OpenCV 5.0 Ships Its First Major Rewrite in Years for Vision Builders 🔗
The C++ library now targets modern hardware and migrates 4.x code, but Android builds need a separate 16kb-page package.
opencv/opencv · C++ · ▲ 15 in 1dEst. 2012 · Latest: 5.0.0
**OpenCV 5.0.
0** is out, and it is the first major version bump since the 4.x line. For developers building computer vision pipelines, that means a new baseline for the library that underpins image processing, camera tooling and deep-learning inference across desktop, server and embedded targets.
The release centers on a published 4.x-to-5.x migration guide, which signals that the team expects real code to move, not just rebuild. Teams should budget time for that port rather than assume drop-in compatibility.
Platform notes in the release matter for shipping products:
Android: The original SDK was built against an older NDK and its standard C++ library is not aligned for devices with 16kb memory pages. Google Play releases should use the package with the 16kb-page-fix suffix.
Windows on Arm: Binaries are validated on Qualcomm Snapdragon hardware. On devices with private L2 caches, PPL auto-partitioning may fail, and the project recommends building with OpenMP instead.
The library itself is written in C++ and covers classic image processing alongside deep-learning modules, with the project's own opencv.ai services offering commercial support for teams that want it.
Project activity is steady: the last push landed today, and the repository has accumulated 2,840 open issues, a sign of wide use alongside a sizable maintenance queue.
The catch: Open issues at this volume mean fixes and edge-case behavior will take time to land, and the platform-specific caveats above show that 5.0 still needs per-target verification. Check the migration guide and test on your actual hardware before committing a production release.
Why this leads today OpenCV sits beneath much of today's computer-vision work, from factory inspection and robotics to mobile apps and machine-learning pipelines, so its changes reach more builders than any other story on today's list.
Use Cases
Mobile app teams shipping camera features to Google Play on 16kb-page Android devices
Embedded engineers porting vision pipelines to Windows-on-Arm Snapdragon hardware
Existing OpenCV 4.x maintainers planning a migration to the 5.x API
Source: opencv/opencv — based on the README and release notes.
More on the Front Page
Opik Adds Dataset Version Viewing and Tighter Tracing for LLM Teams 🔗
Open-source Apache-2.0 platform traces agent tool calls and evaluates RAG pipelines, now with a fix for multi-decorator async tracing.
Teams building LLM applications need to see what their agents actually did, and whether the output was any good. Opik, the open-source observability and evaluation platform from Comet, covers that loop: tracing, evaluation datasets, LLM-as-a-judge metrics, prompt management and production monitoring, all under an Apache-2.
0 license that permits self-hosting.
The latest release, 2.2.105, lands three changes worth noting. The @track decorator now detects async functions even when they are wrapped by multiple decorators, a common failure in layered codebases where traces silently went missing. Stream logging was also repaired: usage and output are now recorded when a ResponseFailedEvent fires, so failed streaming calls leave a usable record. On the interface side, users can view an earlier dataset or test suite version without restoring it, and the Playground now keeps a prompt loaded even in a session that never opened it.
For builders, the practical value is in the trace tree. Multi-step agents and tool calls appear as nested spans, and feedback scores can be attached to traces through the Python SDK or the UI. A PyTest integration lets teams run evaluations on each commit, turning prompt or model changes into testable regressions rather than guesses.
The catch: The project has 195 open issues and is actively developed, but its surface area is large: tracing, evaluation, optimization, guardrails and dashboards in one platform. Teams that want only lightweight logging may find the self-hosted footprint heavier than they need, and the repository's rapid cadence means integration details, such as framework-specific behaviour, should be verified against the current release before production use.
Use Cases
Backend engineers debugging multi-step agents with nested tool-call traces.
ML teams running LLM-as-a-judge evaluations on RAG pipelines in CI.
Platform teams self-hosting LLM observability under Apache-2.0 licensing.
Source: comet-ml/opik — based on the README and release notes.
Open-Source Tool Strips Bloatware From Android TVs Over Wi-Fi 🔗
Its coding-assistant workflow replaces ad-filled home screens with an Apple TV-style launcher, with nothing uninstalled and one-command restore.
A new open-source project lets anyone remove manufacturer bloatware from an Android or Google TV without root or a cable. Users enable USB debugging, connect over the same Wi-Fi, and hand the job to a coding assistant such as Claude Code.
The assistant backs up installed packages, disables telemetry, ad services and preloaded apps with pm disable-user, then builds and installs a native launcher. Nothing is uninstalled, so a restore script can reverse every step.
The launcher replaces the sponsored home screen with a dark layout: a dock of favourite apps, a top shelf naming the focused app, and a grid of the rest. Version 2.2.0 adds theme support through config.json, optional module cards for third-party apps, and live tile refresh.
The project has 443 forks and 43 open issues, and the latest commit landed this morning. Setup takes roughly fifteen minutes.
The catch: Each TV brand ships different bloat, and the assistant must decide what to disable, so an AI agent with shell access is effectively making judgment calls on a device most owners have never inspected.
Use Cases
Parents wanting ad-free Android TVs without technical configuration needed
Smart TV owners seeking reversible debloating of manufacturer preinstalled apps
Developers customising Android TV launchers through themes and module cards
ly05010419/MacNativeGames is a C project that builds a native Mac app, or an unsigned iPhone or iPad IPA, from a game file the user already owns. Users supply their own The Legend of Zelda: Tears of the Kingdom dump (XCI or NSP) and `prod.
keys`. One script assembles the app locally.
