← All news

Analysis · Norvik Tech

TLDRAW's New Contributions Policy: A Technical Deep Dive

Analyze the technical and community implications of tldraw's decision to automatically close external pull requests, and learn best practices for managing open-source contributions.

Norvik Tech Editorial4 min read

The essentials in 30 seconds

  1. 1The tldraw project (GitHub issue 7695) has implemented a new contributions policy that automatically closes pull requests from external contributors.
  2. 2The tldraw policy reflects broader trends in open source business models and project sustainability .
  3. 3Mature projects with complex architecture
In this article
  1. 01What is TLDRAW's Contributions Policy? Technical Deep Dive
  2. 02How TLDRAW's Policy Works: Technical Implementation
  3. 03Why This Matters: Business Impact and Use Cases
  4. 04When to Use Similar Policies: Best Practices and Recommendations
01

What is TLDRAW's Contributions Policy? Technical Deep Dive

The tldraw project (GitHub issue #7695) has implemented a new contributions policy that automatically closes pull requests from external contributors. This represents a significant shift in open-source governance strategy, moving from a fully open contribution model to a more curated approach.

Technical Definition

A contributions policy defines the rules and processes for how external developers can contribute code to a project. Traditional open-source projects use a pull request (PR) model where anyone can fork, modify, and submit changes. TLDRAW's new policy changes this to an automated closure system where PRs from non-maintainers are automatically closed, often with a message directing contributors to follow specific guidelines.

Core Principles

  • Quality Control: Ensures contributions align with project architecture
  • Maintainer Focus: Reduces context switching for core team
  • Strategic Alignment: Keeps development focused on project roadmap
  • Community Management: Sets clear expectations for contributors

This approach is common in large, mature projects like React or Kubernetes, where uncontrolled contributions can create technical debt and maintenance overhead.

Key points

  • Automated PR closure for external contributors
  • Shift from open to curated contribution model
  • Alignment with project roadmap and architecture
  • Reduced maintainer workload and context switching
02

How TLDRAW's Policy Works: Technical Implementation

The policy implementation uses GitHub automation to manage contributions. When a pull request is opened from a non-maintainer account, automated workflows trigger the closure process.

Technical Architecture

GitHub Actions Workflow

yaml name: Close External PRs on: pull_request_target: types: [opened]

jobs: check-author: runs-on: ubuntu-latest steps:

  • name: Check if contributor is maintainer run: | if [[ ! "${{ github.event.pull_request.user.login }}" =~ "maintainer" ]]; then gh pr close ${{ github.event.pull_request.number }}
    --comment "External contributions are not accepted. Please open an issue first." fi

Implementation Components

  1. Event Trigger: pull_request_target event captures new PRs
  2. Author Validation: Checks GitHub username against maintainer list
  3. Automated Response: Closes PR with explanatory comment
  4. Issue Redirection: Directs contributors to create issues first

Alternative Approaches

  • Manual Review: Traditional approach, high maintainer overhead
  • CLA (Contributor License Agreement): Legal framework for contributions
  • Bot-Based Triage: Automated labeling and routing
  • Issue-First Model: Require issue discussion before PR submission

The automated closure model prioritizes project velocity over community contributions, which is appropriate for projects with clear architectural direction.

Key points

  • GitHub Actions for automated PR management
  • Maintainer list validation before closure
  • Automated comments with contribution guidelines
  • Issue-first contribution workflow
03

Why This Matters: Business Impact and Use Cases

The tldraw policy reflects broader trends in open-source business models and project sustainability. For companies relying on open-source libraries, this has significant implications for development workflows and risk management.

