Evidence ledger
29 sources
Checked 16 Sep 2026
Evidence ledger
One row per claim in Maintenance mode: a decade of Netflix retiring code that runs in other people's processes: who published it, what grade it carries, when it was written, when the link was last checked, and the quote or figure it rests on. Nothing in the guide is cited from memory, so anything not in this table is not in the guide.
Field guide: Maintenance mode: a decade of Netflix retiring code that runs in other people's processes Research date: 2026-09-16. All links fetched on 2026-09-16.
Method note: this session's network egress policy reached code hosts and package registries only
(github.com, raw.githubusercontent.com, repo1.maven.org, pypi.org). The Netflix technology blog,
conference video hosts, arxiv.org, usenix.org, web.archive.org and every third-party engineering
blog were blocked by the proxy. There is therefore no blog, paper or talk tier in this corpus, and
no independent commentary on any of it. What is left is the material nobody wrote for an audience:
README status blocks, archive banners, machine-readable lifecycle files, publication timestamps on
Maven Central and PyPI, pull requests nobody merged, and security advisories. The four sources
graded postmortem are GitHub security advisories, which give cause, affected versions and patch
state rather than duration or user impact; where that limit matters, the page says so.
Every claim about what Netflix runs internally is Netflix's own statement about itself, taken from its repositories. No external corroboration was reachable in this run.
| # | Org | Title | Tier | Published | Checked | URL | Claim taken from it | Supporting quote or figure |
|---|---|---|---|---|---|---|---|---|
| 1 | Netflix | Hystrix README, "Hystrix Status" | adr | status block added 2018-11 | 2026-09-16 | https://raw.githubusercontent.com/Netflix/Hystrix/master/README.md | The retirement decision and its stated reason | "Hystrix is no longer in active development, and is currently in maintenance mode." … "our focus has shifted towards more adaptive implementations that react to an application's real time performance rather than pre-configured settings" |
| 2 | Netflix | Hystrix README | adr | as above | 2026-09-16 | https://raw.githubusercontent.com/Netflix/Hystrix/master/README.md | The successor was another organisation's project, and the final release was cut to match the internal version | "leverage open and active projects like resilience4j for new internal projects" … "We have made a final release of Hystrix (1.5.18) per issue 1891 so that the latest version in Maven Central is aligned with the last known stable version used internally at Netflix (1.5.11)." |
| 3 | Netflix | Hystrix README | adr | as above | 2026-09-16 | https://raw.githubusercontent.com/Netflix/Hystrix/master/README.md | Netflix keeps running it internally while telling everyone else to leave | "we intend to continue using Hystrix for existing applications" … "Netflix will no longer actively review issues, merge pull-requests, and release new versions of Hystrix." |
| 4 | Maven Central | com.netflix.hystrix:hystrix-core directory listing | source | continuous since 2012 | 2026-09-16 | https://repo1.maven.org/maven2/com/netflix/hystrix/hystrix-core/ | The library stopped publishing on a specific date | 1.5.18/ 2018-11-16 22:54; previous line 1.5.12/ 2017-05-16; maven-metadata.xml 2018-11-16 22:55 |
| 5 | Netflix | Hystrix pull request 2033, "Fix Exception in HystrixThreadPoolDefault.touchConfig() on Java 11" | source | opened 2022-11-12, closed 2026-08-11 | 2026-09-16 | https://github.com/Netflix/Hystrix/pull/2033 | A real runtime incompatibility sat unmerged for three years and nine months, then closed because the contributor's fork disappeared | "Java 11 ThreadPoolExecutor.setCorePoolSize() throws an IllegalArgumentException if the new coreSize is larger than the current maximumPoolSize." Closed with head repository deleted; no maintainer comment on the thread |
