标签：#opensource

The open-source PIM landscape changed twice in eighteen months. Most comparison articles still ranking for it haven't caught up. Current state, September 2026. The date Akeneo has published 30 September 2026 as the end of support for PIM v7. That is twenty-seven days from the date of writing. It is worth stating precisely what that does and does not mean, because both halves are currently circulating in isolation. It does mean a specific version reaches the end of its supported life on a specific date. Teams running v7 have an upgrade decision with a deadline attached. It does not mean Akeneo is discontinued or unsupported. Akeneo's own help centre states that the Community Edition continues to be supported. The 30 September date attaches to v7 across editions, not to the Community Edition as a product. Both are true simultaneously. Plan around the first. Ignore anyone selling urgency based on the second. The change most articles missed While attention was on Akeneo, the larger licensing shift happened elsewhere. Pimcore's Community Edition is no longer GPLv3. With Platform version 2025.1, Pimcore moved the Community Edition to the Pimcore Open Core License (POCL). Version 2024.4 was the last GPLv3 release. Under POCL, the Community Edition is free for non-production use, for non-profits, and for companies below EUR 5 million in annual revenue . Above that threshold, production use requires a commercial licence. This is the change that catches teams out. An evaluation done in 2023 recorded Pimcore CE as free and GPLv3. A company that has since grown past EUR 5M has a different licensing position than the one in its comparison sheet. Source: pimcore.com/en/products/edition/community Most ranking "open source PIM compared" articles still describe Pimcore CE as GPLv3. Publication dates are worth checking on anything in this space, including this article. The systems as they stand Akeneo Community Edition Licensed under OSL 3.0. Mature, widely deployed, and backed by th

devpub v0.3 adds image uploads via `devpub upload`. The catch: the Forem API has no image endpoint. Here's how we solved it, and the story of devpub's first external contributor.

Many organizations still need a service desk that runs on their own infrastructure. They may have strict data-protection requirements, existing directory services, internal workflows, or simply want to remain in control of their system and data. That is why we created Qisutu : a fully open-source, self-hosted service desk for ticketing, IT service management, and process automation. Qisutu 1.0.3 is the current stable release and is ready for production use. What Qisutu provides Qisutu combines the core components needed to operate a professional service desk: Agent and customer portals Ticket creation through the web interface and email Queue-based ticket processing Automation and configurable workflows Knowledge base and multilingual FAQ articles Configurable CMDB Reports and statistics REST API Custom customer and public web forms Time tracking with billable and non-billable entries CSV imports for customers, contacts, and agents Two-factor authentication using TOTP LDAP and Active Directory integration Microsoft 365 and Google Workspace email integration using OAuth2 A module manager and a versioned API for add-ons The system currently includes eleven complete interface languages: German English French Italian Brazilian Portuguese European Portuguese Spanish Dutch Polish Czech Turkish Built for self-hosting Qisutu runs entirely on infrastructure controlled by the organization using it. Ticket data, customer information, attachments, credentials, and configuration remain on the operator's own server. The software is based on: Perl and CGI MariaDB or MySQL Template Toolkit Apache A browser-based user interface The installation script prepares the required packages, Perl modules, Apache configuration, systemd services, database configuration, and web installer. Multiple Qisutu instances can run independently on the same server. This makes it possible to maintain separate production and test environments without mixing their databases, services, or configuration. Ema

TL;DR It's been a while since I've done a collection (maybe month ago), but today let's look at 12 new and not-so-new projects that can really help you in development. They touch on different areas of development, but we will mainly talk about web development. If there's a project worth adding to the next collection, feel free to write about it in the comments, and maybe it will be included. 1. 🤖 OpenWork - The open source Claude Cowork alternative. And we will continue, of course, with AI projects. This tool will allow you to work in one convenient interface with many popular LLMs. OpenWork is the desktop app that lets you use 50+ LLMs. 💎 Check out the OpenWork repository ☆ 2. 💻 T3 Code - The open-source control plane for coding agents. If you know a YouTuber like Theo, then you should know this project. It's an OpenCode alternative that lets you work with AI in an easy-to-use chat interface. It enables control of the agents on your machine with a best-in-class mobile app (iOS, Android), web app and Electron-based desktop app. 💎 Check out the T3 Code repository ☆ 3. ⚙️ Summarize - Point at any URL or file. Get the gist. The first project is a small tool for extracting short info of content. Summarize was created by one of the creators of the well-known OpenClaw. Fast summaries from URLs, files, and media. 💎 Check out the Summarize repository ☆ 4. 👾 Godot - Free and open source 2D and 3D game engine A truly legendary engine like Unity or Unreal Engine for games. If you are a game developer, you should know this project. From pet projects for the university to multi-million dollar games - it gives it all. Godot Engine is a feature-packed, cross-platform game engine to create 2D and 3D games from a unified interface. It provides a comprehensive set of common tools, so that users can focus on making games without having to reinvent the wheel. 💎 Check out the Godot repository ☆ 5. 💎 React Bits - An open source collection of animated, interactive & fully customizable Rea

