Open source in a website: know the components you depend on

A website uses a form library, an editor and an image-processing package. The team changes and nobody remembers the source or update route for one component. It still works, but maintenance has become an uncertain dependency.

Open source is an ordinary part of web projects and can avoid duplicating useful existing work. Selection, updates and responsibility for the resulting feature remain part of the project.

Available code is not the whole definition

The Open Source Initiative definition addresses distribution and usage terms, rather than access to code alone. A file visible online should not automatically be treated as available for every purpose.

Retain the official source and applicable licence. Check the conditions for the particular use. One package’s terms cannot be assumed for another. Obtain an appropriate review when a requirement is unclear.

Keep a useful inventory

Record the principal component’s name, version, purpose and project address. Identify where it is used and who reviews updates. Reconstructing that information from an arbitrary downloaded filename can be difficult later.

Review maintenance activity, security notices and known limitations. Popularity alone does not establish suitability. A smaller package may fit if its role and maintenance are understandable.

Plan verification and recovery

An update is more than replacing a file. Check its integration points and dependent actions. An editor, payment component and data processor have different consequences. Test important changes in a separate environment first.

• Identify principal components and official sources.
• Record versions, purpose and licence references.
• Assign someone to review update information.
• Verify changes through relevant customer tasks.
• Prepare replacement and rollback routes.

Retain the information needed to rebuild the project alongside backups and documentation, while protecting secrets separately. During website support, open source should be a known, responsibly managed dependency rather than an unexplained free file.