| 6 | Netflix | Hystrix repository page | source | current | 2026-09-16 | https://github.com/Netflix/Hystrix | The size of the population still carrying the library, and the backlog nobody can clear | 24.5k stars, 4.7k forks, 52 open pull requests, 6 open issues, 2,121 commits |
| 7 | Netflix | Hystrix closed-unmerged pull request list | source | current | 2026-09-16 | https://github.com/Netflix/Hystrix/pulls?q=is%3Apr+is%3Aclosed+is%3Aunmerged | Contributions kept arriving for eight years after maintenance mode | "87 total closed, unmerged pull requests"; most recent entries dated 2026 |
| 8 | Netflix | Hystrix OSSMETADATA | source | current | 2026-09-16 | https://raw.githubusercontent.com/Netflix/Hystrix/master/OSSMETADATA | Netflix publishes machine-readable lifecycle state per repository | osslifecycle=maintenance |
| 9 | Netflix | Ribbon README, "Project Status: On Maintenance" | adr | status block current | 2026-09-16 | https://raw.githubusercontent.com/Netflix/ribbon/master/README.md | Per-module honesty about what is actually used inside Netflix | "ribbon-core: deployed at scale in production"; "ribbon-transport: not used"; "ribbon: not used"; "some of which were replaced by non-OSS solutions over time" |
| 10 | Netflix | Ribbon README | adr | as above | 2026-09-16 | https://raw.githubusercontent.com/Netflix/ribbon/master/README.md | The replacement was gRPC plus interceptors, and the interceptors were never published | "Our team has instead started building an RPC solution on top of gRPC." … "The interceptors are Netflix-internal at the moment. When we reach that level of confidence we hope to open-source this new approach." |
| 11 | Netflix | Ribbon README | adr | as above | 2026-09-16 | https://raw.githubusercontent.com/Netflix/ribbon/master/README.md | Even the surviving modules are wrapped internally, so the public artefact is not what Netflix runs | "we have wrapped them in a Netflix internal http client and we are not adding new functionality"; "Any new functionality has been added to internal wrappers on top of Ribbon (such as request tracing and metrics)" |
| 12 | Maven Central | com.netflix.ribbon:ribbon-core directory listing | source | continuous since 2013 | 2026-09-16 | https://repo1.maven.org/maven2/com/netflix/ribbon/ribbon-core/ | Publication trailed off rather than stopping cleanly | 2.7.17/ 2019-05-29, 2.7.18/ 2020-03-31, then 2.4.8/ 2021-08-05 on an older line |
| 13 | GitHub org search | Netflix repositories matching "grpc" | source | current | 2026-09-16 | https://github.com/orgs/Netflix/repositories?q=grpc | Ten years on, the promised open-sourcing of the gRPC discovery and load-balancing interceptors has not happened | One result, the archived Conductor repository; no RPC library |
| 14 | Netflix | Eureka wiki home | adr | statement current | 2026-09-16 | https://github.com/Netflix/eureka/wiki | The rewrite was abandoned in public, and the incumbent was kept | "The existing open source work on eureka 2.0 is discontinued. The code base and artifacts that were released as part of the existing repository of work on the 2.x branch is considered use at your own risk." … "Eureka 1.x is a core part of Netflix's service discovery system and is still an active project." |
| 15 | Maven Central | com.netflix.eureka:eureka-client directory listing | source | continuous since 2012 | 2026-09-16 | https://repo1.maven.org/maven2/com/netflix/eureka/eureka-client/ | The library declared legacy in 2015 is still shipping in 2026, and the "2.0" coordinates were reused years later for something else | 1.1.7/ 2012-09-04; 2.0.1/ 2023-06-21; 2.0.6/ 2026-03-27; 1.10.19/ 2026-08-24 |
| 16 | Netflix | eureka-client build.gradle on the 2.x branch | source | current | 2026-09-16 | https://raw.githubusercontent.com/Netflix/eureka/2.x/eureka-client/build.gradle | Today's 2.0 line is the Jakarta namespace port of Eureka 1, not the discontinued rewrite | api 'jakarta.ws.rs:jakarta.ws.rs-api:3.0.0', jakarta.inject, jakarta.annotation, plus // jersey3 exclusion of org.glassfish.jersey |
