Tidelift

Tidelift, now presented as a Sonar company, pays approved maintainers to help packages used by enterprise subscribers meet security, maintenance, and licensing standards. This is earned service income, not a grant or passive payment.

Eligibility and application. Tidelift currently lists Java/Maven, JavaScript/npm, Python/PyPI, Swift/CocoaPods, Go, Rust/Cargo, C#/NuGet, and Ruby/RubyGems as supported ecosystems; it notes limitations for Swift maintainer partnerships. It recruits package maintainers based on customer usage and inquiry, and does not publish a universal package popularity threshold. The maintainer page invites applicants to find a package. Tidelift’s onboarding guide says applicants create an account, request to lift an available package, submit a lifter agreement, and wait for review. The guide gives a 3–5 business day processing estimate after the agreement, but it was last updated in 2023; check the current application flow for changes. Approval is not guaranteed.

Work, payments, and terms. Lifters validate and maintain package security, licensing, release, and maintenance information, and may need to provide vulnerability guidance or fixes. Tidelift says maintainers do not give up control of their technical roadmap or provide help desk or consulting services. Payment depends on package weight and subscriber usage, with strategic importance also cited; amounts vary and are not guaranteed. The public guide describes monthly USD payments, normally sent through Hyperwallet on the third business day of the month. A signed, month-to-month lifter agreement is required; it describes a 30-day written termination notice and assigns taxes to the recipient. Public materials do not specify a standard maintainer-side fee or minimum payment.

See the current maintainer program page, onboarding guide, supported ecosystems, lifter tasks, payment method, and lifter agreement.