrent

Archaius README and the two lines on Maven Central

Development moved to 2.x and the 1.x branch is called an unmaintained snapshot, yet archaius-core 0.7.12 was published on 2024-03-28 while archaius2-core reached 2.8.8 on 2026-06-02.

Carry forward"Unmaintained" in a README and "last published" in a registry are different facts. Check both.

raw.githubusercontent.com/Netflix/archaius/master/README.md

Source Netflixcurrent

Titus control plane, archived

"This repo has been archived and is no longer in active development", on the public control plane of the container platform. The service kept running inside Netflix; the public copy did not.

Carry forwardA published control plane is a snapshot of an internal one. Assume divergence from day one.

raw.githubusercontent.com/Netflix/titus-control-plane/master/README.md

Source Netflixcurrent

Dynomite README, retirement by drift

No status block, just a branch policy: "Over time master branch has fallen behind and is not maintained. We will eventually delete it and may or may not create it."

Carry forwardIf your status has to be inferred from a paragraph about branches, you have not published a status.

raw.githubusercontent.com/Netflix/dynomite/master/README.md

Case study Netflixcurrent

Maestro README: the later output is a service

A workflow orchestrator described as workflow-as-a-service for Netflix's data platform users, scheduling "hundreds of thousands of workflows, millions of jobs every day". The artefact Netflix publishes now is a system someone operates, not a jar an application links.

Carry forwardPublishing a service invites people to run it; publishing a library invites them to depend on you.

raw.githubusercontent.com/Netflix/maestro/master/README.md

Source PyPI2019 to 2026

Metaflow release history

267 releases since 2.0.0 on 2019-12-03, including 80 in 2025 alone, latest 2.19.39 on 2026-09-02. Compare the three concurrency-limits releases in the same period.

Carry forwardCadence tells you whether a project is a product or an artefact somebody once published.

pypi.org/pypi/metaflow/json

Build a miniature, then productionise it

This one is an audit rather than a prototype. The subject is your own organisation's shared libraries, and the rungs move from a census to a rehearsal of the day you want to stop maintaining one.

Census by publication date

List every artefact your team publishes to an internal or public registry, with the timestamp of its most recent version, taken from the registry rather than from anyone's memory. A directory listing on Maven Central or PyPI takes a single request per artefact.

Done when: you can name the three artefacts you publish that have not shipped in a year. Teaches: that liveness is a measurement, and that somebody is depending on at least one of those three.

Classify each one: decider, carrier or service

For each artefact, answer one question: does a consumer have to configure it correctly for their own traffic? If yes it is a decider, and it is on the path Hystrix and Ribbon took. If it only moves data across a boundary, it is a carrier. If someone operates it, it is a service.

Done when: every artefact has a label and you have found at least one decider you cannot change without other teams redeploying. Teaches: where your future migration cost is concentrated.

Write the wire contract for one carrier

Pick your most widely used client library and document the format it puts on the wire, including the values your own implementation emits and nobody documented. The Steeltoe advisory exists because that document did not.

Done when: a competent engineer could write a second client from your document alone. Teaches: that the protocol, not the library, is the thing you are actually committed to.

Add an inert mode, and default to it in the next major

Implement Servo's move: a configuration under which the library loads, costs nothing and does nothing, with the previous behaviour recoverable by a property. Ship it while the library is still supported.

Done when: a consumer can keep your jar on the classpath with zero runtime effect and no code change. Teaches: how to stop paying for a dependency you cannot remove from other people's builds.

Run a fork drill

Take the role of a consumer on the day you freeze. Clone, apply a one-line fix, build, publish to a private repository and consume it. Time it. If your build needs internal plugins, credentials or a code generator nobody outside can run, your consumers have no exit.

Done when: an outsider's fork builds and publishes from a clean machine in under an hour. Teaches: whether "maintenance mode" is a handover or an abandonment.

Publish the support window before you need it

Copy the DGS format: a table of major versions with maintained, backported-until and unmaintained states, each with a date. Put it in the README of something that is currently healthy, and make updating it part of the release checklist.

Done when: every supported major version has a published end condition. Teaches: that a retirement is a schedule you commit to, not an announcement you make afterwards.

Rehearse the security question

For each artefact, write down who ships the patch if a critical vulnerability is reported the week after you stop. If the answer is "the community", check the Lemur record and decide whether you believe it. If the artefact touches credentials, the honest options are keeping the patch channel or not publishing at all.

Done when: every artefact names a patch owner, or is reclassified as something you will not publish. Teaches: the difference between open-sourcing a tool and taking on an obligation.

Keep hunting

This page was assembled almost entirely from registries and repository metadata, because they are precise, dated and nobody games them. These are the moves that produced it.