Business Impact

For Project Maintainers

  • Reduced Context Switching: Core team focuses on strategic features
  • Quality Assurance: Every contribution undergoes architectural review
  • Roadmap Adherence: Development aligns with business objectives
  • Technical Debt Prevention: Uncontrolled contributions often create maintenance burden

For Organizations Using tldraw

  • Dependency Risk: Changes in contribution policy may affect update frequency
  • Customization Challenges: Limited ability to contribute fixes directly
  • Support Requirements: Need for alternative contribution channels

Real-World Use Cases

Enterprise Application Development: Companies building drawing tools using tldraw must now:

  1. Fork and maintain private versions
  2. Work with maintainers for custom features
  3. Budget for potential delays in bug fixes

Startup Integration: Startups using tldraw for MVPs face:

  • Longer development cycles for customizations
  • Need for in-house tldraw expertise
  • Potential need to evaluate alternative libraries

Norvik Tech Perspective: From a consultancy standpoint, this policy shift requires clients to reassess their open-source dependency strategy. We recommend evaluating the project's health, maintainer responsiveness, and alternative libraries when such policies change.

Key points

  • Project sustainability and maintainer burnout prevention
  • Enterprise dependency risk assessment
  • Customization strategy for businesses
  • Open-source governance implications
04

When to Use Similar Policies: Best Practices and Recommendations

Not all open-source projects should adopt automated contribution closure. The decision depends on project maturity, team size, and strategic goals.

Appropriate Scenarios

Mature Projects (10,000+ stars)

  • Architecture Complexity: Deep integration with ecosystem
  • Stable API: Breaking changes have wide impact
  • Large User Base: Many organizations depend on stability
  • Dedicated Maintainers: Core team can handle strategic development

Projects with Clear Business Model

  • Commercial Backing: Company-funded development
  • Premium Features: Open core with paid offerings
  • Consulting Services: Professional support as revenue stream

Implementation Best Practices

1. Clear Documentation

markdown

Contributing Guidelines

We do not accept external pull requests directly.

Instead, please:

  1. Open an issue describing your use case
  2. Discuss with maintainers about architecture
  3. Wait for maintainer approval before coding
  4. Follow our coding standards and test requirements

2. Alternative Contribution Channels

  • Issue-First Workflow: Require issue discussion before PR
  • Contributor License Agreement (CLA): Legal protection
  • Bounty Programs: Reward for specific features
  • Sponsored Development: Paid custom development

3. Communication Strategy

  • Transparent Rationale: Explain why the policy exists
  • Clear Guidelines: Document acceptable contribution paths
  • Responsive Maintainers: Acknowledge issues promptly
  • Community Engagement: Regular updates on project direction

When to Avoid This Policy

  • Early-stage projects needing community growth
  • Academic/research projects benefiting from diverse contributions
  • Community-driven projects with strong contributor culture
  • Projects with limited maintainer bandwidth but high community interest

Recommendation: Start with issue-first workflow before implementing automated closure. Measure maintainer workload reduction versus community engagement impact.

Key points

  • Mature projects with complex architecture
  • Commercial-backed open source projects
  • Clear documentation and communication
  • Alternative contribution channels required

Frequently asked questions

What are the technical implications of tldraw's new contributions policy for enterprise adoption?

The policy fundamentally changes how enterprises can integrate and customize tldraw. Technically, it means that custom features, bug fixes, or optimizations that aren't on the official roadmap cannot be contributed back via pull requests. Enterprises must now choose between several technical strategies: maintaining a private fork with custom modifications, building extensions through tldraw's plugin system, or implementing a wrapper architecture that adds functionality externally. Each approach has technical trade-offs. Forking requires ongoing maintenance to sync with upstream updates, which can be complex given tldraw's active development. Plugin development limits customization to what the plugin API exposes. Wrapper architectures add complexity and potential performance overhead. Norvik Tech recommends conducting a technical audit to evaluate which approach aligns with your architecture, team capabilities, and long-term maintenance strategy. We also help establish automated testing and CI/CD pipelines to manage fork synchronization effectively.

How does this policy compare to other major open-source projects like React or Kubernetes?