Solving AI Agent Amnesia: Meet Claude-Mem One of the most persistent hurdles in working with command-line AI coding assistants (such as Claude Code, Antigravity CLI, and OpenCode) is context fragmentation across sessions. When a developer ends a terminal session, the agent's working context is wiped clean. The next day, the developer must re-explain architectural decisions, project conventions, and previously resolved edge cases. claude-mem is an open-source memory compression and retrieval engine created by thedotmack. It passively monitors developer interactions, compresses key discoveries into structured observations, and seamlessly primes future agent sessions with relevant context. What is Claude-Mem? claude-mem operates as an intelligent background memory worker. Rather than dumping raw conversation transcripts into future prompt windows—which rapidly drains token budgets— claude-mem extracts semantic summaries of bug fixes, architectural choices, and dependency discoveries. When a new session starts, the agent queries its memory database to recall pertinent project history before writing code. Key Core Features 1. Passive Background Observation claude-mem hooks into five critical lifecycle stages (SessionStart, UserPromptSubmit, PostToolUse, Stop, and SessionEnd). It documents what worked, what failed, and why, without requiring manual intervention from the engineer. 2. Progressive 3-Layer Retrieval (~10x Token Savings) To preserve context window capacity, claude-mem implements a tiered retrieval model: Search Index: Returns compact observation IDs and titles (~50–100 tokens per result). Timeline Slice: Provides chronological context around relevant findings. Detail Fetch: Loads full technical observations only for the specific items needed. 3. Hybrid Search (SQLite FTS5 + Chroma Vector DB) Search queries leverage both lexical matching and vector similarity. Whether an engineer searches for an exact error string or asks conceptually about "how auth tokens are

You know this loop. A page feels slow. You open the Lighthouse panel in DevTools, hit Analyze, and get 86 . You change nothing, run it again, and get 91 . You run it a third time out of spite: 78 . Now which number goes in the PR description? This isn't a bug. Total Blocking Time is CPU-sensitive and worth roughly 30% of the Performance score, so anything else your laptop is doing — a Slack notification, a Docker build, Spotlight reindexing — moves the number. Lighthouse Performance realistically swings about ±5 points on identical runs of an identical page. One run is an anecdote. And the tool that would give you a stable, real-world answer — PageSpeed Insights — needs a public URL, so it can't audit the thing you're actually working on. I got tired of this and built LightAudit Score : a local console that runs Lighthouse on your own machine, repeats it enough times to mean something, and keeps the results. It's free. Not "free tier" — free, MIT, no account, no usage cap. The three gaps, concretely 1. Reach: PSI needs a public URL, your work isn't public PageSpeed Insights is excellent and I use it constantly. It also cannot audit: localhost:3000 , which is where the change you just made lives a staging box behind a VPN the internal app that nobody can link to a preview deploy that dies in an hour The usual workaround is a tunnel, or "we'll check it after deploy," which means checking it after it's a problem. LightAudit runs the same Lighthouse v13 engine against your own Chrome. If your browser can open it, LightAudit can audit it — localhost, staging, VPN, intranet, all through exactly the same pipeline. 2. Accuracy: make the number boring This is the part I care about most, because a score you can't reproduce is a score you can't act on. Median of N. Every URL is audited N times (default 3), and Lighthouse's own computeMedianRun picks the representative run. Not the average — the actual median run, with its real trace. Isolated Chrome per run. Every run launches

GitHub热门项目 | autonomous red teaming platform; multi-agent offensive-security meta-harness | Stars: 5,934 | 257 stars this week | 语言: TypeScript