The repository contains no game program, art, audio, or keys. It holds the patch code, the addresses and hashes used to verify files, and a shader list that names shaders and bind states without shader code.
The approach is not an emulator. The game's ARM64 code runs directly on Apple silicon, Switch system services are answered by a small host, and NVN graphics are rebuilt on Metal.
The iOS build requires iOS or iPadOS 26 and an iPhone 14 or newer. Version 1.4.3 has been reported playing on an iPhone 14 and an iPad.
The catch: the project is an independent, non-commercial effort with 12 open issues, and the README says shaders must be precompiled by players, so stutter-free performance depends on community contributions.
Use Cases
Mac owners who bought Tears of the Kingdom wanting native Apple silicon play
iPad users with a legitimately dumped Switch copy seeking a local build
Porting engineers studying NVN-to-Metal translation and Switch service emulation
leanrea drops the MCP server layer that reverse-engineering agents usually depend on. Instead, one 8 KB skill file tells the agent which plain CLI tool is fastest for each target, supplies ready-to-paste recon commands, and lists the traps REA's code previously handled.
The agent then runs the real tools itself: asar, otool, nm, jadx, apktool, tshark, binwalk and others.
In a benchmark of four tasks run through Claude Code headless, leanrea recorded:
38% less wall time than REA
35% lower cost
56% fewer turns
60% fewer tokens, at matching accuracy
Each cell used only three repetitions, on one model and one machine. REA was tested in its best case, with deferred tool loading.
The catch: the sample is small, and the Ghidra and jadx tasks ran on Xcode tools because those were not installed.
Use Cases
Security researchers auditing Electron apps' app.asar code paths quickly
Agent builders wanting reverse-engineering without running an MCP server
Mobile analysts extracting APK and binary details with minimal token spend
The seedds/nxnative project takes an NSP folder and produces an unsigned IPA that can be sideloaded onto Apple devices. It is not an emulator.
The game's own code runs directly on the Apple chip, with Switch graphics rebuilt on Metal.
The pipeline has three main parts:
An NSO rewriter prepares the game's binaries for native execution.
A Horizon host stands in for the Switch operating system's services.
An NVN-to-Metal layer translates Switch graphics calls. Maxwell shaders are converted to SPIR-V by Ryujinx's translator, then to Metal Shading Language via SPIRV-Cross.
Users supply their own game files and prod.keys. The repository contains no game assets. Several projects are credited, including d2r-mobile, Ryujinx, Atmosphère and LibHac.
The catch:The Legend of Zelda: Tears of the Kingdom is still being ported. It reaches the opening cave on an iPhone 15 Pro or newer running iOS 26, and frame rate remains unresolved.
Use Cases
Owners of legally purchased Switch games wanting them on iPhone
Developers studying native execution of console binaries on Apple silicon
Emulation-engine researchers comparing Horizon synchronization semantics against Atmosphère's kernel
Nixpkgs now holds more than 140,000 software packages installable through the Nix package manager. It also powers NixOS, a purely functional Linux distribution where system configuration is declared rather than mutated.
The project's pipeline is what distinguishes it. Hydra, the continuous integration system, builds and tests both the unstable master branch and the NixOS 26.05 release. Successful artifacts are published to cache.nixos.org, and only builds that pass are distributed through Nix channels.
For builders, the practical effect is that a package set can be pinned, rebuilt and rolled back deterministically across machines.
The project's activity is high: the repository records 22,171 open issues and 20,430 forks, with a commit pushed within the last day.
The catch: the sheer breadth of the collection means the backlog is large, and reviewer bandwidth, not code volume, is the constraint on how quickly changes land.
Use Cases
Developers pinning identical toolchains across laptops and CI runners
Sysadmins deploying declaratively configured Linux servers with atomic rollbacks
Researchers reproducing published computational results using fixed package versions
Source: NixOS/nixpkgs — based on the project README.
Open Source Web Stacks Are Collapsing Into Runtimes, Gateways, and Agents 🔗
Projects now ship fused Rust servers, API gateways with AI routing, and scraping-to-API layers rather than standalone frameworks.
The web-framework cluster in this batch looks less like a list of frameworks and more like a map of where the stack is consolidating. Developers are no longer assembling thin libraries; they are adopting runtimes that bundle server, routing, and protocol handling into one native binary.
Several projects show the shift concretely. granian implements a Rust HTTP server purpose-built for Python applications, moving the hot path out of the interpreter. kgateway positions itself as both a cloud-native API gateway and an AI gateway, treating model traffic as just another routed request. maxun turns arbitrary websites into structured APIs, so extraction and monitoring replace hand-written scrapers. ServiceStack continues pushing a single-binary service model in C#.
The common thread is that the boundary between "framework," "proxy," and "agent" is dissolving. Eridanus builds LLM function calling directly into a bot framework, and mlx-serve ships an OpenAI- and Anthropic-compatible inference server in Zig for Apple Silicon, with no Python dependency.
Meanwhile, lynx-family/lynx is extending web-style development to native cross-platform targets, and Pake packages any site as a desktop app with one command.
The catch: Much of this is early. Fused runtimes trade modularity for speed, and AI-routing features in gateways are young, with limited production evidence. Scraping-as-API raises reliability and legal questions that the pattern does not resolve. Treat the consolidation as a direction, not a settled outcome.
Use Cases
Python teams replacing WSGI servers with a Rust-based HTTP runtime for throughput.
Platform engineers routing both REST traffic and LLM requests through one gateway.
