Recent funding, licensing, foundation, and monetization news from across open source.
The Fresh terminal editor merged a move from GPL-2.0 to GPL-3.0-or-later, saying Apache-2.0 dependencies were incompatible with GPL-2.0 and that GPL-2.0 has no or-later clause. Because 5 of 41 contributors had not replied to the consent request, their code was removed rather than blocking the change, and the maintainer said the removal is reversible for anyone who responds later.
Base Browser is assembling a Firefox hard fork as a set of patch sets applied on top of a Firefox ESR 153 base, describing its aim as stripping out 'people-hostile' features and keeping the browser developed and maintained by humans so it can serve as a base for a wider browser ecosystem. The repository currently ships patch sets such as purge-ai and purge-newtab and presents itself as a first step toward organizing the contributors who would maintain the fork.
The Reticulum-Go networking implementation moved from Apache-2.0 to the custom Reticulum License, the same permissive-but-conditional license its upstream Python stack adopted, which forbids use in systems designed to harm people and in AI or machine-learning training datasets; the project's earlier MIT, 0BSD, and Apache-2.0 revisions keep their original terms.
Pipelex v0.58.0 switches the Python AI-pipeline framework from MIT to the Elastic License 2.0, a source-available license that still allows embedding the software in products and internal tools but bars hosting a service that runs other parties' methods; releases through v0.57.0 stay MIT.
Portainer CEO Neil Cresswell announced that 3.0 is a Kubernetes-first, enterprise-focused release with no Community Edition build: CE stays on the 2.x codebase with 2.45 LTS as the final line, CE 2.45 LTS keeps receiving security and bug fixes for as long as the matching Business Edition LTS is supported, and the free route into 3.x becomes the Business Edition 3 Nodes Free program, while existing Docker functionality remains and any future removal would come with advance notice and a migration path.
The basefoundry/base v1.9.0 release notes record a prospective relicense to Apache-2.0 to reduce adoption friction for companies with copyleft-averse license review, note that earlier MIT and AGPL releases keep their original licenses, and say new repositories initialized by the CLI now default to Apache-2.0.
Chester Wisniewski argues that generative AI is eroding the copyright-and-copyleft equilibrium that made open sharing work: models ingest code and content without regard for licenses, derivative works may not carry the originals' terms, and enforcement has not materialized, so the social contract behind GPL, MPL, and CC-SA is broken. He says authors now have an incentive to close their work while AI-generated pull requests and poisoned dependencies make publishing and maintaining open source riskier, and calls for a new digital Renaissance before a digital dark age sets in.
Fervor AI reports that the supermemoryai/supermemory repository carries a plain MIT LICENSE while the server-v0.0.7 release notes limit the self-hosted edition to 10,000 documents under separate terms enforced at the API, showing how dual-licensed infrastructure can place licensing limits outside the repository's license file.
The Omacom Foundation welcomed Brian Cartmell as a Distinguished Patron with a $100,000 contribution and American Cloud with $25,088 for the year, created a new $25,000 corporate tier, and said open patronage has doubled to more than $120,000 from 826 patrons since the last count.
The Papermerge document-management maintainer says he is focusing development entirely on the commercial Papermerge Cloud SaaS, will stop adding features to the Apache-2.0 self-hosted edition, and is looking for maintainers willing to take ownership or a repository transfer, planning to archive the OSS repository if nobody steps up within 30 days.
NixOS Steering Committee member Christina Emilie Sørensen published her account of stepping back from the project's moderation rebuild, arguing that structural governance and engagement problems remain unresolved and that mechanistic fixes will not address them, releasing the statement after the Nixpkgs core team resigned.
SciActive published version 2-NE of its Human Contribution Policy, a reusable policy that requires all contributions to be human-authored and rejects AI-generated material to limit legal, security, and trust risks, and that the company applies to its own open-source projects.
The Omacom Foundation says it has committed $13 million and will spend everything raised in 2026 over the next three years, with annual budgets above $4 million for 2027 through 2029 to fund the open-source projects, developers, artists, grants, competitions, and infrastructure behind Omarchy.
Linuxiac reports that the Nixpkgs core team disbanded after about ten months, citing unsustainable workload and health impacts, unsuccessful recruitment, and persistent governance friction with the NixOS Steering Committee, leaving its responsibilities without a direct owner while the Steering Committee remains the backstop.