GitHub热门项目 | High-performance In-browser LLM Inference Engine | Stars: 18,711 | 64 stars today | 语言: TypeScript

GitHub热门项目 | Replace port numbers with stable, named local URLs. For humans and agents. | Stars: 11,517 | 69 stars today | 语言: TypeScript

GitHub热门项目 | [EMNLP 2025 Demo] PDF scientific paper translation with preserved formats - 基于 AI 完整保留排版的 PDF 文档全文双语翻译，支持 Google/DeepL/Ollama/OpenAI 等服务，提供 CLI/GUI/MCP/Docker/Zotero | Stars: 36,617 | 55 stars today | 语言: Python

GitHub热门项目 | GEO-first SEO skill for Claude Code. Comprehensive AI search optimization for any website — citability scoring, AI crawler analysis, brand authority, schema markup, platform-specific optimization, and PDF reports. If you want learn how to sell this to real businesses, check out the skool community | Stars: 10,149 | 96 stars today | 语言: Python

GitHub热门项目 | Practice English, one strike, one step forward; 练习英语，一次敲击，一点进步； | Stars: 9,207 | 68 stars today | 语言: Vue

GitHub热门项目 | Source control for agents. Use multiple coding agents, track their changes and query them in one place | Stars: 2,657 | 895 stars today | 语言: Rust

GitHub热门项目 | A股自动选股系统 — 多种技术形态自动扫描，收盘后自动运行并推送飞书 | Stars: 5,919 | 195 stars today | 语言: Python

GitHub热门项目 | A modern formatting library | Stars: 23,819 | 3 stars today | 语言: C++

One of our agents ran a test suite. The suite takes four minutes. The MCP client's idle timeout is sixty seconds. You can see where this is going. At second sixty the client cancelled the call. The process kept running — nobody told it to stop — while the model, holding a cancellation where its test results should be, did the reasonable thing and ran the suite again. Two test suites, same directory, racing each other over the same build artifacts. The second one failed with a locking error, the model reported the tests as broken, and the tests were fine. In another session the same model, burned before, developed a workaround: run the build, then call sleep 240 , then look. A tool call that does nothing, held open for four minutes, so that a different tool call might have something to show. The model had reinvented polling, badly, because we hadn't given it anything better. I build octofs , an open-source MCP filesystem server, and this incident set the agenda for eleven releases in two weeks (0.10.1 through 0.14.1). The principle behind them is one I keep coming back to: an MCP server's real interface is every string it hands back to the model. These releases apply it to the slowest string of all — the one the model waits for. The shell is now event-driven. Commands start in the foreground, move to the background on their own if they outlast ten seconds, and the client gets a notification when they finish. Nothing blocks, nothing gets killed, nothing runs twice. First fix: prove the call is alive The sixty-second cancellation had a shallow cause and a deep one. The shallow one: a shell call is silent by nature. A build that's compiling says nothing on the wire for minutes, and to an MCP client silence is indistinguishable from a hung server. So 0.10.2 added liveness heartbeats — while a command runs in the foreground, octofs emits a progress notification every ten seconds, well below any sane idle timeout, so a single missed beat can't cancel the call. That stopped

Someone plugs in the HDMI cable. The room's display shows nothing, or shows 1024×768, or shows the desktop of whoever presented last week. After a minute of this, somebody says "just share your screen", and out comes AnyDesk or TeamViewer. It works. It is also the wrong shape for the problem, and noticing why turns out to be more interesting than it sounds. What remote desktop tools are actually for AnyDesk, TeamViewer and RustDesk exist to solve one problem well: reach a machine you are not near. Your parent's laptop. A server in a rack. A colleague's desktop three time zones away. Everything about their design follows from that. One person connects to one machine. That person takes the mouse. The remote screen is mirrored to them, and the whole session is framed as control — because when you are not in the room, control is the only way to do anything. Being fair about the privacy question, because it is the claim people reach for first and it is wrong: AnyDesk has a LAN mode , and in it a session goes directly between the two machines without the internet. RustDesk can be self-hosted entirely on your own infrastructure. Neither of these tools forces your screen through somebody's cloud if you configure them not to. If you have read that they do, that is not accurate. The mismatch is not privacy. It is shape. The relay, the account and the NAT traversal are not overhead — they are the product, and they are what makes reaching a machine in another country possible at all. Standing beside the machine, you pay for all three and use none of them. Where the shape stops fitting Stand in a room with four people and a Mac, and three things go wrong at once. It is one-to-one. Remote desktop is a session between two endpoints. Four people looking at one screen is not what it models, so three of them read over a shoulder. It mirrors, and mirroring is sometimes the wrong answer. Every tool in this category shows a screen that already exists. But the meeting-room problem is oft