Data analysts turning target websites into monitored structured feeds without custom scrapers.
Open Source Data Infrastructure Is Converging on Agent-Ready Stacks 🔗
Crawling, orchestration, databases, and retrieval tooling now ship as integrated pieces aimed at AI workloads rather than isolated analytics.
The projects clustered under data-infra share a common shift: they are being rebuilt around what AI agents and retrieval pipelines need, not around batch reporting alone.
On the ingestion side, getmaxun/maxun turns arbitrary websites into structured APIs with automation and change monitoring, while XiaoYouChR/Ghost-Downloader-3 consolidates multi-protocol transfer into a single Python client.
curl/curl remains the transport layer underneath much of this traffic, now spanning more than two dozen protocols.
Integration and storage are converging too. apache/camel offers 350+ connectors across Java, YAML, and XML routes, and pingcap/tidb now pitches ACID transactions alongside analytics and vector search in one system. supabase/supabase packages Postgres as an application backend for web, mobile, and AI apps.
Retrieval and compute complete the picture. NirDiamant/RAG_Techniques catalogs notebook-level retrieval patterns, while ray-project/ray positions itself explicitly as an AI compute engine rather than a general task scheduler.
The pattern: data infrastructure is being repackaged as a single pipeline from fetch to vector index to agent action.
The catch: Many of these projects are fresh repackagings of established tools with AI framing added. Vector search inside a transactional database, or web extraction driven by LLMs, is still unproven at scale, and the stack is fragmented across languages and licenses. Treat "agent-ready" as a marketing direction more than a settled architecture.
Use Cases
Data engineers building web-to-warehouse extraction pipelines with monitoring and retries.
Startup teams choosing one Postgres-based backend for web, mobile, and AI features.
ML engineers prototyping retrieval-augmented generation pipelines using documented notebook patterns.
LLMs Are Escaping the Chat Window and Becoming Open-Source Infrastructure 🔗
This cluster shows agents now generating films, decompiling binaries, debugging pipelines, and running local inference on consumer hardware.
The newest wave of open-source LLM tooling is no longer about chat interfaces. It is about agents doing concrete, verifiable work inside specialized domains.
decomp.wtf lets an agent decompile games you own into C that recompiles to identical bytes, turning a language model into a reverse-engineering pipeline. huashu-motion has coding agents generate launch films and revise them frame by frame. imozuru packages a Claude Code skill that recursively traces unfamiliar topics back to primary sources.
The plumbing is catching up. mlx-serve offers a Zig-based inference server for Apple Silicon with OpenAI and Anthropic-compatible endpoints, while ray-project/ray and opik address distributed compute and tracing for production agent workflows. agency-agents-zh and Claude-Code-Game-Studios go further, packaging dozens of role-specialized agents with orchestration layers that coordinate them along a dependency graph.
What unifies these projects is the shift from prompt-as-product to agent-as-component, with standardized interfaces such as OneBot-style function calling and API-compatible servers making swaps easy.
The catch: Most of these projects are weeks old, and many multi-agent "studios" have little evidence beyond demos. Role-based agent swarms often multiply token cost and failure modes without clear accuracy gains, and reverse-engineering and bypass tools raise legal questions that the READMEs rarely address. The pattern is real; its reliability is not yet proven.
Use Cases
Indie game developers verifying decompiled code against their owned binaries.
Marketing teams generating and revising product launch videos from prompts.
Mac developers running private, local OpenAI-compatible inference without Python.
Deep Cuts
Eridanus Lets Your LLM Drive a QQ Bot or a Desktop Pet 🔗
Its function-calling layer routes model intent to OneBot actions, and it runs with no QQ account at all.
Eridanus is a Python bot framework built around LLM function calling rather than bolted-on keyword triggers. Models pick which tool to invoke based on conversation context, and the framework executes it through the OneBot 11 protocol, the standard interface most QQ bot stacks use.
It also supports OpenAI and Gemini APIs, so you can swap backends without rewriting your tool definitions. The unusual part is the pure Live2D desktop-pet mode. It skips QQ entirely, giving you a Live2D character driven by the same LLM and tool layer.
For builders, that means one codebase can serve chat platforms and a local companion app. Tool schemas stay in one place. The project is small, with 208 stars and Chinese-first documentation, so expect rough edges. The catch: it is early, niche, and its English-language docs are thin, which keeps it under the radar.
Use Cases
Chinese-speaking developers building QQ group bots with LLM-driven features
Indie makers prototyping Live2D desktop companions powered by OpenAI or Gemini
Framework builders studying OneBot function-calling patterns for their own agents
coop-anythingLets an AI agent turn any single-player game into a co-op experience, with online or splitscreen play, plus tools to reverse engineer, fix, test, and share the changes.515
Summer2027-InternshipsA daily-updated list of Summer 2027 internship postings across software engineering, data science, AI, quant, product management, and hardware.48k
decomp.wtfLets an AI agent decompile games you own into C source that compiles back to byte-identical binaries, running entirely on your own machine.504
lynxA cross-platform web rendering engine aimed at growing a community of contributors who build across platforms.15.2k
Nous Research's hermes-agent, a Python agent that builds skills from experience and carries memory across sessions, shipped v0.22.
2 on October 15, 2026. The release corrects a mistake: v0.22.1 was built from the wrong commit and shipped unreleased gateway work that could leave the Microsoft Store app stuck on "Connecting."