Dating a library's decline

https://repo1.maven.org/maven2/com/<org>/<artifact>/
https://pypi.org/pypi/<package>/json then sort releases by upload_time
raw.githubusercontent.com/<org>/<repo>/<old tag>/README.md
raw.githubusercontent.com/<org>/<repo>/master/OSSMETADATA

Finding the argument and the aftermath

github.com/<org>/<repo>/pulls?q=is:pr+is:closed+is:unmerged
github.com/advisories?query=<package or org>
github.com/orgs/<org>/repositories?q=<successor technology>
"maintenance mode" OR "no longer in active development" README <org>

Two of these are worth keeping permanently. Comparing a README at an old tag with the same file on the default branch dates a project's contraction to the month, and the advisory database answers the question a dependency scanner cannot: not whether a component has findings, but whether anyone is still shipping fixes for them.

References

Netflix, Hystrix README and status block GitHub. Status block dated to the final release of 2018-11. Checked 2026-09-16.
Netflix, Hystrix pull request 2033 GitHub. Opened 2022-11-12, closed unmerged 2026-08-11. Checked 2026-09-16.
Netflix, Hystrix closed-unmerged pull requests GitHub. Checked 2026-09-16.
Netflix, Hystrix OSSMETADATA GitHub. Checked 2026-09-16.
Netflix, Ribbon README, project status GitHub. Undated status block. Checked 2026-09-16.
Netflix, Eureka wiki GitHub. Checked 2026-09-16.
Netflix, eureka-client build file, 2.x branch GitHub. Checked 2026-09-16.
Netflix, Servo README GitHub. Checked 2026-09-16.
Netflix, Archaius README GitHub. Checked 2026-09-16.
Netflix, concurrency-limits README GitHub. Checked 2026-09-16.
Netflix, Conductor repository and archive notice GitHub. Archived 2023-12-13. Checked 2026-09-16.
Netflix, Conductor OSSMETADATA GitHub. Checked 2026-09-16.
Netflix, DGS framework README GitHub. Checked 2026-09-16.
Netflix, Simian Army README GitHub. Checked 2026-09-16.
Netflix, Titus control plane README GitHub. Checked 2026-09-16.
Netflix, Dynomite README GitHub. Checked 2026-09-16.
Netflix, Maestro README GitHub. Checked 2026-09-16.
Netflix, Lemur repository, archived GitHub. Archived 2026-07-07. Checked 2026-09-16.
Netflix organisation repository search for gRPC GitHub. Checked 2026-09-16.
GHSA-j8ph-6fxj-g533, CVE-2026-50196, Steeltoe Eureka discovery GitHub Advisory Database, published 2026-05-29. Checked 2026-09-16.
GHSA-8gqp-hr9g-pg62, CVE-2025-26074, Conductor command injection GitHub Advisory Database, published 2025-06-30. Checked 2026-09-16.
GHSA-v2wp-frmc-5q3v, CVE-2026-55166, Lemur authorisation chain GitHub Advisory Database, published 2026-06. Checked 2026-09-16.
GHSA-pxmc-2ffp-8j67, CVE-2026-71417, Lemur certificate revocation GitHub Advisory Database, published 2026-07-06. Checked 2026-09-16.
GHSA-wpcv-5jgp-69f3, CVE-2024-4701, Genie path traversal GitHub Advisory Database, published 2024-05-09. Checked 2026-09-16.
Spring Cloud Netflix README at v2.2.10.RELEASE GitHub. Checked 2026-09-16.
Spring Cloud Netflix README, current GitHub. Checked 2026-09-16.
Maven Central, com.netflix.hystrix:hystrix-core Sonatype. Checked 2026-09-16.
Maven Central, com.netflix.ribbon:ribbon-core Sonatype. Checked 2026-09-16.
Maven Central, com.netflix.eureka:eureka-client Sonatype. Checked 2026-09-16.
Maven Central, com.netflix.servo:servo-core Sonatype. Checked 2026-09-16.
Maven Central, com.netflix.spectator:spectator-api Sonatype. Checked 2026-09-16.
Maven Central, com.netflix.archaius:archaius2-core Sonatype. Checked 2026-09-16.
Maven Central, com.netflix.governator:governator Sonatype. Checked 2026-09-16.
Maven Central, com.netflix.zuul:zuul-core Sonatype. Checked 2026-09-16.
Maven Central, com.netflix.concurrency-limits:concurrency-limits-core Sonatype. Checked 2026-09-16.
Maven Central, org.conductoross:conductor-core Sonatype. Checked 2026-09-16.
Maven Central, spring-cloud-starter-netflix-hystrix Sonatype. Checked 2026-09-16.
Maven Central, spring-cloud-starter-netflix-eureka-client Sonatype. Checked 2026-09-16.
Maven Central, spring-cloud-starter-circuitbreaker-resilience4j Sonatype. Checked 2026-09-16.
PyPI, metaflow release metadata Python Software Foundation. Checked 2026-09-16.
Netflix, Hystrix repository GitHub. Star, fork and pull-request counts read 2026-09-16.