Topic
The study of how open-source software is funded and maintained, focusing on the gap between corporate reliance on volunteer coders and the support they receive.
postgres-js leaves a connection's row cursor set after a query fails mid-stream, so one team's LIMIT 500 query came back with 813 entries. With the one-line fix an open pull request since October 2025, pooled users have to patch the driver themselves.
Reality
The program paid for critical vulnerabilities for about a year and closed because generating a plausible report now costs about a tenth of a cent while reading one still costs ten minutes of the person who knows the code.
Reality
An outsider benchmarking laya's multilingual checkpoint on 300 Japanese emails found the first-listed ordinal level effectively unreachable, and the maintainer shipped the limitation in a README before any retrain.
Reality
A public measurement across five ecosystems puts one component in seven down as unmaintained, though its own findings data shows that almost never changes what you can do about an advisory today.
Reality
Chainguard says its Athena coalition will start releasing about 50 findings on September 28, with affected version ranges attached. A scanner needs those ranges before it can flag a pinned old release.
Reality
The dev.to post announcing llm-sentinel says llm-guard is archived. The replacement is ten pattern-matching scanners with a score threshold each, benchmarked on 133 hand-written cases its author calls a smoke test.
Reality
The year's CVE tally has reached 66,401, close to double where it stood last September, and Microsoft alone patched 974 in a single month. Jerry Gamblin, who keeps the count, says more known bugs is mostly the system working.
Reality
Since uv 0.12.0 landed on July 28, 2026, uv init has written a src layout and a uv_build build-system table by default. The old --package tip is now backwards, and --no-package is the way back to a flat main.py.
Reality
A dev.to writeup dates the README link-spam campaign to at least September 14 and puts one bot at three pull requests a day. Worked out per repository, that is about one arrival a day at any project it targets.
Reality
The case that generated code fails without the usual warning signs comes from two practitioner accounts, while the only measured series is curl's inbound bug reports, and Daniel Stenberg stopped taking those in January 2026.
Reality
Six authors writing for the ACM's Technology Policy Council say AI has made code and vulnerability reports cheap to produce while the people who decide what ships are volunteers at projects like Apache, whose 2024 revenue was $2,379,402.
Reality
Symfony AI Mate deleted its MCP server in August and now exposes profiler data through console commands that SKILL.md files tell the agent to run. The author of the community bundle Mate replaced has deprecated his.
Reality
Homebrew rated the unsigned cask removal metadata path High and closed it back in 6.0.12. The 7.0.0 upgrade adds one Moderate sandbox escape through LaunchServices, plus a scanner for installed formulae.
Reality
GitHub gives forked pull requests a read-only token and no secrets, so any test that needs a credential fails. The two documented ways around that differ in whose code the secrets-bearing job actually checks out.
Reality
The filter appears once, in the SELECT that collects primary keys, and the writes then go out one statement per row keyed on id. Anything that changes a row in between is overwritten, and the window grows with the row count.
Reality
Anil Madhavapeddy's account of the cohttp 6.3.0 path traversal fix puts a number on the gap between publishing a patch and being probed for the bug it closes. The three alternatives he examined each cost a small maintainer something.
Reality
The Next.js team's closability agent reads each issue's conversation, searches the history and retries the reproduction on three releases, then hands a confidence score and its evidence to a maintainer who owns the close decision.
Reality
Two or three of the 95 were genuine, and reviewers had to read all of them to find out. The EU's 24-hour ENISA clock starts on September 11, 2026, and only evidence of active exploitation starts it.
Reality
Discovery took 495,211 executions and ten hours forty-three minutes on a single machine. The two-line guard that fixes it was proposed on ffmpeg-devel in November 2024 and never landed on the path that mattered.
Reality
A GSoC final report on webpack-doc-kit shows what deleting the manual API-doc update actually costs: an adapter layer between two markdown tools that do not agree on format.
Reality
Build · August 22, 2026 · 1 publisher
Build · August 15, 2026 · 1 publisher