This is mostly accurate for CodeMirror version 5. But this article is talking about version 6, which was intentionally built in a way that avoids the problem.
That would explain the weird experience of having your open software used in Apple products — no one from the company ever talks to you. I'm a bit baffled how they deal with upstream bugs with this mentality. Not my problem, of course.
Just weird.
There's the classic `tail -f` bug where they didnt upstream the fix, but on their own open source release have an #ifdef APPLE or something to that effect.
A bit late with this reply, but the answer is: Make patches internally, to work around the problematic areas. Often done to avoid the legal necessity to contribute it back upstream. For example, hook code at runtime to jump out to Apple specific changes that are now not part of the OSS codebase directly.
You used to be able to do `git clone https://codemirror.net`, which was kind of neat. But the constant barrage of emails from "security researchers" who had found a "vulnerability" (an exposed git directory holding an open source codebase), have made me configure my server to deny all .git paths.
