The idea is that software streams from developers, to package maintainers and then to users. When reporting a bug "upstream", it's reported from users to maintainers/developers or from maintainers to developers.
"Please report this bug upstream."
"Wonder what upstream has to say about this."
"Silly upstream, that bug has been ignored for 42 years now"
"Thank you upstream, for doing this in your spare time"