Open Source news and engineering summaries

Mitchell Hashimoto, a long-time GitHub user and creator of Ghostty, announced that the project will leave GitHub due to recurring infrastructure outages that hinder productivity. Citing frequent downtime for pull requests and GitHub Actions, Hashimoto is planning to migrate independently while maintaining a read-only mirror, emphasizing that the decision stems from a desire to prioritize reliable software development.

A Matplotlib PR proposed replacing np.column_stack with np.vstack().T for a 36% performance boost. The PR was closed because it was created by an AI agent, violating community policy. This sparked a heated debate regarding AI contributions, open-source gatekeeping, and the ethics of personal attacks by automated agents.

Godot maintainers are struggling with an influx of low-quality, AI-generated code contributions, often referred to as 'AI slop'. This deluge is taxing human resources, forcing maintainers to verify the authorship and functional validity of every submission. The community is exploring funding for more staff and potential platform migration to handle the overwhelming volume.

Paperclip is an open-source, self-hosted control plane for running organizations of AI agents. Its Node.js server and React UI coordinate heterogeneous agents through goals, org charts, tasks, heartbeats, budgets, governance, approvals, audit trails, integrations, and persistent workspaces. It supports multi-organization isolation, plugins, observability, and mobile management, with local installation requiring Node.js 24.11+.

VoiceStudio is an open-source, fully local alternative to ElevenLabs for voice cloning, voice design, video dubbing, dictation, transcription, and audiobook creation across 646 languages. Its Electron desktop app runs models on user hardware, supports selectable engines including k2-fsa/OmniVoice, and offers local API and MCP integrations, with optional remote workers and privacy-conscious analytics.

Daniel Stenberg, the lead developer of the widely used open-source networking tool cURL, has announced the termination of the project's vulnerability reward program. This decision follows a surge in low-quality bug reports, many of which are identified as AI-generated slop that wastes the time of the small maintenance team. While users expressed concerns that this move might impact the security of the tool, which is a staple in Windows, macOS, and Linux, Stenberg emphasized that the current volume of bogus submissions threatens the mental health and sustainability of the project. Effective at the end of the month, the project will pivot away from paid bounties to protect its limited resources from automated misinformation.

F-Droid reports that Google’s planned Android lockdown remains a threat despite public misconceptions. The community is raising awareness via in-app banners. Meanwhile, F-Droid Basic 2.0-alpha3 was released with UI improvements, and various apps like Conversations and ProtonVPN received updates, focusing on removing proprietary dependencies and adopting modern protocols.

Bose has announced a surprisingly consumer-friendly strategy for its legacy SoundTouch smart speakers. Originally slated to lose official cloud support in February, Bose has extended the deadline to May 6th, 2026. Crucially, the company is open-sourcing the API documentation, allowing developers and enthusiasts to create custom tools to maintain functionality. Instead of bricking the devices, a final update to the SoundTouch app will introduce local controls, preserving features like Bluetooth, AirPlay, Spotify Connect, and physical AUX connections. This move provides a rare alternative to the industry standard of rendering old hardware useless once cloud services are discontinued, drawing comparisons to community-driven efforts like the Rebble Alliance for Pebble watches.

Earendil released Pi 1.0, a hardened, minimal, extensible agent harness with Codemode, MCP support, virtual models, deferred tool loading, Anthropic cache warming, transcript-aware changes, and a refreshed TUI. Pi Durable, an experimental package for long-running agentic applications, ships alongside it. Both are MIT licensed and available via installers, npm, and GitHub.

Mastodon is a decentralized social networking platform. To access its web application profile or interface, users must enable JavaScript in their browsers. Users who prefer not to use a web browser can opt for various native apps available across different platforms for a more integrated experience.

Firefox will continue supporting uBlock Origin despite Microsoft Edge and other Chromium-based browsers phasing out Manifest V2. Edge’s shift to Manifest V3 removes extension capabilities needed for effective ad blocking. As Firefox remains non-Chromium and other alternatives lack full support, it is now the main browser offering uBlock Origin without compromises; uBlock Origin Lite is less capable.

Valve has released CAD files for the Steam Controller and Puck, allowing users to create custom accessories like skins or mounts. The release includes STL and STP files under a creative commons license, encouraging community innovation while permitting commercial inquiries. This initiative follows Valve's history of open hardware support for devices like Steam Deck and Index.

The cURL project has officially announced the termination of its bug bounty program effective January 31, 2026, following a relentless surge of AI-generated garbage reports. Daniel Stenberg, the creator of cURL, initiated this change by removing all program references from the documentation and GitHub after the project was overwhelmed by low-quality HackerOne submissions. Despite previous warnings and potential bans, the influx of unresearched reports continued into early 2026, forcing the team to prioritize their time over financial incentives for security researchers. Moving forward, the project will still accept vulnerability reports via GitHub or mailing lists, but no monetary rewards will be provided. Stenberg emphasized that this decision aims to eliminate the profit motive for those using LLM tools to generate bogus reports, and he remains firm on critiquing those who submit issues they do not fundamentally understand or cannot reproduce.

Ollama, initially an accessible wrapper for llama.cpp, has faced criticism for obscuring its reliance on the engine, failing to credit contributors, and introducing performance issues via a custom backend. Critics highlight its vendor lock-in, proprietary format, and pivot toward cloud-based services, arguing that superior, community-driven alternatives like llama.cpp and LM Studio offer better transparency and performance.

Google plans to mandate central developer registration for all Android apps by September 2026, requiring government ID and fees. This policy effectively kills the open-source spirit of Android, threatens apps from F-Droid, and creates a significant censorship and privacy risk, drawing widespread opposition from developers and privacy advocates who view it as a total control move.

F-Droid 2.0 is a decade-scale redesign of the official Android app, adding improved discovery, multilingual search, filtering, automatic updates, and a unified installer. It modernizes the interface with Kotlin and Jetpack Compose, improves maintainability and contribution, and preserves privacy-focused features while temporarily omitting panic-triggered app wiping.

Homebrew 6.0.0 is now available, featuring a new tap trust security mechanism, a faster internal JSON API, and Linux sandboxing via Bubblewrap. This release includes improved defaults, parallelized brew bundle operations, enhanced startup performance, and initial support for macOS 27 (Golden Gate), while strengthening supply-chain security and refining the package management experience across macOS and Linux.

OpenLogi is a native, local-first Rust alternative to Logitech Options+. It controls Logitech mice directly over HID++, enabling 44 button actions, custom shortcuts, scripts, DPI, SmartShift, device profiles, and app-specific overlays. It supports Bluetooth, USB, and multiple receivers on macOS, Linux, and Windows, with TOML configuration, signed packages, no account, and no telemetry.

Pirate Face is decentralized peer-to-peer infrastructure designed to preserve open AI models beyond any single host. It mirrors Hugging Face models as checksum-verified torrents, using web-seeds while available and swarm fallback after removal. Planned drop-in API compatibility, creator verification, licensing controls, and community incentives support resilient, attributable distribution of sovereign AI.

Mastodon is a decentralized social networking platform. Its official web interface requires JavaScript to function properly. Users who prefer not to use JavaScript or seek a more integrated experience are encouraged to utilize native apps available for various operating systems and platforms.