The fixes matter most to anyone running the agent unattended. After a reboot, Linux could hand an early PID to an unrelated process, and the gateway would mistake it for a live instance. Supervised gateways under systemd, launchd or Docker then refused to start. Hermes now records the boot it started in and checks a host lock that only a live gateway holds.
Local-model users get three changes. Requests always stream with prompt-reading progress in the status line. Stall timers ignore time a laptop spent asleep. A recovered local server gets another attempt rather than a circuit breaker that rejects every later message. On Windows unified-memory machines, model launch and the prompt cache are now sized to free memory.
The agent also supports seven terminal backends, including Modal and Daytona, which hibernate when idle. The release does not change that architecture; it hardens the gateway and local paths underneath it.
The catch: Sessions created under the 0.22.1 gateway cannot be deleted in 0.22.2, a known issue with no fix yet. Builders who ran the broken build should expect those records to persist until a later release addresses them.
Supabase, the open-source Postgres development platform, has moved Pipelines into public alpha. The managed change-data-capture service streams database changes to BigQuery in near real time, and teams configure it in the Dashboard rather than building their own replication jobs.
Pipelines is available on all paid plans. Builders who already run analytics in BigQuery can keep operational data in Postgres without writing custom sync code.
The same month brought two other changes. Unified Logs entered open beta with one searchable view across every Supabase service, including live tail and filtering. Sign in with ChatGPT entered beta, letting users authenticate with their ChatGPT account.
Supabase is built from open-source components and has been in development for about seven years, so its core is mature even where individual features are new.
The catch: Pipelines is alpha software, and the release gives no published data on throughput limits or behavior under heavy write load.
Use Cases
Analytics engineers syncing operational Postgres tables into BigQuery continuously
Startups on paid Supabase plans adding warehouse reporting without custom ETL
Platform teams consolidating logs from multiple Supabase services into one view
The transformers library, Hugging Face's model-definition framework, shipped v5.20.
1 with a new model: Beam, from Reflection AI. Beam is a token-efficient, frontier-scale model aimed at coding and agentic work, and it is built to run on a team's own hardware or cloud.
The release also repairs a regression. Model loading broke on older torch versions, and this version restores it. Fixes include:
HunYuan-VL image assignment during batched generation
DeepGEMM Mega MoE under expert parallelism
from_pretrained on torch 2.7, which now requires torch 2.8 or later for distributed checkpointing
DtensorShardOperation on torch 2.6 and 2.7
Users on older PyTorch releases should check their version before upgrading. The library's pivot role means downstream trainers and inference engines inherit these fixes.
The catch: Beam's benchmarks and real-world coding results are not yet independently verified, and the release notes do not say how it compares to existing open coding models.
tesseractRecognizes text in images and scanned documents across more than 100 languages, turning pictures of words into editable, searchable text.77.1k
rayScales Python workloads from a laptop to a cluster, with built-in libraries that speed up training, tuning, serving, and reinforcement learning for ML pipelines.44.1k
RAG_TechniquesWalks through a broad catalog of advanced retrieval-augmented generation methods, each explained in its own runnable notebook, so you can compare approaches side by side.29.9k
open-webuiGives you a self-hosted, browser-based chat interface for local models via Ollama or any OpenAI-compatible API, with multi-user support and document features.156.2k
Data-Science-For-BeginnersTeaches the fundamentals of data science over ten weeks through twenty hands-on lessons, with projects and quizzes suited to complete beginners.37.7k
Kornia v0.8.3 Brings Half-Precision and New Keypoint Models to PyTorch Vision Pipelines 🔗
Release rolls up roughly 175 commits, adding XFeat and ALIKED feature models and cutting `depth_to_normals` runtime about threefold.
Kornia, the differentiable computer vision library built on PyTorch, shipped v0.8.
3 as a patch release rolling up roughly 175 commits since v0.8.2. The release matters most for teams running geometry and feature pipelines on GPUs.
Two new local feature models arrive: XFeat and ALIKED. Both are detectors and descriptors that slot into the library's existing matching stack alongside LoFTR and LightGlue.
Performance work targets core geometry. depth_to_normals runs about 3x faster, while transform_points and denormalize_points_with_intrinsics each gain roughly 2x. These are the operations that dominate robotics and spatial-AI loops.
Half-precision support is now tested end to end. The CI suite runs in both float16 and bfloat16 against strict known-failure manifests, so mixed-precision training no longer depends on untested paths.
Other changes include batched inference for VisualPrompter, MPS device fixes, and ONNX export corrections. Several utilities in kornia.utils now emit DeprecationWarning ahead of removal, so downstream code should be checked before upgrading.
The catch: the project carries 152 open issues, and the half-precision guarantees rely on known-failure lists that are still being trimmed. Teams deploying float16 in production should run their own numerical checks rather than assume parity with float32.
Jumper, a 22-degree-of-freedom crab robot from KingKong Robotics, now ships with an AI toolkit for shaping how it looks, moves and where it operates. The repository is designed to be opened in an AI coding assistant, which then works through guided prompts.
Builders can:
Design a sand ranger appearance with coordinated body and limb colors, exported as a .skin file.
Train a stable tripod gait, replay and evaluate it, then package it as an .app.
Generate a park pump-track scene with rolling terrain, trees and benches, exported as a .map.
Training runs on mjlab, rsl_rl, MuJoCo and MuJoCo Warp, so the simulation-to-behavior pipeline is built from established open tools rather than proprietary stacks.
The project has drawn 295 forks and carries nine open issues, with its last commit a day old.