The Handmade Network adopted a new AI policy that bans unread vibe-coded work and AI-generated prose, requires projects to disclose AI use, and bars AI code generation from showcase posts with narrow exceptions, citing long-time members' frustration with AI slop in the community.
Wired reports that while AI labs debate pacts to slow frontier development, widely available AI tools are already helping uncover a flood of security flaws, leaving open-source maintainers to validate and patch findings as AI-assisted and AI-generated reports strain triage capacity.
The maintainer of the Auto Job Applier project documented an August 2026 relicense from AGPL-3.0 to MIT, saying third-party contributions were removed or independently reimplemented and that the per-provider AI connectors were replaced with a provider-agnostic layer so the current tree contains only work authored by the project owner.
A Wall Street Journal opinion piece pushes back on the 'rogue AI' framing of the Hugging Face incident, arguing the agents were carrying out human-programmed objectives rather than rebelling on their own, and faults coverage that turns qualified AI-risk warnings into claims of consensus.
Ruby Central looks back at Ruby Shield, the four-year, $1 million partnership with Shopify that funded security and reliability work on RubyGems.org, citing trusted publishing, verifiable releases, and around-the-clock coverage before the program closed in June, and points to the Ruby Alliance as the next vehicle for sustained support.
In an API Evangelist conversation, former AsyncAPI executive director Lukasz Gornicki says the Linux Foundation supplied intellectual property and trademark protection but no engineering funding, and that one sponsor declined to renew specifically because AsyncAPI was part of the foundation, as he argues a project is better served by a separate organization such as Open Source Europe.
TYPO3's Governance Working Group published revised Rules for TYPO3 Units and the Unit Cooperation Panel after a public review closed on September 6, adding explicit council votes on admitting and removing members and direct power to recall coordinators, ahead of an extraordinary General Assembly on October 29.
ITPro reports that the Swiss government is trialling OpenDesk, the German-built open-source office suite backed by the Sovereign Tech Agency, as a sovereignty and resilience alternative to Microsoft 365, adding to European public-sector moves toward vendor-independent workplace software.
At HUAWEI CONNECT 2026, Huawei said it has open-sourced end-to-end agent tools for Ascend, including CANNBot, Model Agent, MindStudio Agent, and Solution Agent, opened ThinkProcess APIs in openEuler, and will invest CNY5 billion over three years with universities and partners to grow an open-source computing ecosystem.
Dawn Foster previews a talk on the open-source leadership gap, arguing that burnout, retirement, and stalled succession are leaving projects without enough new leaders, and outlining inclusive leadership, documented contributor ladders, role definitions, and term limits for boards and steering committees as fixes.
RuntimeWire reports that Nicolas Krassas's team abandoned its AI-security startup plans and released the underlying local-first red-team engine as OpenHunterAI, an alpha for testing web, API, and LLM applications that ships under the source-available PolyForm Noncommercial license with separate commercial licensing, keeping a path back to paid use while the code reaches developers.
JumpMind's SymmetricDS 3.18.0 release notes say the open-source database-replication project is re-licensed from the GNU GPL to the GNU Affero GPL v3 effective September 1, 2026, extending copyleft to network use while the separately licensed SymmetricDS Pro stays a commercial option alongside Java 21 support and OpenTelemetry metrics.
A source audit of openocta/openocta finds the AIOps agent's root LICENSE went GPL-3.0, then Apache-2.0 on July 10, then back to GPL-3.0 in a September 16 commit, while the English and Chinese READMEs, the Windows installer, and the project website still describe Apache-2.0 licensing, leaving adopters to reconcile conflicting terms.
Creative Bloq reports that OpenAI's Astra launch advert, in which the agent models a rocket in Blender, angered Blender users who objected to the community-driven open-source 3D tool being used to suggest human artists are superfluous, with the artist behind Blender 5.2's splash-screen Puma objecting to her work appearing in the promotion.
The Register rounds up the browsers forked from Mozilla's code as Firefox 156 and Thunderbird 156 ship, noting that this release adds Mozilla partner ads to localized Wikipedia suggestions, and pointing users who object to the fortnightly release pace or Mozilla's AI and advertising direction to alternatives such as Waterfox, LibreWolf, Floorp, Zen, Pale Moon, Basilisk, SeaMonkey and Betterbird.
Google and Speakeasy released Speakeasy's OpenAPI client-generation suite under AGPLv3, covering multi-language SDK generators, an agent-native CLI generator, and a documentation MCP server generator, after the proprietary SDK vendor Google had relied on was acquired and abruptly shut down, with generated code left under the developer's own license.