TLDRAW's approach aligns with mature open-source projects that have achieved critical mass. React maintains tight control over core contributions through a working group model, where external contributors must join specific working groups and follow RFC (Request for Comments) processes. Kubernetes uses Special Interest Groups (SIGs) to manage contributions at scale, requiring membership and following strict governance. Both models prioritize stability and architectural coherence over community contributions. The key difference is that React and Kubernetes have established governance structures with clear contribution paths, while tldraw's automated closure is a simpler, more direct approach. For comparison, Vue.js uses a maintainer team with RFC processes for major changes. The trend shows that successful open-source projects with commercial backing or large user bases tend to move toward more controlled contribution models. This reflects the reality that maintaining architectural integrity becomes more critical as project adoption grows.

What are the best practices for managing a fork of tldraw under this new policy?

Managing a fork effectively requires strategic planning and technical discipline. First, establish a clear fork management strategy: decide whether you'll maintain a permanent fork or use it temporarily. Implement automated synchronization with the upstream repository using GitHub Actions or similar CI/CD tools. Create a comprehensive test suite that validates both your custom features and compatibility with tldraw's core functionality. Establish a governance model for your fork: define who can make changes, how decisions are made, and when to contribute back upstream. Document all customizations thoroughly, including why they were necessary and their technical implications. Set up regular sync schedules (weekly or bi-weekly) to catch breaking changes early. Consider using tools like `git-imerge` for complex merges. Most importantly, design your custom features as modular extensions rather than core modifications when possible. This reduces merge conflicts and makes future migrations easier. Norvik Tech typically recommends starting with a fork but planning for eventual migration to a plugin-based architecture or alternative library if the customizations become too extensive.

Should we consider alternative libraries instead of dealing with tldraw's policy restrictions?

The decision depends on your specific requirements and technical constraints. Evaluate alternatives based on several criteria: feature parity, performance characteristics, API design, community health, and long-term viability. Excalidraw offers similar open-source drawing capabilities with a different governance model. Fabric.js provides lower-level canvas manipulation, giving more control but requiring more development effort. Konva.js offers good performance for complex canvas applications. Commercial alternatives like Miro or Figma provide enterprise features but come with licensing costs and vendor lock-in risks. The technical evaluation should include: prototyping with each alternative, measuring performance for your specific use cases, assessing the learning curve for your team, and analyzing the ecosystem of plugins and extensions. Consider your team's expertise and the long-term maintenance burden. If your requirements are highly specific and tldraw's core architecture aligns well, maintaining a fork might be more cost-effective than migrating. However, if you need extensive customizations that don't align with tldraw's roadmap, an alternative might be better. Norvik Tech can help conduct this technical evaluation with proof-of-concept implementations and total cost of ownership analysis.

How can organizations contribute to tldraw's ecosystem despite the pull request restrictions?

While direct code contributions via pull requests are restricted, there are still valuable ways to contribute to tldraw's ecosystem. First, engage through the issue tracker: provide detailed bug reports with reproduction steps, suggest well-researched feature requests with use case analysis, and participate in discussions about project direction. Second, contribute to the ecosystem: create and share plugins that extend tldraw's functionality, write tutorials and documentation for specific use cases, develop integration guides for popular frameworks, and maintain community resources. Third, provide feedback: test pre-release versions and report issues, participate in community discussions on platforms like Discord or GitHub discussions, and share success stories that demonstrate tldraw's capabilities. Fourth, consider sponsored development: some projects accept funding for specific features through platforms like GitHub Sponsors or Open Collective. Finally, contribute to related projects: improve tools that work with tldraw, enhance documentation generators, or develop testing utilities. This ecosystem approach benefits the project while respecting its governance model. Norvik Tech helps clients establish these contribution strategies to maintain good relationships with open-source projects while achieving their business objectives.

Want to apply this in your business?

A Norvik specialist reviews your case in a 30-minute call and tells you what to do first.

TLDRAW Contributions Policy Analysis: GitHub Issue… | Norvik Tech