The catch: the toolkit is only useful alongside the physical Jumper hardware, and generated outputs do not inherit the repository's Apache-2.0 license, so builders must check third-party terms before reuse.
Use Cases
Robotics students training gaits for a 22-joint crab platform in simulation
Hobbyist builders designing custom skins and colorways for physical crab robots
Simulation researchers creating outdoor terrain scenes for legged-locomotion experiments
0, pushes its open-source driving stack toward faster, more reproducible builder workflows.
Notable changes include:
NVIDIA Thor support on JetPack 7 and SBSA CUDA 13, covering both Jetson and DRIVE hardware.
autoware_simple_planning_simulator, added to autoware.repos for testing planning logic without a full vehicle stack.
Dev containers migrated to docker-compose, with GUI forwarding, and runtime dependencies baked into devel images.
A version_lock Ansible role to pin dependencies for repeatable installs.
Diffusion planner v5.0 model files and directory structure.
The project is ROS 2-based and built from source through Docker and Ansible. Its 79 open issues and an active commit history suggest steady maintenance.
The catch: Thor and CUDA 13 support depends on NVIDIA's newest hardware and JetPack releases, so teams on older platforms will need to stay on earlier versions.
Use Cases
Robotics teams testing planning logic in simulation before vehicle trials.
Hardware engineers deploying Autoware on NVIDIA Thor-based compute platforms.
Developers standardizing reproducible autonomous-driving dev environments across machines via Docker.
Groki Bot is an open-source desktop robot built on an M5Stack CoreS3 with a Stack-chan base. Its C++ firmware and computer-side gateway connect the device to agents in the Grok Bot app.
On macOS, the gateway uses the app's existing login, so no separate xAI voice API key is needed. Users can wake the robot by saying "Hi Grok," handled by local voice detection. Dual-axis servos track the user's face through the Mac camera.
Firmware v0.2.2 fixes a gateway bug in which stale Gemini Live sessions left the robot silent until restart. The gateway now starts a fresh session instead. Boards can be flashed from Chrome or Edge, with later updates delivered over Wi-Fi.
The catch: the project is young, with 13 open issues and a 0.2 version line, and Gemini remains the default backend unless builders reconfigure it.
Use Cases
Hobbyists building a voice-driven desk companion on an ESP32 device
Mac developers prototyping hands-free agent interfaces without separate API keys
Robotics students experimenting with servo-driven face tracking and expressions
drakeVerifies robot designs before they're built by simulating dynamics, contact, and control, so engineers can catch failures in software first.4.2k
ogreProvides a high-performance 3D rendering engine with bindings for C++, Python, C#, and Java, suited to games and visualization.4.7k
rtabmapBuilds 3D maps in real time from RGB-D and lidar sensors, with loop closure for long-term localization and mapping on robots.4k
cq-picsearcher-botA Chinese-language bot that finds the source of an image by querying SauceNAO, ascii2d, and trace.moe, handy for anime and art lookups.1.6k
ardupilotShips the flight control firmware for planes, copters, rovers, and submarines, letting one open codebase steer many autonomous vehicle types.16.1k
OpenCTI Adds Entity Merging and Defanged Search to Threat Intel Platform 🔗
Latest release lets analysts merge duplicate entities in the knowledge view and search defanged indicators directly, cutting manual cleanup in STIX2-based threat graphs.
OpenCTI, the open source platform for managing cyber threat intelligence, has shipped release 7.261016.
0 with changes aimed at analyst workflow rather than infrastructure. The most consequential addition is the ability to merge entities in the knowledge view, letting teams consolidate duplicate threat actors, malware families, or indicators that accumulate when data arrives from multiple feeds.
Global search now accepts defanged terms, so an analyst can query an address written as hxxp:// or example[.]com and still find the underlying observable. Attack Pattern Matrix views gained expand-all and collapse-all controls, and description fields on intrusion sets, malware, and tools received a layout pass.
The release also tightens the plumbing. Renovate dependency updates are now constrained to supported runtime and service versions, and a nested-object mapping conflict affecting same-named fields has been addressed. An artifact import fix rounds out the bug work.
Built in TypeScript on a STIX2 knowledge schema with a GraphQL API, OpenCTI targets security operations and CTI teams that need to link every observable and TTP to its primary source, with first-seen and last-seen dates and confidence levels. Connectors cover MISP, TheHive and MITRE ATT&CK.
The catch: The project carries 2,203 open issues, and the most recent release is largely incremental. Teams should check whether the merge and mapping changes behave correctly against their own data before relying on them, and weigh which features sit in the Community Edition versus the Enterprise Edition.
Quivr, an open-source engine written in Go, now targets continuous content streams rather than static document sets. Its V2 design makes three promises: a write is acknowledged only once committed, so outages delay content rather than losing it; text becomes lexically searchable as soon as it is segmented; and embeddings arrive later without blocking that search.
Key design points:
Idempotent writes: each write carries a key, replays return the same result, and corrections create new immutable Versions.
Hybrid search: keyword results stay live while vectors rebuild, and affected Corpora are reported.
Rebuildable indexes: PostgreSQL and S3 hold canonical data, with the search index treated as a projection.
Latest release core-0.0.33 added a Zendesk workflow connector and a CLI fix. The project itself is at evaluation stage, and its API is v0 and may change without notice.
The catch: The project's own README says not to run it in production yet, and the API may change without notice.
The projectdiscovery/nuclei scanner's latest release, **v3.11.
1**, makes its Lua scripting more flexible. Scripts can now accept arguments and values, letting one template handle varied targets without duplication.