RuntimeWire reports that a September 14 SEC Form D shows Firecrawl sold about $82.06 million of preferred stock to seven unnamed investors, 5.7 times its 2025 Series A, as the open-source web-scraping, search, and crawling project, now around 180,000 GitHub stars, tries to convert self-hosted adoption into enterprise revenue.
tante.cc responds to Laurie Voss's proposal to force companies to pay for open source through package registries, arguing it treats free software mainly as an underpaid startup and big-tech supply chain and overlooks desktop, distribution, and infrastructure projects that never pass through npm or PyPI, and asking what kinds of software and structures the community actually wants to fund.
OpenAI's Charlie Marsh said Codex for Open Source is being renewed for a second round with $100 Pro plans and double the grants, from 5,000 to 10,000 maintainers, inviting previous recipients to reapply for six months of Codex access and API credits.
GNOME Foundation interim executive director Allan Day's update covers the new board and officer slate after a contested election, the hiring of a Finance and Operations Director, approval of the FY27 budget, and a year-end fundraising campaign he calls critical to the Foundation's ability to grow its support for the GNOME project.
The Innovation Attorney examines Software Freedom Conservancy v. Vizio, in which the Conservancy sues as a device purchaser rather than a copyright holder to enforce GPL source-code obligations, tracing how a plaintiff win would widen GPL enforcement to ordinary customers while the EU Cyber Resilience Act and CISA's SBOM baseline pull license inventory into routine compliance.
TechCrunch reports that Automattic named WordPress VIP CFO Jeremy Klaperman as interim chief financial officer and that a chief legal officer candidate verbally accepted, after CFO Mark Davies and legal chief Andy Missan left following the failed board attempt to oust CEO Matt Mullenweg, with new board members yet to be named.
W3C began the first pilot of a program to support open source software projects, aiming to accelerate adoption and interoperability of web technology through the standards body's neutral, multi-stakeholder governance.
The OpenSSL Foundation introduced its 2026-2027 Foundation Advisory Committee after restructuring it into a single body, with elected representatives for academics, committers, distributions, individuals, and large and small businesses, and three vacant seats that could require a special election.
The Next Web reports that the Ninth Circuit affirmed dismissal of DMCA claims that GitHub Copilot and Codex stripped copyright notices from licensed open-source code, holding that the pleaded outputs never contained the notices rather than removing them, while the training theory was forfeited and two breach-of-contract claims remain pending.
Let People Work's Lighthouse kept MIT terms for releases through v26.9.9.9 on 9 September 2026 but placed later source under the custom Lighthouse Source Available License 1.0, which permits reading, running, and self-hosting while barring competing substitutes, managed-service resale, and license-key bypassing.
TheSampleSpace reports that Vercel CEO Guillermo Rauch personally awarded $1,000 each to 35 open source contributors in the second round of his OSS grants, organized around agent skills and tools, local AI, performance, foundations, and creative experiments, with no Vercel affiliation or conditions.
FOSS Force republishes a GNU Project essay by Jacob Bachmeyer and Richard Stallman urging developers to stop hosting repositories on GitHub, citing vague GPL licensing guidance that treats copying a license file as sufficient, nonfree JavaScript and telemetry in GitHub's CLI, Copilot as a SaaSS dis-service whose GPL-derived suggestions carry unresolved legal risk and whose billing GitHub can change at will, and gamification and centralization that pull distributed Git workflows into a walled garden.
The OpenSearch Technical Steering Committee's year-in-review describes opening governance elections to all active maintainers, adding a contribution ladder and a roll-call process for inactive maintainers, approving a project policy on AI-generated code contributions, launching Security and Search TAGs, completing SPDX license scanning across every repository, and targeting release 3.6 for full FIPS compliance.
GrapheneOS notes that Android 17 QPR1 adds new developer APIs without a corresponding release to the Android Open Source Project, the first time since Android Honeycomb, leaving the APIs exclusive to Google's Pixel OS and unavailable to other Android OEMs.
GamingOnLinux reports that the Khronos Group, which maintains open standards including Vulkan, OpenGL, and OpenXR, established Khronos AISBL, a Brussels-based non-profit association that lets it serve as a formal partner in EU-funded research and innovation programs such as Horizon Europe and feed open standards work into European consortia.
