open-source maintainers

Greg Kroah-Hartman, the longtime Linux kernel maintainer who oversees stable kernel releases, has a talk on software security in the era of large language models. The discussion covers what LLM-generated code means for the kernel's security processes and for maintainers reviewing an influx of machine-written patches.

Sentry, the open-source error tracking and performance monitoring platform maintained by Sentry, is seeing fresh attention among developers. The tool helps engineering teams catch, prioritise and fix crashes and performance problems in production software, and its Python-based repository remains a widely used reference project in the monitoring space.

The maintainer of novelWriter says they are still building packages for Debian 12 and have noticed people keep downloading them, even though the Debian 12 release reached end-of-life a few months ago. They would like to drop support, which would let them move on from Python 3.11, but are weighing that against users who still rely on those builds.

StreetComplete maintainer westnordost reports that the effort to bring the OpenStreetMap surveying app to iOS using Kotlin Multiplatform and Compose Multiplatform has reached roughly 50 percent completion after several months of work. The update gives the open-source mapping community a concrete progress marker on bringing the popular Android app to Apple devices.

Search company Kagi has announced it is stopping development of its Orion browser for Linux and will release the Linux version's code as open source. The move means the Linux community will be able to maintain or fork the browser themselves, even as Kagi concentrates Orion's ongoing development on other platforms. Early reaction online is limited so far, with the announcement just beginning to circulate among developers and open-source enthusiasts.

The Dutch Party for the Animals posted a vacancy for a full-time social media and content specialist for its parliamentary faction, listing Instagram, TikTok, Bluesky and Facebook among the platforms. Mastodon users are questioning why the decentralised network Mastodon is not mentioned, noting the party itself maintains an active account there. The discussion highlights debate over whether organisations should include smaller, open-source platforms in their communications work.

Kagi has announced it is stopping development of its Orion browser for Linux and will instead release the code as open source. The move means Linux users will no longer receive official updates, but the community will be able to maintain and build the browser themselves. Kagi positions the decision as a way to serve Linux users better without continuing costly in-house development.

A maintained fork of ncdu, the NCurses-based disk usage analyser for the command line, is now available on GitHub under rcalixte's account. The project continues the popular terminal tool that lets users inspect and manage disk space interactively, drawing attention from developers interested in open-source command-line utilities.

System76, the Linux hardware and software company, will no longer accept LLM-generated content in pull requests for its COSMIC desktop environment project. The move means code submissions flagged as AI-generated will be rejected. The decision reflects a broader debate in open-source development, where maintainers are increasingly pushing back on low-quality or unreviewable AI-generated contributions flooding their queues.

Version 18.1 of GDB, the GNU Debugger widely used for debugging C, C++ and other compiled programs, has been released. The announcement was made on the GDB mailing list maintained by Sourceware, pointing users to the new stable point release. Developers are sharing the news in programming communities, where the debugger remains a core tool in open-source toolchains alongside GCC.

A software developer has added a continuous integration workflow to their open-source project that automatically rejects pull requests containing commits signed by major AI agents or marked as AI-assisted. The check is shared as a reusable workflow in a separate repository so the blocklists and regex patterns can be updated centrally across projects.

Cloudflare has announced a managed Cloudflare OS, pitched as a company workspace for AI agents that is maintained for customers rather than self-hosted. The announcement, shared on Cloudflare's blog with open-source and AI tags, positions the product as infrastructure for organisations running agentic software without managing the underlying environment themselves. Early response online has been modest so far, circulating mainly among developer and open-source communities.

A modified version of Google's TalkBack screen reader, called Backtalk, is drawing attention in accessibility circles. Built by developer TheQuinbox, the fork takes Google's open-source releases and adds fixes and extra features for blind and visually impaired Android users. The project is hosted on GitHub and is explicitly not affiliated with Google.

An engineer who spent sixteen years at Collabora has announced he is leaving to start his own business focused on software engineering in the age of AI. He is also stepping down as maintainer of WirePlumber, the PipeWire session manager, with Julian Bouzas, who has worked alongside him since 2019, taking over the project.

A vulnerability tracked as EUVD-2026-91330 has been catalogued affecting the Lua component of Apache Thrift, the open-source RPC framework maintained by the Apache Software Foundation. The flaw, scored 8.7 out of 10 under CVSS v3.1, involves allocation of resources without limits or throttling and improper handling of length parameter inconsistency, which could enable denial-of-service conditions.

A developer scanned four popular Python libraries and found documentation quietly drifting out of date: functions gain new parameters over time while the docstrings above them still describe older versions. The observation is resonating with programmers who recognise the pattern, sparking discussion about how open-source projects maintain documentation as code evolves and what tools could catch these silent inconsistencies.

A developer maintains a small open-source calculator that estimates the cost of closing an unexplained gender pay gap. The tool is built in JavaScript and is designed to make zero network calls, so salary data entered by employers or analysts never leaves the user's browser. The privacy-first approach is drawing attention in open-source and HR communities.

A medium-severity vulnerability, EUVD-2026-90763, has been catalogued in Apache APISIX, the open-source API gateway maintained by the Apache Software Foundation. Rated 5.7 out of 10 under CVSS v3.1, the flaw involves the insertion of sensitive information into log files, with unmasked header values potentially being written in cleartext.

A high-severity vulnerability, EUVD-2024-55728, was published for Renovate, the popular open-source dependency update tool maintained by renovatebot. Versions 37.158.0 before 37.199.0 contain a command injection flaw in the helmv3 manager's registryAliases handling, rated 8.4 out of 10 on the CVSS v3.1 scale. Users are being urged to update to a patched release, as the bug could allow attackers to execute arbitrary commands through manipulated registry alias values.