The Git Times

These cover JSON-RPC envelopes, OAuth consent, and audit trails, with runnable labs, quizzes, and three mock exams. CI now validates all lesson transcripts against the MCP 2026-07-28 wire shape. The core curriculum remains 523 lessons across 20 phases, shipping reusable artifacts like prompts and MCP servers in Python, TypeScript, and Rust. Over 114k readers accessed the site in the last month. The catch: The MCP prep assumes familiarity with agent architectures; beginners may need supplemental study on foundational LLM and tool-use concepts before tackling protocol-specific labs.

Previously in The Times “covered” — Sep 26

Source: rohitg00/ai-engineering-from-scratch — based on the README and release notes.

These changes reflect shifts in the API’s capabilities over the past year, helping developers adapt to newer model behaviors. The project assumes an API key and basic Python familiarity, with most examples requiring minimal setup beyond environment variable configuration.
The catch: Many notebooks still rely on legacy completion endpoints, creating confusion for newcomers trying to migrate to chat-focused workflows.

Source: openai/openai-cookbook — based on the project README.

4 release introduces a dramatically smaller Docker image, shrinking the slim build to ~175 MB — nearly 89% lighter than before. The standard image also lost ~170 MB by removing duplicate Python installs, unused fonts, and redundant tooling. These cuts lower bandwidth and startup time for local AI setups using Ollama or OpenAI-compatible APIs. The platform still supports model wrapping, agent terminals, MCP tool integration, and granular RBAC. The catch: Aggressive slimming may complicate debugging or extension for users relying on stripped-away system tools.

Previously in The Times “covered” — Sep 26

Source: open-webui/open-webui — based on the README and release notes.

org, rebuilt nightly via Jenkins. Contributors can test changes locally with make html or enable live updates using sphinx-autobuild, which watches source files, rebuilds incrementally, and serves at http://localhost:2022 with automatic browser reload. The build defaults to parallel Sphinx execution (-j auto) and requires Ubuntu Noble, Python, and pinned dependencies via constraints.txt. Multiversion builds ignore local changes and pull from branches. The catch: 184 open issues suggest documentation gaps or build complexity that may slow contribution velocity despite tooling improvements.

Source: ros2/ros2_documentation — based on the project README.

0 finalizes Milestones 05–07, enabling students to train TinyGPT on Shakespeare using multi-head attention and validate it via TinyCopilot’s AST-based code completion against unseen prompts. The release fixes silent correctness errors in autograd and optimizers, removes unverified test passes, and redesigns lab guides to act as an interactive mentor powered by MLSys·im. Learners now build transformers from scratch in pure Python and NumPy while confronting real deployment constraints through hardware kits. The catch: Despite progress, the framework remains limited to educational scale, with no path to production deployment or GPU acceleration beyond NumPy.

Previously in The Times “covered” — Sep 28

Source: harvard-edge/cs249r_book — based on the README and release notes.

Python SDK gains tighter viewer integration, letting scripts drive the time cursor and trigger live updates without restarting the viewer. These updates strengthen Rerun’s role as a live debugging and training data pipeline for multimodal robotics workflows.
The catch: Video decoding performance depends on the optional nasm feature, which requires external NASM installation and may deter users seeking zero-config setups.

Previously in The Times “covered” — Sep 26

Source: rerun-io/rerun — based on the README and release notes.

js 22.13.0+ and Python 3.10+, with findings stored in SQLite via a separate service container. Recent updates include GitHub Actions and Azure Pipelines workflows for Bedrock scans, improved error reporting for scan failures, and Windows compatibility fixes. It supports drafting SECURITY.md policies and suggests owners for vulnerabilities using Git history.
The catch: The project has 299 open issues and relies on Trusted Access for Cyber for protected findings, limiting accessibility for some teams.

Previously in The Times “covered” — Sep 27

Source: openai/codex-security — based on the README and release notes.

75.0 release improves accuracy in detecting OS package CVEs within container images and reduces false positives in IaC scanning for AWS CloudFormation. Integrations with GitHub Actions and the Kubernetes operator were updated to support SBOM export in CycloneDX and SPDX formats. Trivy remains lightweight, written in Go, and installable via brew install trivy or Docker. The catch: Scanning large monorepos or air-gapped environments still requires manual configuration and may miss transient build-time dependencies.

Previously in The Times “covered” — Sep 26

Source: aquasecurity/trivy — based on the README and release notes.

0 adds automatic refresh of its AI model catalogue over the network at the beginning of each security scan. This ensures the agent uses the latest vulnerability patterns when analyzing source code and executing real exploits against web apps and APIs. The update supports CI/CD integration and maintains the core principle: no exploit, no report. Shannon still requires local execution and relies on browser automation to validate findings.
The catch: Model freshness depends on network access and may fail in air-gapped or restricted environments without manual intervention.