PANews reports that Zhipu apologized after its ZCode coding tool was found uploading full workspace snapshots, including .git history, to Alibaba Cloud, attributing it to a default-enabled repository indexing feature and pledging not to store user data, to open-source the software, and to reset affected users' quotas.
How-To Geek explains that open source was never free as in cost, walking through license permissiveness, support and compliance obligations, hosted-service lock-in, and the paid tiers plus foundation and corporate backing that keep widely used projects maintained.
Grist argues that treating every project as part of one 'open source sustainability' problem hides the real question of whether an individual project has a way to thrive and who pays for its maintenance, security, and continuity, costs that users otherwise absorb invisibly until an incident such as Log4Shell forces the bill.
The Drop Times reports on a proposed overhaul of EU public procurement rules that would let public buyers favor open-source solutions when pursuing innovation, while requiring them to weigh lock-in, where dependencies sit, and whether another supplier could take over running a system.
Open Apps examined 28 confirmed acquisitions of Y Combinator-tagged open-source companies and found that star counts, company age, and even the acquirer's stated rationale predict little, while weekly commit activity in the first three weeks after a deal closes separates the projects that keep shipping from the ones that go quiet.
The Register reports that an Akademy talk by longtime KDE contributors Eva Brucherseifer and Jan Muehlig proposes an AI-native Plasma assembled from an encrypted, vendor-agnostic personal model of each user, a plan expected to polarize the project, and notes that Trinity Desktop Environment contributors have begun dabbling with AI-generated code.
The FSFE's Software Freedom Podcast speaks with Danish coordinator Carsten Agger about the founding and work of the Aarhus local group, Denmark's growing push for digital independence, the role of Free Software in public infrastructure, and the group's plans around the 'Public Money? Public Code!' initiative.
Sidero Labs, the company behind Talos Linux and Omni, announced it has been acquired by Yardi, saying the Kubernetes operating system stays fully open source under MPL-2.0 with the same repositories and contribution process while Yardi's backing funds new work such as the Talos Hypervisor.
The Register reports that DHH's Arch-based Omarchy desktop has drawn roughly $18.5 million in pledges and donations to the Omacom Foundation, including multiyear commitments and AI-token pledges from Meta, Anthropic, OpenAI and Fireworks, while free-software figures and a Stop Omarchy campaign accuse the project of normalizing far-right politics.
Morse Micro joined the Linux Foundation-hosted Zephyr Project and is contributing its Wi-Fi HaLow driver and sample applications upstream, giving embedded developers a portable path to add long-range Wi-Fi HaLow connectivity to the open-source real-time operating system instead of maintaining a separate port.
XDA examines how distributions such as Debian have settled on policies that permit generative AI contributions only when the person submitting them takes responsibility for the resulting code, arguing that the stance shifts the hidden cost of reviewing, fixing and defending machine-generated patches onto volunteer maintainers.
Help Net Security covers a new ACM technology-policy brief in which six authors argue that AI coding tools are increasing the volume of low-quality contributions and AI-discovered vulnerabilities that open-source maintainers must assess, while most projects still rely on unpaid labor and modest sponsorships and lack sustainable funding.
The Next Web reports that the Advanced AI Society joined the Linux Foundation and LF Decentralized Trust and released a working draft of its Proof-of-Control standard for verifiable AI agents, framing open verification of agent execution as a new category of open source that no single vendor should own.
Phoronix reports that Intel appears to have ended its paid bug bounty program and replaced it with a responsible-disclosure program that offers no bounties, a change coming as AI and LLM-driven report floods strain security programs across the open-source ecosystem, including Intel's own open-source projects.
Chris Amico traces ownership across the layers of his publishing stack, from the Python Software Foundation and public-domain SQLite to Astral's sale to OpenAI, Vercel's backing of Svelte, and Cloudflare's acquisition of VoidZero, weighing what corporate stewardship means for the open source tools he depends on.
Laurie Voss argues that free-riding is the stable outcome of open source economics and that voluntary funding and corporate goodwill cannot fix it, proposing that package registries and distribution channels build in ways to charge the companies that depend on maintainers' work.
NLnet Labs' Alex Band describes how LLM-driven pull requests and machine-generated security reports have reshaped the work of maintaining DNS and routing software such as Unbound and Routinator, and how engineers who value hand-written code are adapting their review and disclosure practices.
A Bevy contributor reflects on the game engine's sixth year, arguing that the project's newly relaxed policy on AI-generated contributions was developed without enough community input and describing how the resulting dispute has left contributors feeling alienated and reluctant to keep volunteering.
