How to manage the endemic nature of open-source software