| 17 | Steeltoe / GitHub Advisory Database | GHSA-j8ph-6fxj-g533 (CVE-2026-50196) | postmortem | 2026-05-29 | 2026-09-16 | https://github.com/advisories/GHSA-j8ph-6fxj-g533 | A reimplementation of the Eureka wire format failed on a value the Java client emits, and failed silently | "DataCenterInfo.FromJson throws ArgumentException for any name value other than MyOwn or Amazon" despite the Java Eureka specification recognising "Netflix"; the exception "propagates through the entire registry deserialization chain and is swallowed by the periodic cache refresh task, leaving the local service registry permanently empty or stale." High, CVSS 7.5, affects Steeltoe.Discovery.Eureka <= 3.3.0 and 4.0.0-4.1.0, patched 3.4.0 and 4.2.0 |
| 18 | Netflix | Servo README | adr | current | 2026-09-16 | https://raw.githubusercontent.com/Netflix/servo/master/README.md | The neutralise-in-place retirement: keep shipping, make the default do nothing | "# DEPRECATED … This project receives minimal maintenance to keep software that relies on it working." … "As of version 0.13.0, the default monitor registry is a no-op implementation to minimize the overhead for legacy apps that still happen to have some usage of Servo." |
| 19 | Maven Central | com.netflix.servo:servo-core and com.netflix.spectator:spectator-api listings | source | continuous | 2026-09-16 | https://repo1.maven.org/maven2/com/netflix/servo/servo-core/ | The replacement instrumentation library is alive while the deprecated one froze in 2021 | servo-core 0.13.2/ 2021-03-03 is the last; spectator-api 1.10.7/ 2026-09-09 |
| 20 | Maven Central | com.netflix.spectator:spectator-api directory listing | source | continuous | 2026-09-16 | https://repo1.maven.org/maven2/com/netflix/spectator/spectator-api/ | An in-process library that only carries data has kept shipping for the whole decade | 1.9.9/ 2026-06-03, 1.10.5/ 2026-07-31, 1.10.6/ 2026-08-19, 1.10.7/ 2026-09-09 |
| 21 | Netflix | Archaius README | source | current | 2026-09-16 | https://raw.githubusercontent.com/Netflix/archaius/master/README.md | The configuration library split into a frozen 1.x and a maintained 2.x | "Development of Archaius now happens in the 2.x branch. The 1.x branch contains an unmaintained snapshot of the last legacy 1.x release." |
| 22 | Maven Central | com.netflix.archaius:archaius-core and archaius2-core listings | source | continuous | 2026-09-16 | https://repo1.maven.org/maven2/com/netflix/archaius/archaius2-core/ | The "unmaintained" 1.x line was still being published in 2024 while 2.x ships in 2026 | archaius-core 0.7.12/ 2024-03-28; archaius2-core 2.8.8/ 2026-06-02 |
| 23 | Maven Central | com.netflix.governator:governator directory listing | source | continuous | 2026-09-16 | https://repo1.maven.org/maven2/com/netflix/governator/governator/ | The dependency-injection library is on a three-releases-in-five-years path | 1.17.11/ 2021-01-06, 1.17.12/ 2021-04-19, 1.17.13/ 2023-03-20 |
| 24 | Netflix | Conductor repository, archive banner and README notice | adr | archived 2023-12-13 | 2026-09-16 | https://github.com/Netflix/conductor | The hand-over retirement, with a stated business reason and no named successor | "This repository was archived by the owner on Dec 13, 2023. It is now read-only." README: "Effective December 13, 2023, Netflix will discontinue maintenance of Conductor OSS on GitHub" … "members of the Conductor community have been active in promoting alternative forks of this project" |
| 25 | Netflix | Conductor OSSMETADATA | source | current | 2026-09-16 | https://raw.githubusercontent.com/Netflix/conductor/master/OSSMETADATA | The machine-readable lifecycle field is wrong for exactly the project that was abandoned | osslifecycle=active on a repository archived on 2023-12-13 |
| 26 | Maven Central | com.netflix.conductor and org.conductoross conductor-core listings | source | continuous | 2026-09-16 | https://repo1.maven.org/maven2/org/conductoross/conductor-core/ | The fork took over the release train and has moved 18 minor versions past Netflix's last | Netflix line ends 3.15.0/ 2023-11-26; fork ships 3.33.0-rc4/ 2026-09-15 |
