In early 2024 we needed the networking module to put one extra tag on public subnets, because our cluster's load balancer controller discovers them by tag. The upstream module did not expose it. Forking took twenty minutes, the change was four lines, and I remember thinking it was the cheapest option available.
Two years later we needed a provider feature that only exists in the AWS provider's 5.x line. Our fork's required_providers pinned to 4.x, and the module's own code used three arguments that 5.x removed. Upstream had done exactly that migration, in about forty commits, in their 5.0.0 release. We had none of them, and the diff between our fork and the version upstream had reached was nine hundred lines across thirty one files, almost all of it work we had not done and did not understand.
Eleven workspaces could not move until it was resolved. It took five weeks in the end, spread across two people, and the part that stung was not the work. It was reading the upstream changelog properly for the first time since the fork and finding a fix from eighteen months earlier that we had never received, for a default that left a wide egress rule on a security group the module creates. We had been running with it the whole time, in every environment, because we had stopped receiving other people's corrections the day we copied their code.
We went back to upstream at the current release. Our one tag is now passed through public_subnet_tags, an input somebody added upstream about eight months after we forked, which I would have known if we had ever looked. Where a fork is genuinely unavoidable it now needs an open pull request against upstream and a review date in the repository, so the intention to return is recorded rather than remembered. And a monthly job compares every pinned third party module against its latest upstream release and opens a ticket when the gap passes two minor versions.
A fork looks like a copy and behaves like a subscription you cancelled while still depending on the service. You keep the code you took and you stop getting everything that was coming after it, including the corrections you would never have thought to make.
– Sergey Shinder