A separate fix lets thread-safe library scans reuse a single metadata cache. That matters for teams embedding Nuclei in their own Go services, where repeated metadata loading slows parallel runs.
The release also adds a gRPC JavaScript library, widening how non-Go tooling can drive the engine. Dependency bumps across the modules and workflow groups round out the changes.
Nuclei is written in Go and built on YAML templates, so these changes touch both template authors and integrators.
The catch: the project carries 142 open issues and is explicitly in active development, so breaking changes between releases remain likely; review the changelog before upgrading.
The DVWA project, a deliberately insecure PHP and MariaDB application, now includes a module for practicing attacks against OpenAPI-described interfaces. Version 2.
5 adds the capability to test vulnerable APIs alongside its existing web exercises.
The app has long served as a legal sandbox for security professionals and students. It covers common flaws such as SQL injection across multiple difficulty levels, with both documented and undocumented weaknesses left in on purpose.
The new module matters because APIs now carry much of the traffic that web applications once handled alone. Learners can probe endpoints defined in OpenAPI specifications rather than only browser-facing forms.
Maintainers stress that DVWA must run in an isolated environment, such as a virtual machine on NAT networking. Exposing it to the internet invites compromise.
The catch: The project has 8 open issues and the API module is a fresh addition, so its coverage of real-world API flaws is still unproven.
Use Cases
Security students practicing SQL injection on a controlled local server
Penetration testers rehearsing tool workflows against intentionally vulnerable web targets
Developers learning how insecure API endpoints fail before securing their own
Source: digininja/DVWA — based on the README and release notes.
Quick Hits
web-checkRuns a broad set of passive and active reconnaissance checks on any website, from DNS and SSL details to tech stack and security headers, in one place.35.2k
juice-shopA deliberately vulnerable web app covering the full OWASP Top 10 and beyond, letting you practise real exploits safely on modern tooling.14.2k
CheatSheetSeriesConcise, practical guidance on specific application security topics, from authentication to input validation, ready to drop into your development workflow.33.7k
PROXY-ListContinuously refreshed daily lists of public proxies, useful for testing rotation logic or geographic routing, though verify each before relying on it.5.9k
mitmproxyIntercepts, inspects, and modifies live HTTPS traffic through an interactive terminal or web interface, ideal for debugging APIs and assessing app security.45.7k
ClickHouse Ships Release 26.8 as Real-Time Analytics Stays Open Source 🔗
The column-oriented engine now runs as a managed service and self-hosted cluster, with LTS builds for production teams.
ClickHouse, the column-oriented database for real-time analytical reporting, has moved its latest long-term support line to **v26.8.
31.2-lts**. The project continues to pair its open-source engine with ClickHouse Cloud, a managed offering run by the core maintainers, so teams can choose between self-hosting and a hosted service on the same codebase.
The engine is written in C++ and built for scans and aggregations over very large tables. Data is stored by column, so queries read only the fields they touch. That design is why it is used for log analytics, event pipelines and observability backends where users expect answers in seconds rather than minutes.
Recent activity is concentrated in the release cadence. The team ran release calls for 26.7, 26.8 and 26.9 this summer and autumn, and it is publishing a steady stream of meetups and hands-on training, including agent observability sessions with Langfuse. The lakehouse and ai topics on the repository reflect a push toward querying data-lake formats and feeding analytics into agent workflows.
For builders, the practical signal is the LTS tag. An LTS line gives a fixed upgrade path for teams that cannot absorb monthly changes, which is the main reason to choose it over the latest feature release.
The catch: The repository carries 8,503 open issues, a large backlog for a project of this scale. Teams should check whether the bugs affecting their workload are fixed in the LTS branch rather than assuming the release tag resolves them.
Developers running coding agents pay for every token their tools dump into context. rtk sits between the shell and the model, filtering and compressing command output before it reaches the agent.
The project claims 60-90% reductions on common developer commands.
The latest release, v1.0.1, is a patch. It makes llm-proxy start and the agent launchers honour RTK_PROXY_BIND, so proxy bindings work as configured. It also stops suggesting rtk pipeline share where that command does not exist.
Compression runs in four ways:
Smart filtering strips comments, whitespace and boilerplate.
Grouping aggregates files by directory and errors by type.
Truncation keeps relevant context and cuts redundancy.
Deduplication collapses repeated log lines into counts.
Hooks fire only on Bash tool calls, so built-in Read and Grep tools bypass the filter.
The catch: the project carries 1,542 open issues, and another crate named rtk on crates.io is not this one.
5** release of whisper.cpp is a maintenance update. It bumps the project to ggml v0.26.0 and syncs the underlying ggml tensor library.
The changelog is mostly backend work. Recent commits fix a Vulkan Flash Attention out-of-bounds write, optimize CUDA kernels for NVFP4 accumulation, and add Q8_0 kernels for SpacemiT X60 RISC-V chips.
For builders, the practical effect is a steadier path for running Whisper on local hardware:
Apple Silicon users get Metal and Core ML paths
NVIDIA and AMD users get CUDA and ROCm support
Edge devices benefit from CPU-only and quantized inference
The catch: the project has 353 open issues, and the release notes are a long list of upstream syncs, so builders should test their own hardware before depending on a specific backend.