Security controls in AI systems often end up duplicated across applications. One team adds prompt validation, secrets detection, PII filtering, authentication, logging, and rate limits to an LLM application. A second team builds similar controls around another provider. Once agents enter the mix, the organization has several implementations of policies that should be shared. An AI gateway provides a central place to enforce those controls. Traditional infrastructure already centralizes TLS termination, authentication, rate limiting, traffic routing, and observability instead of rebuilding them in every microservice. The same pattern applies to AI traffic. What is an AI gateway? Without a gateway: +--> OpenAI Application -------+--> Anthropic +--> Gemini With a gateway: Applications | v +-------------------------+ | AI Gateway | | | | Authentication | | Rate limits | | Guardrails | | Routing | | Logging / observability | +------------+------------+ | +------+------+ | | | v v v OpenAI Anthropic Gemini Products in this space include Bifrost , Kong AI Gateway , LiteLLM , and Cloudflare AI Gateway . Their feature sets differ, but each can route model traffic through a common control layer. Security policy can run at that layer before traffic reaches a provider. Why application-level guardrails become painful To prevent users from accidentally sending credentials to an LLM, a simple implementation might look like this: def ask_llm ( prompt ): if contains_secret ( prompt ): raise SecurityError ( " Potential secret detected " ) return llm . chat ( prompt ) For one application, this is reasonable. Across 30 services, enforcement starts to drift. Some services call OpenAI directly, others use Anthropic, and several teams maintain their own wrappers. One application omits the secret check, another uses an old version, and a third checks prompts but no other AI interactions. Policy enforcement now depends on convention. Moving enforcement to the gateway changes the model: Requ

Hoi hoi! I’m @nyaomaru, a frontend engineer who is surprised by how cold it is in the Netherlands...

Pessoal, eu quase mandei uma lista de 23 "vulnerabilidades" pra mantenedores de código aberto. XSS, CORS, CSP, um SVG suspeito. O modelo tinha devolvido volume. Eu sentia que tinha trabalhado. Aí parei. Se eu fosse o cara do outro lado da issue, eu levaria isso a sério? A conta virou quando eu parei de pedir "audita meu código". Passei a escrever o contrato antes de abrir o repo. Direção (o que o modelo pode afirmar) e disciplina (o que ele não pode). Isso não deixa o LLM mais inteligente. Controla o comportamento. Em segurança, isso é o que separa auditoria de lista. O que você leva daqui: o contrato (esqueleto), por que o scanner não substitui hunt, e as três portas pra não colar relatório no tracker. Os repos no meio são prova. Não são o ponto. Tabela de Conteúdo 1. Direção e disciplina não deixam o modelo mais inteligente 2. O scanner vê o que está. O hunt vê o que falta 3. Silêncio também é resultado 4. As três portas 5. O que você monta amanhã 1. Direção e disciplina não deixam o modelo mais inteligente Esse é o ponto que eu demorei pra aceitar. O modelo já conhece OWASP. O que muda é o que ele tem permissão de afirmar. Sem isso, "audita meu código" devolve XSS fantasma, CORS, CSP, um SVG. Volume. A pergunta de segurança some: disto aqui, o que vira issue, o que vai pro e-mail privado, o que é silêncio? Direção amarra três coisas antes da leitura: Padrão externo. OWASP ASVS 5.0, com o ID do requisito. "Boas práticas" não conta. Invariante em uma frase, falsificável. "Webhooks deveriam ser autenticados" é opinião. "Todo handler de webhook de entrada verifica autenticidade do remetente antes de mutar estado" é hunt. Formato único. Finding, observação e hipótese não misturam. Disciplina é o que corta o teatro. O texto que o modelo vê antes de abrir arquivo: Padrão: OWASP ASVS 5.0, com o ID do requisito. "Boas práticas" não conta. Invariante: uma frase, falsificável. Relatório: finding, observação e hipótese não misturam. Sem arquivo:linha → não é finding. CWE inv