Of the 149 companies carrying Y Combinator's "Open Source" tag, standalone apps get acquired at roughly 20%. Libraries and SDKs get acquired at roughly 3%. Stars don't move that number. Having a named SaaS competitor doesn't move it. Company age doesn't move it. Shipping a product someone can actually run, not just a dependency someone can import, is what makes an open-source project a company someone can buy.
That's the first finding in reviewing all 149 companies and independently confirming 28 acquisitions. The second is about who's doing the buying and why — one acquirer ran the same playbook three times in eighteen months. The third is the one that actually matters if your own stack depends on any of this: the announcement tells you nothing about what happens after a deal closes, but the first three weeks of commit history tell you almost everything.
20%
of standalone apps acquired
3%
of libraries and SDKs acquired
28
confirmed acquisitions, of 149 reviewed
What actually makes open source acquirable
Apps get bought roughly 6.7x more often than libraries in the population reviewed for this report. That gap holds even though several of the libraries here are far more popular by any conventional measure — frameworks and SDKs with tens of thousands of stars that have never been acquired, because there's no standalone product or customer base attached to buy. A library is a component someone else's product depends on. An app is a product with users, a market position, and a specific "replaces X" story — the three things an acquirer actually needs in order to write a check.
What doesn't predict it is more interesting than what does. Acquired companies in this data have a lower median star count than the ones that stayed independent — being the loudest, most-starred project in a category isn't what gets you bought. Having a well-known commercial competitor in the same space barely moves the odds either. And company age makes almost no difference: a two-year-old app and a six-year-old app show roughly the same acquisition rate. The one variable that actually separates the acquired from the not-acquired is whether there's a product to buy at all.
Who buys it, and why
Most of these deals share a stated reason, and it isn't hiring. Eighteen of the 28 acquisitions come with an explicit line from the acquirer about what the project does for their own product: it feeds their pipeline, extends their platform, or replaces something they'd otherwise have to build. Citus now powers Azure Cosmos DB for PostgreSQL. Pyroscope was folded directly into Grafana's own profiler. Arroyo's stream-processing engine now runs Cloudflare Pipelines. Keep's alert-correlation engine went straight into Elastic's own observability stack. Requestly bolsters BrowserStack's testing suite, and highlight.io does the equivalent for LaunchDarkly's feature-flag platform. This is the dominant motive in the data — buying an open-source tool because it plugs into what you already sell, not because you want the team.
One acquirer runs this playbook faster and more visibly than anyone else. ClickHouse bought PeerDB in July 2024, HyperDX in March 2025, and Langfuse in January 2026 — three companies in eighteen months, each one a tool that feeds data into or watches over a ClickHouse deployment. PeerDB moves data in. HyperDX and Langfuse watch what happens once it's there. It reads less like three unrelated acquisitions and more like a data platform being assembled in public, one open-source purchase at a time. Mintlify has quietly run a smaller version of the same move, buying Trieve and then Helicone eight months apart, both tools that plug into an AI-driven documentation product.
The pattern isn't confined to infrastructure-adjacent buyers either. Bun — a JavaScript runtime with roughly 95,000 GitHub stars, one of the largest projects in this entire cohort — was bought by Anthropic in December 2025 and immediately positioned as infrastructure for Claude Code and the Claude Agent SDK. Same logic as ClickHouse and Mintlify, running inside a very different kind of company.
Figure 1 28 acquisitions, grouped by why the buyer says they did it
ClickHouse's three deals and Mintlify's two sit inside eighteen-month and eight-month windows, respectively. Every other acquirer in this data has bought exactly one company.
Source: Company announcements and public repositories, 2018–2026
The announcement doesn't tell you what happens next
The natural next question is whether the stated motive predicts the outcome. It doesn't, cleanly. Payload and Fern were both framed around the team joining a new company, and both are still shipping as actively as before. FlowiseAI continues under new ownership with commits landing daily. Meanwhile Trieve was acquired for an explicit product reason — powering search inside Mintlify's own platform — and its commit activity has still measurably slowed since the deal closed. A press release built around "the team is joining" and a press release built around "this powers our roadmap" turn out to predict almost nothing about which repos are still active a year later.
What actually predicts it: the first three weeks
Commit history does. Pulling weekly commit counts for a matched set of acquisitions — three that kept shipping, two that didn't — produces a split with almost no middle ground. PeerDB, HyperDX, and Langfuse never once hit zero commits in a week, before or after their deals closed; PeerDB dipped to one or two commits for about three weeks right at the close and recovered from there, while HyperDX and Langfuse show no pause at all. PipelineDB and Optic did the opposite — both dropped to near zero within a week of their acquisition and stayed there for months. Optic ran nineteen commits the week before its deal closed and one the week after; Atlassian folded it into its Compass developer platform, and the repository sat untouched until it was formally archived nearly two years later. PipelineDB never shipped a release past version 1.0 once the Confluent deal closed — by its own README, the acquisition was effectively the project's last public act.
Figure 2 Weekly commits, 10 weeks before to 16 weeks after acquisition
Every project that kept shipping had zero silent weeks, before or after the deal. Every project that later went dark was already near-silent within a week of the announcement. There's no case in this data of a slow recovery — it's one or the other, fast.
Source: GitHub commit history, pulled per repository
That's a sharper cutoff than "watch the repo for signs of trouble" — it's closer to a specific, checkable rule. If a project you depend on gets acquired, the deal itself tells you nothing. A brief pause in the days around the close tells you nothing either — even ClickHouse, buying with every intention of keeping a project alive, produced one deal with a real dip. What separates the ones that survive from the ones that don't is whether commits are still landing three weeks out. By then, the pattern has already set.
That split isn't limited to the five repositories in the chart above. Fifteen of the 28 acquisitions in this cohort are already cataloged in Open Apps' own directory, each carrying a repo health score computed independently — a different methodology built from releases, contributor activity, and issue responsiveness, not raw commit counts. The same pattern holds. Langfuse, Bun, and Payload score 92; Keep, Fern, PeerDB, and HyperDX all sit in the high 80s. Trieve and Warrant — the two companies already named above as cases where a stated motive didn't predict what actually happened — score 43 and 45, the lowest of any acquisition in the group.
That convergence matters more than either number alone. Two methods built for different purposes, on different timelines, using different signals, land on the same two outliers. It isn't an artifact of which five repositories got picked for the commit-history pull above, or how a given week's commits happened to get counted — it's the same split showing up wherever you look.
What this means
If you're building something open source with an eventual acquisition in mind, the data points at a specific shape: ship something people run, not just something people import, and make it something a company already shipping adjacent infrastructure would want plugged into their own product. Stars and buzz aren't doing the work you might expect them to.
If you're on the other side of this — depending on a tool that just got acquired — skip the press release entirely. Check the repo in three weeks. That single number carries more information than anything either company says about the deal.
Scope and method
The starting population is the 149 companies carrying YC's "Open Source" tag as of July 2026. Of those, 28 acquisitions are independently confirmed by a repository, press release, or company blog post stating the deal directly — a narrower bar than YC's own "Acquired" status field, which also flags at least one company (Jitsu) with no independent confirmation available. The app-vs-library acquisition rate is computed across 96 standalone apps and 37 libraries in the reviewed population; with only 19 and 1 acquisitions respectively behind those rates, the library side in particular rests on a thin sample and should be read as directional, not precise. The commit-history comparison draws on five repositories with a clear, dateable acquisition and continuous public commit history before and after — three that kept shipping, two that didn't — rather than the full set of 28, which don't all have equally clean before-and-after data to pull.