Use Cases
Mobile developers embedding offline speech-to-text inside iOS and Android apps
Hobbyists building fully local voice assistants on Raspberry Pi hardware
Teams transcribing sensitive audio on-premises without sending data to cloud APIs
codegraphBuilds a pre-indexed code knowledge graph that auto-syncs as your code changes, cutting token use and tool calls for AI coding agents, all running locally.74.4k
PakeConverts any website into a lightweight desktop app with a single command, working across macOS, Windows, and Linux.62.2k
llama.cppRuns large language model inference efficiently in plain C and C++, making local LLM deployment practical on modest hardware.131.7k
codexPuts a lightweight coding agent right in your terminal, letting you delegate programming tasks without leaving the command line.129.9k
zedOffers a high-performance, multiplayer code editor built for speed, from the team behind Atom and Tree-sitter.91.9k
claw-codeExplores an experimental agent-managed codebase in Rust, developed and maintained entirely without human intervention.194.9k
Open-Source Rust Firmware Turns a Cheap Dongle Into a FIDO2 Security Key 🔗
Google's OpenSK runs on commodity nRF52840 boards, and its CTAP 2.0 build has passed FIDO Alliance certification.
OpenSK is Google's open-source firmware for hardware security keys, written in Rust and supporting both FIDO U2F and FIDO2 (WebAuthn) standards. Security keys are the physical devices that sign users into websites, and OpenSK lets builders inspect and modify the code that runs on them.
The project's most concrete recent milestone is its certified baseline. The release notes say the CTAP 2.0 firmware certified by the FIDO Alliance runs on the Nordic nRF52840 dongle, with only bugfixes applied since that do not alter CTAP2 behavior. Builders can therefore study a certified implementation rather than a black box.
The develop branch tracks the latest CTAP specification but is not certified and is less rigorously tested. Work is ongoing to use the ARM CryptoCell-310 inside the nRF52840 for hardware-accelerated cryptography. Until then, OpenSK relies on the RustCrypto libraries.
Supported hardware includes the nRF52840-DK development kit, the nRF52840 Dongle, the Makerdiary nRF52840-MDK, and the Feitian OpenSK dongle. OpenSK can also run as a Wasefire applet or as a library. Non-discoverable credentials created through either U2F or FIDO2 work with the other protocol.
The catch: The project describes itself as a proof of concept and research platform, not an officially supported Google product, and it is not meant for daily use. The develop branch is untested against the certified build, and the project shows 15 open issues. Builders should treat it as a platform for experimentation, not a drop-in replacement for commercial keys.
ESPectre 3.0 separates its sensing engine, runtime and frontend, letting Wi-Fi motion detection run inside other ESP32 firmware rather than only as a standalone device.
The release folds three release candidates into one stable version.
The main change is the francescopace/espectreC++ SDK, published on the ESP Component Registry. It requires C++17 and ESP-IDF 5.5.3 or later; ESP-IDF 6.x is build-validated only.
Other changes:
Standalone Native firmware adds Direct HTTP, MQTT, Home Assistant discovery and HTTPS OTA.
A Matter occupancy-sensor frontend reports motion, though its builds are uncertified and lack Matter OTA.
Timestamp-based sampling replaces packet-count windows, so missing slots stay explicit.
Detection runs on-device from channel state information, with no cloud dependency.
The catch: the project has 14 open issues, and 3.0 ships the Matter frontend without certification or OTA updates, so builders should test before deploying.
1, sharpens the firmware's wireless tooling. It now detects WPA3-PSK and mixed WPA2/WPA3 networks, a gap that matters as more access points move off WPA2.
Other changes target reliability rather than new features:
BLE spam gains Samsung OUI entries and receives fixes on the ESP32-C5, which previously crashed when running BLE functions.
Brucegotchi now captures handshakes correctly after a refactor.
SSH and Telnet no longer crash when accessed while disconnected, and non-keyboard devices work correctly.
NetCut now affects multiple targets, not just one.
The project runs on M5Stack, LILYGO and other ESP32-S3 and C5 boards, and the release ships binaries for flashing via esptool.py or M5Burner.
The catch: the project carries 240 open issues, and the offensive-security scope means every fix is also a capability upgrade for anyone who runs it, so adopters should confirm their use is authorized.
IceNav-v3 turns an ESP32 into a standalone GPS navigator that draws OpenStreetMap data from the device itself, so no phone or cellular link is needed in the field.
The project supports multi-constellation GNSS receivers and two map formats: large rendered tiles and smaller vector maps.
Builders get the best performance on an ESP32-S3 or ESP32-P4 with PSRAM and a 320x480 display, though SPI screens also work.
The latest release, v0.3.3, is a modest step. It adds an alternative Docker-based builder and resolves issue #398. The ESP32-P4 with ESP32-C6 pairing has a known problem: enabling WiFi while an SD card is mounted can trigger reboots. The root cause sits in upstream ESP-Hosted firmware, and the documented workaround is to disable WiFi.
Build configuration lives in platformio.ini, and ESP32-S2 support has been dropped because of IRAM limits.
The catch: the project is still marked experimental, with features on a devel branch and 27 open issues, so builders should expect rough edges.
Use Cases
Hikers needing offline navigation without phone coverage or subscriptions
Makers building custom GPS trackers on ESP32-S3 or ESP32-P4 boards
Embedded developers studying LVGL and LovyanGFX with real-world map rendering
detect-gpuClassifies a device's GPU from its 3D rendering benchmark score, so developers can pick sensible default graphics settings for demanding applications.1.2k
aa-proxy-rsActs as a wired or wireless proxy for Android Auto, letting you connect the head unit to a car system without a phone-native integration.494
TYPE-2A touch-sensitive polyphonic synthesizer on an ESP32-S3 that reads capacitive touch to play expressive, multi-voice sound.49
glasgowA multi-tool hardware hacking platform that lets you probe, interface, and debug electronics through one reconfigurable Python-driven device.2.2k
maker.jsGenerates 2D vector line drawings and shapes from code, ready for CNC machines and laser cutters.2k
Godot Party Brawler Starship Olympics Adds Keyboard Fallbacks After Player Lockouts 🔗
Latest release lets player one use SPACE or ENTER alongside M, fixing a selection-screen trap in the GDScript arcade game.