Previously in The Times “covered” — Sep 29

Source: KeygraphHQ/shannon — based on the README and release notes.

7, released September 16, 2026, delivers targeted fixes for Node.js compatibility and command-line reliability. The update ensures Deno.serve correctly extracts traceparent headers regardless of case, addressing distributed tracing gaps. It also prevents duplicated passthrough arguments when using deno deploy or deno sandbox, improving CI/CD workflow integrity. Additional patches honor custom CA stores, fix zsh completion flag formatting, and resolve Linux desktop window close races. Built on V8, Rust, and Tokio, Deno maintains secure defaults while expanding Node.js interoperability. The catch: Despite active maintenance, 1,647 open issues suggest ongoing challenges in stabilizing edge-case Node.js API emulation and permission model consistency across platforms.

Source: denoland/deno — based on the README and release notes.

The browser offloads image decoding and HTTP requests to separate processes, reducing attack surface. Built on SerenityOS-derived libraries like LibWeb and LibJS, it supports Linux, macOS, and Windows via WSL2. Despite active development with commits as recent as today, Ladybird remains in pre-alpha.
The catch: Only suitable for developers due to incomplete features and stability gaps in daily use.

Previously in The Times “covered” — Sep 26

Source: LadybirdBrowser/ladybird — based on the project README.

This update targets broadcasters using WebRTC and SRT protocols, reducing end-to-end delay in live 4K streams by up to 40% compared to software-only encoding. The release also improves HEVC B-frame handling and adds native support for SMPTE ST 2110-22 JPEG XS essence in libavformat, benefiting broadcast over IP pipelines. Builders now leverage ffmpeg -c:v libdav1d -low_delay 0 for sub-100ms glass-to-glass latency in camera-to-cloud workflows. Despite these gains, the AV1 encoder remains experimental for 10-bit 4:2:2 profiles, with color space conversion bugs reported in HDR10+ workflows.
The catch: Real-time AV1 encoding at broadcast bitrates still requires recent Intel Xeon or AMD Zen 4 CPUs, excluding older deployments.

Source: FFmpeg/FFmpeg — based on the project README.

Builders can assemble the controller in floor-standing or table-top mode with basic soldering and woodworking skills. The project includes step-by-step instructions, firmware, and 3D-printable housings for sensor isolation. The catch: Long-term durability of 3D-printed sensor housings under repeated arcade-style impacts remains untested at scale.

Source: ouchitaikoproject/OuchiTaikoProject — based on the project README.

19.0 introduces this via owner-reference detection in nfd-master, alongside configurable owner refs and new x86-64 microarchitecture labels. The nfd-topology-updater also reduces API load by serving per-pod lookups from a node-scoped Pod informer, though it requires updated RBAC for pod list/watch. The catch: Users upgrading only the image without applying new RBAC rules will see crash-loops due to forbidden pod access, creating a subtle upgrade footgun.

Previously in The Times “covered” — Sep 26

Source: kubernetes-sigs/node-feature-discovery — based on the README and release notes.

The shader supports vertex-colored outline width and offset, SDF textures, rim lighting via ramp, and anisotropic specular for hair. Documentation is in Japanese but machine-translatable. Recent activity shows seven open issues and weekly commits, indicating ongoing maintenance.
The catch: The shader avoids platform-specific features, requiring modules for such support, which may complicate cross-platform deployment.

Source: lilxyzw/NonToon — based on the README and release notes.

0, marking seven years of Rust-based 2D and 3D game engine development. The engine includes a built-in scene editor, supports GUI and rendering systems, and lets users run demo projects directly in web browsers. Backed by JetBrains’ open-source license and community funding via Boosty and Patreon, it targets indie and professional developers seeking a native Rust alternative to Unity or Godot. Despite recent activity—last commit one day ago and 59 open issues—the project maintains steady growth with 451 forks.
The catch: While feature-rich, its Rust-only ecosystem may limit accessibility for teams without systems-programming expertise.

Source: FyroxEngine/Fyrox — based on the README and release notes.

13 resolves a stability issue where bridge64.exe and bridge32.exe helper processes remained in Task Manager after forced termination or crashes. The update binds these processes to the main application’s Windows Job Object, guaranteeing kernel-enforced cleanup regardless of how the main process ends. Injected game speed patches remain unaffected as they run inside the target game’s process. The tool continues to adjust game speed via Ring-3 hooking of Windows time functions without kernel intrusion, supporting x86 and x64 Windows 10+ builds.
The catch: Despite clean process termination, using OpenSpeedy in online games risks anti-cheat detection and potential account bans, limiting its safe use to offline or single-player scenarios.

Previously in The Times “covered” — Sep 27

Source: game1024/OpenSpeedy — based on the README and release notes.