SiliconANGLE reports that Comp AI raised $34 million in a Series A led by Roo Capital and Grand Ventures to extend its open-source-core compliance automation platform from SOC 2 and ISO 27001 audit preparation into continuous monitoring, control validation, and security testing for more than 1,000 customer companies.
Barndoor AI acquired Diaphora, the startup behind the open-source Frags workflow engine, saying the automation engine will remain open source so outsiders can contribute, extend, and verify how it works as the technology is folded into Barndoor's governed AI gateway.
FOSS United announced a grant of INR 8 lakhs to Webminal, the free browser-based Linux terminal and learning platform that developer Lakshmipathi G has run since 2011, to support continued work on the long-running project.
FOSS United announced a grant of ₹3,00,000 to Subtitle Studio, a modern cross-platform subtitle editing application, to support the volunteer-built tooling used by Malayalam fan-subtitling group Msone, whose translators had been limited to desktop and mostly Windows-only workflows.
FOSS United awarded a grant of INR 6 lakhs to Aravinda VK to support his continued work on Sanka, Chitra, Binnacle, Dataframes (D), and other open source projects he has largely maintained on his own since first encountering free software through local Linux user groups in 2006.
Licensing lawyer Heather Meeker examines the Ninth Circuit's September 16, 2026 decision in Doe v. GitHub, No. 24-7700, calling it a milestone in the GitHub Copilot class action and a potentially significant win for defendants in AI training cases that turn on how open source code was used.
Advay Udupa recounts how a ₹18,000 FOSS United grant, won after a FOSS United Bengaluru meetup talk, let a 14-year-old self-taught Blender user turn community workshops into a full YouTube course on the free 3D tool.
AIR Security researchers describe Plugin4Shell, a zero-click remote code execution flaw affecting Claude Code, Codex, Copilot, and Gemini, in which a trusted plugin is silently swapped for a malicious one and auto-installed past the agent's SHA pinning, a supply-chain weakness they say no plugin marketplace can fix and that users must address by updating their agent.
Adam Harvey, writing for the crates.io team and the Rust security response working group, warns that an ongoing campaign is targeting rust-lang members and owners of popular crates, using fake job, project, or contract video calls to trick maintainers into installing malware or running clipboard commands so their accounts can publish malicious releases, tactics previously used against the arrayref crate and attributed to the DPRK.
Phoronix reports that Modular shipped Mojo 1.1 and MAX 26.6 a month after the language was open-sourced following Qualcomm's acquisition, and that the project is now accepting community contributions to the Mojo compiler itself, extending the open-source and stewardship story beyond the initial Apache 2.0 release.
The Python Software Foundation announced the five inaugural members of its Python Packaging Council — Brett Cannon, Pradyun Gedam, Donald Stufft, Henry Schreiner, and Ralf Gommers — after a first election that drew 541 ballots and split the seats into staggered one- and two-year term cohorts.
The Python Software Foundation reported that voters elected Elaine Wong, Laís Carvalho, Ee Durbin, and returning member Georgi Ker to its board with 670 ballots cast, reaching quorum, and thanked outgoing directors Cheuk Ting Ho, Chris Neugebauer, and Denny Perez for their service.
Servo reports that a year of OpenCollective- and GitHub Sponsors-funded maintainer work let Josh Bowman-Matthews spend part-time effort on contributor experience, including eight new maintainer nominations, 1,150 pull-request reviews, newcomer issues, documentation, and support for another contributor's approved grant proposal.
CYBR.SEC.Media reports on OISF president Kelley Misata's CYBR.SEC.CON talk, arguing that critical open-source security projects such as Suricata need funding, governance, licensing oversight, maintainer succession planning, and careful due diligence around commercial revenue-sharing opportunities.
InfoQ reports that Microsoft open-sourced TauGrid, a Kubernetes-native platform for scheduling, monitoring, and managing GPU-backed AI workloads across clusters, adding another vendor-backed open-source infrastructure option for AI operations.
Notifuse v40.0 and later releases moved from AGPL-3.0-or-later to Business Source License 1.1 with conversion back to AGPL after four years, while v39.x and earlier remain permanently AGPL and five production features now require a license key.
Meteor launched a contributor sponsorship program that sends project sponsorship revenue back to community maintainers, funding one trusted contributor per quarter through GitHub Sponsors while leaving contribution choices with the sponsored maintainer.
