Topic
Topic covering how open-source projects fund upkeep, choose licensing models, and sustain long-term development of widely used software.
Cloudflare is acquiring the Deno team, with one year of bug and security fixes committed for the runtime. Anyone building on Deno now has to choose between migrating and backing a community fork.
Reality
OpenSSH 10.6, released October 6, turns off the LZ77 coder in SSH compression to block an attack that reads one channel's secrets from another. Hosts using the Compression option will get less from it, so the project suggests compressing in the application.
Perspective Coverage
5 publishersReality
Dioxus engineers already had code running inside Devin's command line, and they arrive with a cloud harness that snapshots and forks virtual machines on five operating systems. Neither side called it an acquisition.
Reality
Shopify is moving every one of its apps off React Native to native Swift and Kotlin, and rebuilt its Shop app that way in 12 weeks. The switch leaves three Shopify-maintained React Native libraries, including the widely used FlashList, archived or without a maintainer.
Reality
A developer checked npm, PyPI and crates.io for machine-readable funding data using nothing but their public APIs. npm has a declared field whose value arrives in three shapes, PyPI has hand-typed labels, and the sparse index has neither.
Reality
The post's hawks-and-doves model explains why MIT-style terms keep winning. Each of the four cases behind the claim is an infrastructure project with a downstream party rich enough to fund a fork of its own.
Reality
Version 7.0.0 adds a brew vulns command that checks installed packages against OSV.dev and Homebrew's own advisory records. The same release drops Intel macOS 11 and later to Tier 3 and stops building bottles for it.
Reality
Alexander Wang bundled TALA into D2 v0.9.0 and wound Terrastruct down the same week. The engine now costs nothing, and its randomized three-seed search becomes something your repository has to absorb.
Reality
A dev.to post citing Reuters says attackers talked an agent into treating an intrusion as a drill. The trick is old, but it exposes a design question worth arguing about: where refusal is allowed to live.
Reality
Archiving a project with a billion Docker pulls turned an object store into an audit finding. Docker's extended support does not remove the migration, it moves the deadline out to 2031.
Reality