open-source maintainers

OpenBao is an open-source tool written in Go for managing, storing, and distributing sensitive data such as passwords and API secrets, encryption keys, and digital certificates. It emerged as a community-maintained alternative to HashiCorp Vault after licensing changes. On GitHub's trending list this week it has picked up new stars and attention, with developers discussing it as a free, open option for handling secrets securely in their infrastructure.

Chimera Linux has published a new essay making the case for cbuild, its distribution build tooling developed in-house rather than reused from an existing distro. The article argues that a small community-maintained distribution benefits from owning its packaging and build pipeline, and the piece is drawing attention among Linux and open-source developers discussing dev tooling choices.

The EmDash CMS project has published a blog post explaining how it uses Clef to moderate its plugin registry. The announcement is drawing attention among developers interested in open-source content management systems and approaches to keeping plugin ecosystems safe and well-maintained. Discussion so far is modest but positive, with the open-source community watching how automated moderation tooling is applied to CMS plugin marketplaces.

Greg Kroah-Hartman, the longtime maintainer of the Linux kernel's stable branch, is featured discussing what large language models mean for software and kernel security. The talk examines how AI-generated code affects maintenance, review practices, and vulnerability risks in widely used open-source infrastructure, and it is drawing attention among developers weighing the benefits and dangers of AI-assisted programming.

A new data visualisation from Sheets.works highlights the small teams and individual volunteers behind critical open-source software the internet depends on, including OpenSSL, SQLite, zlib, curl, sudo, ffmpeg, Linux and core-js. The piece, being shared widely in open-source and developer circles, underscores how few maintainers keep essential infrastructure running, renewing debate about underfunding and burnout in the volunteer-run software ecosystem.

Solus Linux, the independent Linux distribution, has introduced a formal policy governing contributions created with AI and large language models. The move, reported by Linuxiac, sets clear rules for how AI-assisted code is handled in the project. It reflects a broader debate in open-source communities about how to manage the growing volume of AI-generated submissions to volunteer-maintained software projects.

A widely shared article highlights how billions of phones and everyday services rely on critical open-source code maintained by just a handful of often unpaid volunteers. From phone alarms to boarding passes and banking, essential digital infrastructure rests on a tiny group of maintainers, prompting renewed debate about the fragility of the software underpinning daily life and the lack of funding and support for the people who keep it running.

Sentry, the open-source error tracking and performance monitoring platform maintained by Sentry, is seeing fresh attention among developers. The tool helps engineering teams catch, prioritise and fix crashes and performance problems in production software, and its Python-based repository remains a widely used reference project in the monitoring space.

StreetComplete maintainer westnordost reports that the effort to bring the OpenStreetMap surveying app to iOS using Kotlin Multiplatform and Compose Multiplatform has reached roughly 50 percent completion after several months of work. The update gives the open-source mapping community a concrete progress marker on bringing the popular Android app to Apple devices.

Anthropic has launched a free AI-powered security scanning service for open-source projects, according to a report by The Verge. The tool is aimed at helping maintainers find vulnerabilities in widely used code at no cost. The announcement is drawing attention from developers and security observers discussing the growing role of AI companies in open-source security.

The maintainer of novelWriter says they are still building packages for Debian 12 and have noticed people keep downloading them, even though the Debian 12 release reached end-of-life a few months ago. They would like to drop support, which would let them move on from Python 3.11, but are weighing that against users who still rely on those builds.

Anthropic has launched a free service that uses AI to run security scans on open-source software projects. The move aims to help volunteer maintainers find vulnerabilities they might otherwise miss due to limited time and resources. It also positions Anthropic more deeply in the developer tools space alongside rivals like OpenAI and Google.

curl maintainer Daniel Stenberg reports that two ARM64-specific compiler optimization bugs, one in GCC 15/16 and one in the Rust compiler, have affected curl. The bugs, triggered by aggressive optimization on 64-bit ARM platforms, caused miscompiled code in the widely used data transfer library. The report has drawn attention from developers discussing the risks compiler bugs pose to critical open-source infrastructure.

Anthropic has launched a free service that uses its AI to scan open-source software for security vulnerabilities. The move is being discussed as a potentially significant boost for under-resourced open-source maintainers, who often lack dedicated security auditing, while also raising questions about the growing role of AI companies in software infrastructure and security.

The Dutch Party for the Animals posted a vacancy for a full-time social media and content specialist for its parliamentary faction, listing Instagram, TikTok, Bluesky and Facebook among the platforms. Mastodon users are questioning why the decentralised network Mastodon is not mentioned, noting the party itself maintains an active account there. The discussion highlights debate over whether organisations should include smaller, open-source platforms in their communications work.

Anthropic has introduced OSS Scanner, a free service that helps open-source software projects find security vulnerabilities. Open-source maintainers can now use the company's AI tools to check their code for weaknesses at no cost. The move comes amid growing concern over the security of widely used open-source dependencies, which are often maintained by small teams with limited resources.

A new data project by Data Drop, 'The people holding up the internet', examines open-source software and finds that billions of phones run on code maintained by only a handful of people. The team counted maintainers directly from the code itself, highlighting how heavily the world's digital infrastructure depends on a very small group of often unpaid developers. Readers are sharing the findings and discussing the fragility of open-source maintenance.

Version 18.1 of GDB, the GNU Debugger widely used for debugging C, C++ and other compiled programs, has been released. The announcement was made on the GDB mailing list maintained by Sourceware, pointing users to the new stable point release. Developers are sharing the news in programming communities, where the debugger remains a core tool in open-source toolchains alongside GCC.

Western companies and governments are accelerating efforts to compete in open-source artificial intelligence, according to Semafor's analysis. The push comes as open-weight models gain ground globally and policymakers weigh how to keep pace with rivals while maintaining an edge over Chinese AI developers. The debate centers on whether open approaches can match closed, proprietary systems from leading US labs.

The developers behind Bridown's Bridgetown are again asking the Ruby community to sponsor the project, describing it as the only hybrid site generator in the Ruby web ecosystem, capable of producing both static sites and dynamic server-rendered pages within one system. They note it powers websites for projects including Sidekiq and RuboCop. The renewed appeal suggests funding support remains modest, and open-source maintainers are increasingly turning to sponsorship to sustain development.

The BBC maintains its own fork of dash.js, the open-source JavaScript library for adaptive video streaming via MPEG-DASH. A report examines why the broadcaster diverged from the upstream project and what its changes involve. The story is being discussed among developers interested in streaming media technology and the BBC's engineering practices.

Anthropic says it will fast-track the reporting of AI-related security bugs to open-source software maintainers, aiming to shorten the time between discovery and disclosure. The company also named 11 firms it is working with on operational technology security. The announcements signal Anthropic pushing deeper into cybersecurity coordination, drawing attention from developers and security teams watching how AI vendors handle vulnerability disclosure.

A new vulnerability, EUVD-2026-92803, has been catalogued affecting the docling and docling-slim packages maintained by the docling-project. The flaw carries a moderate severity score of 4.0 out of 10 under CVSS v3.1 and affects versions from 2.91.0 onward. Docling is widely used to parse document formats and connect them with generative AI tools, so affected users are advised to check versions and apply fixes.

Anthropic is offering open-source projects free automated security scans to find vulnerabilities. The company says that in tests, most of the weaknesses identified by the scans turned out to be genuine. The move puts AI-powered security auditing in the spotlight, with observers weighing the benefit for under-resourced open-source maintainers against questions about trusting an AI vendor with code analysis.