Bookmarks

Open-Source Spotlight — Week of November 8, 2026

Project of the Week

OpenSSH 10.6p2
Released with a workaround, reported by LWN on 2026-11-05, for a flaw that LWN says can let a password login succeed when it should fail; maintainer Damien Miller says the root cause lies outside OpenSSH. Glibc systems, systems using PAM, and non-Linux systems are not affected. Until you have patched, set `PasswordAuthentication no`; Alpine is backporting the fix to every release back to 3.16. Last covered 2026-10-08 for 10.6; back because this one is an active exposure.

Top 5 Trending Repos

Scrapling
A Python scraper that scales from one HTTP request to a pausable, resumable crawl, with a stealth browser fetcher and an MCP server for agents. 99.8k stars, BSD-3-Clause. The base `pip install` leaves out the fetchers, so you need the `fetchers` extra and a `scrapling install` step.
T3 Code
A web, mobile and Electron front end that drives Claude Code, Codex, Cursor, OpenCode and others using your existing subscriptions. 52.3k stars, MIT. The README calls it very early, mostly closed to contributions, and the repo shows roughly 4k open pull requests.
agent-browser
A native Rust CLI that gives an agent a browser one shell command at a time: `snapshot` returns compact page text with element refs, and a click fails loudly if a consent banner covers the target. 47.5k stars, Apache-2.0.
Kronos
Decoder-only foundation models for candlestick data, from 4.1M to 499.2M parameters, with only the three smaller sizes released. 47.3k stars, MIT. The authors say the bundled backtest is a demonstration, not a trading system.
Worktrunk
Manages Git worktrees by branch name so several agents can work in one repo without stepping on each other, and shares `target/` and `node_modules/` caches across them on APFS, btrfs and XFS. 12.1k stars, MIT or Apache-2.0.

Notable New Releases

openSUSE Leap 16.1
Reviewed by The Register on 2026-11-05. The Agama installer now offers a conventional or an immutable install from one image, which retires Leap Micro: there will be no Leap Micro 6.3 or 7.0. Desktops are GNOME 48.8, KDE Plasma 6.6.4 and LXQt 2.4.
Linux stable kernels 7.3.3, 6.18.62 and 6.12.116
Greg Kroah-Hartman released seven stable kernels on 2026-11-06 containing only fixes for three Xen use-after-free bugs, CVE-2026-100080, CVE-2026-100081 and CVE-2026-100082. The 100081 flaw allows privilege escalation. If you run Xen guests with a network backend, update.
GhostBSD 26.2-R15.1p6
Covered 2026-11-03. It sits on FreeBSD 15.1, adds full-disk encryption to a new installer, and ships the XLibre fork of the X server. The Mac-like Gershwin desktop is gone for lack of packaging time.
Bazzite 45
Announced 2026-11-04. The image-based gaming distribution rebases onto Fedora 45 and picks up updated Open Gaming Collective kernels and Logitech TrueWheel support.
Cutefish 1.0
The Register's 2026-11-06 roundup of Mac-style Linux desktops reports that this revived project has reached 1.0 for x86-64 and Arm64, with a compatibility layer called Reef still in progress to run Mac apps.

Community & Ecosystem News

Asahi Linux moves to copyleft
Reported 2026-11-07. The project is relicensing every repository to GPLv2 or later, citing code copied from developers' forks without attribution or rewritten with LLM help to hide its origin. OpenBSD's Bryan Steele objected that prior contributors were not asked. Whether copyleft stops that kind of copying is the open question in the thread.
SUSE to cut about 10% of staff
CEO Dirk-Peter van Leeuwen told staff on 2026-11-02 that "automation and AI" are forcing a reorganisation. The company has about 1,900 people. The fiscal 2027 strategy is due on 2026-11-16, and the openSUSE release above shows the distributions are still shipping.
Octoverse 2026
Published 2026-10-28 and updated 2026-11-06. It counts 17.9 billion pushes and 2.5 billion public contributions, and says agent-started pull requests passed 40% by September 2026. Rust doubled its contributor base in a year. These are GitHub's own numbers.
ACCESSIBILITY.md support
From 2026-11-05, repositories get an Accessibility tab for an `ACCESSIBILITY.md` file, organisation-level inheritance from the `.github` repo, and a default `accessibility` issue label. GitHub warns that naming a WCAG target is not a conformance claim.
Amutable OS
Lennart Poettering, Michael Vogt and Joaquim Rocha published a technical overview, covered by LWN on 2026-11-07, of an image-based OS whose nodes ship without a shell, SSH or Python, and will only activate images signed by a key in the verity keyring. A project commenter says it is not aimed at desktops. The licence was not stated in what I could read.

Hidden Gems

Coldframe
A low-interaction honeypot that poses as a supermarket refrigeration controller, a Danfoss AK-SM 800A or Dixell XWEB 500. It logs credentials and public exploit attempts, and recognises five CVEs. One Python file, standard library only, MIT, 52 stars.
warsaw-vibe-voxel
Central Warsaw as a 3950 by 3150 metre voxel diorama at 1 m resolution, built from LiDAR, OpenStreetMap and city tree registers, with a time-of-day slider and a traffic simulation. Code is MIT, the generated data is ODbL. 45 stars.
LoreKit
Lets a coding agent save the lesson from a bug it fixed, so the next agent on any machine gets it when the same error appears. Recurring lessons can be promoted to permanent rules. MIT, self-hostable, 22 stars.

Developer Tooling Highlights

OmniDiff
A Rust diff tool that compares 25 languages structurally through tree-sitter, and also reports changes in images, archives, fonts and PDFs. `omnidiff git configure` wires it into `git difftool`. 1.3k stars. AGPL-3.0, with a paid commercial licence for internal use.
PR-Agent
Qodo donated the review bot to its own community organisation, where it is now described as a community-maintained legacy project. Docker images moved to `pragent/pr-agent` from 0.34.2, and `/help_docs` has been off since 0.36.1 over a credential-exposure bug. 15.6k stars, MIT. If you pin the old image name, change it.
Spec Kit
A toolkit that puts spec-driven development in front of coding agents, installed with `uv tool install specify-cli`. Bug-fix and idea-assessment workflows are optional extensions. 148.7k stars, MIT. The README warns that catalog listings are not audits.
GitHub's new Git storage architecture
Project Rubicon, started in May 2026, separates compute from storage: packs live in Azure Blob Storage and a replicated reference log handles updates. In GitHub's internal tests it took 7,200 pushes per second to one repository and 5,000 concurrent agents. It is in limited private preview, with a wider rollout planned for early next year.