Starship Olympics, a free and open-source local multiplayer arcade game, is built in GDScript on Godot 4.4.
x. Players pilot aliens in a top-down 2D arena, with one to four players sharing a keyboard or controllers.
The newest release, v0.14.1, is a narrow fix. Player one's keyboard controls now accept SPACE and ENTER in addition to M. Players were getting stuck on the player selection screen because the original key choice was not obvious.
The fix matters for builders because it shows how small input decisions can block a party game's first thirty seconds. The project's control scheme is deliberately minimal: single-button inputs meant to be understood immediately. That design only works if the bindings are discoverable.
The game's modes are solo, versus, and co-op, with a stated goal of more than twenty mini-games. Most of that roster is still in development. Assets are licensed CC BY NC SA, which limits commercial reuse. The repo has 144 open issues, and the project is active, with its most recent push in October 2026.
The catch: The roadmap of twenty-plus games is aspirational. The current build is a single-release, early-stage project with a large open-issue backlog, and its non-commercial asset license rules out most product use without replacing the art and audio.
The open-source project Donchitos/Claude-Code-Game-Studios gives Claude Code a studio structure. Instead of one general assistant, builders get 49 specialized agents arranged in three tiers: directors who guard the vision, department leads who own their domains, and specialists who do hands-on work.
The v1.2.0 release reworks the main path. /create-stories now proposes S, M or L estimates, and stories list the files they touch so /story-done can flag changes after evidence was captured.
A read guard refuses whole-file reads of design docs over 40 KB, returning headings so the retry reads a single section.
Engine references now target Godot 4.7 and Unreal Engine 5.8.
Skills no longer pre-approve every shell command.
Support covers Unity, Unreal and Godot agent sets. The project has 67 open issues and roughly 4,000 forks, so its maintenance load is visible. The catch: the agent hierarchy is a fixed opinion about how a studio should run, and solo developers who want less process will have to customize it heavily.
Use Cases
Solo indie developers wanting design reviews before writing gameplay code.
Small teams tracking game stories with estimates and file-level scope.
Godot or Unreal developers enforcing design docs through Claude Code sessions.
The C library raylib, now 13 years old, shipped version 6.2 after nearly six months between releases.
The update began as a small CMake fix but grew into more than 300 changes.
The headline change is an Image drawing API realigned with the Texture API. Most GPU-accelerated Texture functions now have CPU-side Image counterparts that take the same parameters in the same order. Code written for one path is easier to port to the other.
Other changes:
20 new functions, bringing the API to 619
10 new examples, for 225 total
Renamed parameters, const-correctness fixes and reordered API entries
The library targets prototyping, tooling and embedded work, with no external dependencies and a software renderer that needs no OpenGL.
The catch: the project has 10 open issues and the API has grown to 619 functions, so teams should check that the redesigned Image calls behave as expected before migrating existing code.
Use Cases
Indie developers prototyping 2D and 3D games in plain C
Embedded engineers drawing graphics on ESP32 and Raspberry Pi hardware
Educators teaching game programming without heavy engine tooling
Source: raysan5/raylib — based on the README and release notes.
Bevy Ships v0.20 With Breaking Changes Builders Must Plan For 🔗
Rust game engine's quarterly API churn continues as release diff spans v0.19.1 to v0.20.0
0** is out, and the release diff from v0.19.1 is where builders should look first. The engine's maintainers say a new version with API breaking changes lands roughly every three months, so upgrades are a recurring cost rather than a one-time event.
The engine itself is unchanged in pitch: a 2D and 3D toolkit built on an Entity Component System, written in Rust. What's new is the release cadence and the migration work it implies. Projects pinned to bevy need to budget time for each bump.
Migration guides ship with each release.
The project tracks the latest stable Rust compiler closely.
Last commit landed the same day this data was pulled.
The catch: the project carries 3,531 open issues and its own README warns that documentation is sparse and important features are missing.
Rust developers prototyping 2D games with an ECS architecture
Indie teams building 3D prototypes who accept frequent API migrations
Engineers evaluating data-oriented engines for parallel game logic
Source: bevyengine/bevy — based on the README and release notes.
Quick Hits
enttEntity component system and utility library for C++ that delivers fast, reliable game architecture alongside a broad set of supporting tools.13.2k
o3deA free, Apache 2.0-licensed multi-platform 3D engine for building AAA games, cinema-quality worlds, and high-fidelity simulations with no fees attached.9.8k
VulkanWorking C++ examples demonstrating how to use the Vulkan graphics API, from basic rendering setup to more advanced techniques.12.2k
WickedEngineA 3D engine built around modern graphics techniques, suited to developers who want to study or build on contemporary real-time rendering.7.3k
learn-gdscriptA free, browser-based course that teaches Godot's GDScript language from scratch, so beginners can start coding without installing anything.2.8k
The Git Times AI Desk
Ask about today's stories — or hit “Ask about this” on any article to focus on one.
Unlock the Git Times AI desk to ask about today's stories and the AI model market.