| 27 | Orkes / GitHub Advisory Database | GHSA-8gqp-hr9g-pg62 (CVE-2025-26074) | postmortem | 2025-06-30 | 2026-09-16 | https://github.com/advisories/GHSA-8gqp-hr9g-pg62 | The security burden moved to the fork's coordinates along with the code | "Conductor vulnerable to OS command injection through unrestricted access to Java classes"; "Orkes Conductor v3.21.11 allows remote attackers to execute arbitrary OS commands"; Critical, CVSS 9.8, maven org.conductoross:conductor-core < 3.21.13, patched 3.21.13 |
| 28 | Spring Cloud | spring-cloud-netflix README at tag v2.2.10.RELEASE | source | tagged 2021-11 | 2026-09-16 | https://raw.githubusercontent.com/spring-cloud/spring-cloud-netflix/v2.2.10.RELEASE/README.adoc | What the downstream ecosystem carried at its peak | Feature list: Eureka client, embedded Eureka server, "Circuit Breaker: Hystrix clients", "embedded Hystrix dashboard", "Client Side Load Balancer: Ribbon", "External Configuration: a bridge from the Spring Environment to Archaius", "Router and Filter: automatic registration of Zuul filters" |
| 29 | Spring Cloud | spring-cloud-netflix README, current main | source | current | 2026-09-16 | https://raw.githubusercontent.com/spring-cloud/spring-cloud-netflix/master/README.adoc | What is left of it | Two feature bullets, both Eureka: "Service Discovery: Eureka instances can be registered…" and "an embedded Eureka server can be created with declarative Java configuration" |
| 30 | Maven Central | spring-cloud-starter-netflix-hystrix, -ribbon, -zuul listings | source | continuous | 2026-09-16 | https://repo1.maven.org/maven2/org/springframework/cloud/spring-cloud-starter-netflix-hystrix/ | Three Netflix components left the Spring ecosystem on the same day | All three end at 2.2.10.RELEASE/ 2021-11-17 |
| 31 | Maven Central | spring-cloud-starter-netflix-eureka-client listing | source | continuous | 2026-09-16 | https://repo1.maven.org/maven2/org/springframework/cloud/spring-cloud-starter-netflix-eureka-client/ | The one Netflix component the ecosystem kept | 4.3.3/ 2026-06-11 and 5.0.2/ 2026-06-11 |
| 32 | Maven Central | spring-cloud-starter-loadbalancer and -circuitbreaker-resilience4j listings | source | continuous | 2026-09-16 | https://repo1.maven.org/maven2/org/springframework/cloud/spring-cloud-starter-circuitbreaker-resilience4j/ | The replacements the ecosystem had to write and now maintains | Both ship 5.0.3/ 2026-08-20 |
| 33 | Netflix | concurrency-limits README | adr | current | 2026-09-16 | https://raw.githubusercontent.com/Netflix/concurrency-limits/master/README.md | What "adaptive" means concretely, and why fixed thresholds were rejected | "Java Library that implements and integrates concepts from TCP congestion control to auto-detect concurrency limits"; "in large distributed systems that auto-scale this value quickly goes out of date and the service falls over by becoming non-responsive as it is unable to gracefully shed excess load"; algorithms Vegas and Gradient2 |
| 34 | Maven Central | com.netflix.concurrency-limits:concurrency-limits-core listing | source | continuous | 2026-09-16 | https://repo1.maven.org/maven2/com/netflix/concurrency-limits/concurrency-limits-core/ | The recommended successor is a 0.x artefact on an annual release cadence | 0.5.2/ 2024-09-03, 0.5.3/ 2024-11-20, 0.5.4/ 2025-12-08 |
| 35 | Netflix | Lemur repository, archive banner and README notice | source | archived 2026-07-06/07 | 2026-09-16 | https://github.com/Netflix/lemur | A security-critical service was retired by telling users to fork it | Banner: "This repository was archived by the owner on Jul 7, 2026. It is now read-only." README: "This repository is now archived and read-only as of July 6, 2026 … If you need to continue making changes, please fork this repository." |
| 36 | GitHub Advisory Database | GHSA-v2wp-frmc-5q3v (CVE-2026-55166) | postmortem | 2026-06-10, database entry 2026-06-25 | 2026-09-16 | https://github.com/advisories/GHSA-v2wp-frmc-5q3v | The abandoned service was carrying a critical authorisation chain | "any SSO-authenticated user achieves AWS IAM compromise and permanent PKI key access via ACME acme_url SSRF and creator-equality IDOR"; affected < 1.9.2, patched 1.9.2 |
