Socket: fsnotify Maintainer Dispute

What it is

A maintainer-access dispute in fsnotify (Go cross-platform filesystem-notification library; GitHub shows 10.7k stars, 321k dependent projects). Martin Tournoij (@arp242) removed commit access from Yasuhiro Matsumoto (mattn) and others; mattn's since-deleted X post alleging a hijack triggered supply-chain fears. The Socket writeup adds the concrete resolution and the specific releases involved.

What actually happened

The alarm was a false positive, and the page gives the details the summary omits:

• Tournoij says the removed accounts held commit rights for historical reasons, not active maintenance ("In any other project they never would have had commit rights"). He frames the removal as a trust/quality decision after rushed, cross-platform-unreviewed merges.
• The stated trigger was a FUNDING.yml/sponsorship change committed directly to main early in the work with no discussion — Tournoij noted mattn had withdrawn funds from thanks.dev over the years before doing work here.
• Matsumoto retracted and apologized: he conceded his claim that original maintainers were also removed was wrong, and that the FUNDING.yml edit was a mistake. He said he stepped in only because the project had gone >1 year without a release.

The scanner-pressure angle (the reusable lesson)

The maintenance burst was itself provoked by tooling. An April issue noted automated scanners flag projects as unmaintained after 12 months without a release; fsnotify crossed that on April 4, 2026. That pressure prompted the rushed releases that then looked suspicious — a feedback loop worth recognizing when triaging your own dependencies.

Preconditions / Affected

Matters only if you depend on fsnotify (directly or transitively — likely, given 321k dependents underneath CLIs, dev servers, and infra tooling). No release was found compromised.

What to do

• No incident response required — there is no evidence any release was tampered with. Do not pin away from recent versions out of the takeover rumor.
• If you want current behavior, note v1.10.0 and v1.10.1 (May 4, 2026) are the recent releases. v1.10.1 fixed an inotify bug where sibling watches sharing a path prefix could be removed or renamed incorrectly — relevant if you watch multiple paths under a common prefix on Linux.

Caveats

The takeover narrative was explicitly disputed by the maintainer ("the commit log isn't a secret") and partially retracted by the accuser. The mattn quotes are AI-translated from a deleted Japanese post, so treat exact wording as approximate. The page is one vendor's (Socket) synthesis of a public GitHub thread, not an independent audit of the releases.