StackBlitz renewed the Bolt Open Source Fund for 2026, adding $1,700 per month in new sponsorships and raising its open-source support run rate to $11,333 per month across developer-tooling, testing, package-management, editor, WebAssembly, and JavaScript ecosystem projects.
Mocha announced $20,000 in community sponsorships from its Open Collective balance, donating $5,000 each to Knip, Node.js, Prettier, and unified as independent open-source projects that Mocha and its users depend on.
FRVR reports that PS5 Linux lead Andy Nguyen says he is stepping away from the homebrew project because LLM-assisted newcomers submitted code they did not understand and reported a key hypervisor bug to Sony, derailing planned PS5 Pro Linux work.
OpenSSF says its governing board and major technology companies are committing to sustainable funding models for public package registries, aiming to secure critical open-source supply-chain infrastructure while keeping it free for individual developers.
Hinterbuild reviews how Redis's move to RSALv2 and SSPLv1 led to the Linux Foundation-backed Valkey fork, comparing feature parity, performance, managed-service costs, and migration paths for teams deciding between the relicensed Redis and the BSD-licensed fork.
Information Systems Journal published a study of vendor-driven open-source license changes and the hard forks they triggered, analyzing Elasticsearch to OpenSearch, Terraform to OpenTofu, and Redis to Valkey as collective-action and governance responses to relicensing.
WSO2 announced general availability of Agent Manager, an Apache-2.0 open-source control plane for governing enterprise AI agents with identity, MCP-level governance, observability, guardrails, and sandboxed runtime across self-hosted or managed SaaS deployments.
Spokes Server, a self-hosted text, voice, and video chat platform, says its server codebase is now source-available under Business Source License 1.1, with core server capabilities unrestricted while paid licenses fund relay-backed mobile push notifications and continued development.
VentureBeat reports that AI-assisted development is changing software supply-chain attack economics by increasing exposure to malicious open-source packages, CI/CD abuse, GitHub Actions risks, and agent tooling that developers and maintainers now need to secure proactively.
Hexaware announced support for the Project NANDA Fellowship, a three-month remote program where Hexaware engineers and external developers build open-source infrastructure for agent discovery, verifiable identity, and secure coordination across AI-agent systems.
Filigran says SEK will embed the open-source OpenCTI threat-intelligence platform and OpenAEV exposure-validation tooling into managed security services across Brazil, Argentina, Chile, Colombia, and Peru, expanding commercial services around Filigran's open-source threat-management stack.
The Frontier reports that Google's Apache-2.0 Artemis Android-agent release reused material from Minitap's Apache-2.0 mobile-use project while initially carrying Minitap author names under a Google copyright line, prompting an unresolved attribution and license-compliance dispute.
TechNewsReel reports that an ACM Technology Policy Council brief warns generative AI is widening an open-source maintenance gap by increasing code and vulnerability-report volume faster than human maintainers can review, secure, and govern it.
SecurityWeek reports that Vercel's $1 million Sandbox bug-bounty challenge generated 1,285 reports and roughly $325,000 in early payouts, including Linux kernel networking flaws and AI-assisted submissions that pushed Vercel to build a triage agent it plans to open source.
The Python Software Foundation adopted its 2026-2031 strategic plan, adding security and vulnerability-management objectives, clearer paths for targeted funding, grants-reform work, and annual public reviews of progress.
OpenSSF introduced a Community Garden user journey to help open-source maintainers, stewards, and manufacturers understand Cyber Resilience Act obligations and find CRA readiness resources.
Sidero Labs announced Talos Enterprise Linux, a commercial license and support tier for the MPL-2.0 Talos Linux codebase that adds 24/7 support, FIPS builds, SBOM/VEX artifacts, signed attestations, CVE SLAs, and IP indemnity while keeping Talos Linux fully open source.
It's FOSS reports that Rune, a Go-based IDE, is now available under GPLv3 and plans to share revenue with contributors while letting them retain rights to their work.
Researchers studying 3,171 public GitHub repositories found that AI coding-agent configuration files create a new dependency layer for open-source developers, with unpinned MCP servers, broad shell approvals, and pre-approved skills producing confirmed supply-chain defects in 16% of sampled setups.
Tom Wang compares open-source payment and ledger projects including TigerBeetle, Formance, Midaz, Hyperswitch, and Mojaloop, warning that AGPL, Elastic License, enterprise-edition boundaries, and a quiet Midaz move from Apache-2.0 to Elastic License 2.0 complicate commercial adoption.