| 37 | GitHub Advisory Database | GHSA-pxmc-2ffp-8j67 (CVE-2026-71417) | postmortem | 2026-07-06 | 2026-09-16 | https://github.com/advisories/GHSA-pxmc-2ffp-8j67 | The last patch landed on the day of the archive notice, and the advisory count kept climbing | "Any user can revoke arbitrary certificates at the CA by uploading a duplicate record and revoking it"; affected <= 1.9.2, patched 1.9.3; 20 advisories total against the pip package lemur |
| 38 | Netflix | DGS framework README, version compatibility table | adr | current | 2026-09-16 | https://raw.githubusercontent.com/Netflix/dgs-framework/master/README.md | The current retirement practice: a dated support window published before the end, not after | "11+ / Spring Boot 4 / Actively maintained"; "10.x / 3 / Most features will be backported until the second half of 2026"; "5.x / 2 / No longer maintained" |
| 39 | PyPI | metaflow release history | source | continuous since 2019-12-03 | 2026-09-16 | https://pypi.org/pypi/metaflow/json | The modern Netflix artefact is a continuously released product, not a frozen library | 267 releases; first 2.0.0 2019-12-03, latest 2.19.39 2026-09-02; releases by year 2019:2, 2020:12, 2021:22, 2022:30, 2023:36, 2024:61, 2025:80, 2026:24 |
| 40 | Netflix | Maestro README | casestudy | current | 2026-09-16 | https://raw.githubusercontent.com/Netflix/maestro/master/README.md | The later open-source layer is a service, described by its operating scale | "a general-purpose workflow orchestrator that provides a fully managed workflow-as-a-service (WAAS) to the data platform users at Netflix"; "It schedules hundreds of thousands of workflows, millions of jobs every day and operates with a strict SLO" |
| 41 | Netflix | Titus control plane README | source | archived | 2026-09-16 | https://raw.githubusercontent.com/Netflix/titus-control-plane/master/README.md | The container platform's public control plane was archived outright | "# Titus Control Plane (ARCHIVED) … This repo has been archived and is no longer in active development." |
| 42 | Netflix | Simian Army README | adr | retired | 2026-09-16 | https://raw.githubusercontent.com/Netflix/SimianArmy/master/README.md | The split-and-rehome retirement, with each capability named a successor | "## PROJECT STATUS: RETIRED … Some of the Simian Army functionality has been moved to other Netflix projects"; Chaos Monkey standalone, Swabbie for Janitor Monkey, Conformity "rolled into other Spinnaker backend services" |
| 43 | GitHub Advisory Database | GHSA-wpcv-5jgp-69f3 (CVE-2024-4701) | postmortem | 2024-05-09 | 2026-09-16 | https://github.com/advisories/GHSA-wpcv-5jgp-69f3 | The contrast case: a maintained Netflix service shipped a patch | "Path Traversal Vulnerability via File Uploads in Genie", Critical CVSS 9.9, com.netflix.genie:genie-web < 4.3.18, patched 4.3.18 |
| 44 | Netflix | Dynomite README | source | current | 2026-09-16 | https://raw.githubusercontent.com/Netflix/dynomite/master/README.md | Retirement by drift: no notice, just a branch that stopped | "Over time master branch has fallen behind and is not maintained. We will eventually delete it and may or may not create it." |
What is missing, and why it matters
- No postmortems in the usual sense. Netflix publishes incident analysis on its technology blog, which this run could not reach. The four advisory-tier records here describe defects and their patch state, not outage duration or user impact.
- No internal measurement. Nothing here says how many Netflix services still link Hystrix, how much the gRPC migration cost, or what the adaptive limiter does to tail latency in production. Those numbers exist in talks and blog posts that were unreachable.
- No external voice. Every statement about Netflix's motives is Netflix's own, written in a README by the team that made the decision. Read the motive claims as sanctioned accounts.
- Download and dependent counts. The obvious measure of how many people still run these libraries is dependent counts, which live on hosts the proxy blocked. Stars, forks and open pull requests are weak proxies and are labelled as such in the page.