We give maintainers 2 weeks to respond to bug reports, requests for updates, and so forth (security-officer@ can override)
After that time, any commmitter may make the change via a "maintainer-timeout"
Period is a compromise between not infringing on a maintainers' prerogative to maintain a port as he sees fit, and the needs of users to have their problems addressed in a timely fashion
Maintainers who do not respond to PRs within 3 months may lose the maintainership of their ports
Special case: PR for an application bug (not specific to FreeBSD)