So, to be clear, salva, the most likely scenario seems to me to be: Bob sends you a bug report, either with a patch attached or, after you completely fail to respond in any way, a patch comes in as a follow-up to the bug report. After you (perhaps for the second time) completely fail to respond (for a few weeks) and you haven't gotten around to your queue of bugs for that module for "years" (as you said), Bob uploads an "unauthorized" version of the module with his patch applied.

I can't tell, even after all of the back-and-forth, whether that would leave you "very upset" (well, you said "very impolite and upsetting" so maybe the "very" wasn't meant to distribute across the "and" there).

Note that I don't consider any of the steps in my first paragraph to be particularly problematic. Quite the contrary, I find them to be the most likely results in general, not just for salva's modules. All salva has done is admit to being quite ordinary when it comes to interest in and level of involvement in a bit of software.

But I do consider responding to the above scenario with an actual display of being upset to be childish, counter-productive, and self-indulgent.

The correct response (IMHO) to the above scenario is to finally respond to the bug report(s) and to politely ask that the new volunteer/contributor consider taking advantage of their current level of interest in the module. The response would mention the git repo (why isn't that just in the module documentation?) and the backlog (that'd be good to put someplace public) and would offer to give the volunteer co-maintainer (at least) access, of course. The response or a follow-up would mention any suggestions about how to improve the patch.

Now, I can admit to the point that a polite action would be a 2nd (or 3rd) e-mail announcing (politely) that Bob (given that lack of response and years since the last release and at least implying that neither of those facts is surprising nor a bad reflection upon you) will soon be uploading a patched version of the module (and offering to seriously consider any concerns you might have and asking you to consider granting co-maintainer status so the upload won't remain "unofficial").

But I also consider that step rather optional. And my biggest concern with that step is that it stretches the time span from patch construction to publication of a patched release to the range where I find people are likely to loose their interest / motivation and then we'll just have two people with backlogs for the module and no fix published until "years" pass and one of you gets excessively bored or otherwise unusually motivated.

An obvious middle ground is for Bob to mention, when sending the patch, his intent to upload a patched version. That makes more sense if the patch comes after a bug report with no response. But I wonder if that would also be "impolite and upsetting" to you.

I think my balance point would settle upon two e-mails. If I sent a (full) patch in the initial bug report, then I'd not initially mention my intent to upload a patched release. If I got no response after a week, then I'd follow-up with an e-mail describing my intent to upload.

But I think it would be more likely that my first bug report would not contain a full patch (more likely just a patch that fixes the problem w/o incrementing the module version, adding a test to cover the fix, and updating the documentation). But, after no response, if I actually still had the motivation to produce a full patch, then I think I'd just forward the full patch and, as politely as I could, note that I plan to upload a patched version.

And I seriously wish that I could declare that my CPAN modules are officially open for such contribution. I would really like to know that, if I got hit by a bus, my modules on CPAN could actually receive contributions that would (eventually) be fully indexed without requiring somebody find the motivation to stalk my non-existence for 6 months and then beg for manual intervention from the admins.