What APIs and backends repositories shipped recently

dicebear/dicebear

Dicebear · github.com/dicebear/dicebear

Merged pull requests

• feat: render declarative animations in all cores (#557, merged September 1, 2026 by FlorianKoerner) (source)

Releases

• v10.7.0 (DiceBear 10.7 - Release Notes), published August 26, 2026. (source)
• v10.6.0 (DiceBear 10.6 - Release Notes), published August 17, 2026. First change listed: inkColor colors the whole drawing, outlines and filled areas alike. Seven styles use it: Adventurer, Adventurer Neutral, Croodles, Croodles Neutral, Notionists, Notionists Neutral, and Open Peeps. (source)
• v10.5.0 (DiceBear 10.5 - Release Notes), published August 9, 2026. First change listed: Editor: The eight character styles it was missing are in: clay, critters, moods, pixelbot, sprouts, thumbs, voxel-art, and voxel-bot. Its list now matches the Characters category on the website… (source)
• v10.4.0 (DiceBear 10.4 - Release Notes), published August 1, 2026. First change listed: Filter Avatar Variants with Tags (source)
• v10.3.0 (DiceBear 10.3 - Release Notes), published June 13, 2026. First change listed: PHP: Style::fromJson($json) (source)
• v10.2.0 (DiceBear 10.2 - Release Notes), published June 10, 2026. First change listed: Color luminance is now computed from a precomputed lookup table instead of calling pow() at runtime. Math libraries round pow() slightly differently (even browsers disagree among themselves), which… (source)

From the changelog

• 11.0.0-rc.2: CLI: The style names are no longer commands, and --optimize, (source)
• 11.0.0-rc.2: Core (JS, PHP, Python): Avatar no longer accepts a raw style definition, (source)
• 11.0.0-rc.2: CLI: dicebear create <style> prints one avatar to stdout, as SVG, JSON (source)
• 11.0.0-rc.2: Styles: Bumped @dicebear/styles to 11.0.0-rc.2 for the CLI and the (source)
• 11.0.0-rc.2: Core (Go): The module path is github.com/dicebear/dicebear-go/v11, as Go (source)
• 11.0.0-rc.2: Core: All seven cores require @dicebear/schema 2.0, which carries the (source)
• 11.0.0-rc.2: Core: ColorOrder: 'fixed' treats the style's palette the way it treats (source)
• 11.0.0-rc.2: Core: animation is a boolean. The name and list forms from 11.0.0-rc.1 (source)

From the README

• DiceBear is an open source avatar library. It turns any seed string (a username or an email address, for example) into an SVG avatar in one of 63 styles, from hand-drawn characters to abstract patterns. The same seed always produces the same avatar, so you store a string instead of an image and never ask users to upload a profile picture. (source)

Who ships it

• FlorianKoerner: 1,615 commits on the default branch (source)
• davidyuk: 1 commits on the default branch (source)
• eduardomosko: 1 commits on the default branch (source)
• elierotenberg: 1 commits on the default branch (source)
• Zaczero: 1 commits on the default branch (source)
• pennstatephil: 1 commits on the default branch (source)

encode/django-rest-framework

Django-rest-framework · github.com/encode/django-rest-framework

Week of October 5, 2026

• Released 3.18.2 with security hardening for content negotiation against large Accept headers and refusal of non-text encoding charsets. Release
• Released 3.18.3 restoring order_by_precedence from 3.18.1 to fix a broken return value. Release
• Fixed order_by_precedence so it again returns a list of sets of strings instead of a list of sets of media types. Pull request #10066
• Improved teardown of a test that modifies INSTALLED_APPS so it no longer leaks state into later tests. Pull request #10056
• Fixed CI that broke after a Django bugfix release addressing security vulnerabilities. Pull request #10064

Week of September 14, 2026

• Configured dependabot to automate pre-commit hook updates, reducing maintenance burden. Pull request #10046
• Redirected the writable nested serializers documentation page to the serializer relations guide. Pull request #10045
• Updated pre-commit hooks to latest versions. Pull request #10044
• Fixed grammar in the writable nested serializers third-party package note. Pull request #10043
• Fixed grammar in the drf-proxy-pagination third-party package note. Pull request #10042

Merged pull requests

• Fix dead links in the API guide and hypermedia docs (#10100, merged November 10, 2026 by Kernel-Hunter) (source)
• Make model fields with a db_default optional in ModelSerializer (#10086, merged November 9, 2026 by LindseyZ1205) (source)
• Remove stray quote from CursorPagination schema example (#10097, merged November 9, 2026 by Medamineelkhattabi) (source)
• Align directory listing with command used before in tutorial (#10090, merged November 7, 2026 by dawedawe) (source)
• Add missing & fix Greek translations (#10085, merged November 5, 2026 by GiannopoulosK) (source)
• Update Brazilian Portuguese translations (#10084, merged November 4, 2026 by thalisonwilker) (source)
• Fix SearchFilter crash when search_fields uses the pk alias (#10071, merged October 8, 2026 by mohamed-alired) (source)
• Restore order_by_precedence from 3.18.1 to fix broken return value (#10066, merged October 6, 2026 by browniebroke) (source)
• Fix CI that broke due to latest Django bugfix (#10064, merged October 6, 2026 by browniebroke) (source)
• Improve teardown of test modifying INSTALLED_APPS (#10056, merged October 5, 2026 by browniebroke) (source)
• Add support for Python 3.15 (#10025, merged September 24, 2026 by p-r-a-v-i-n) (source)
• Add missing article in "writable relationship field" in documentation (#10052, merged September 23, 2026 by haimingZZ) (source)

Releases

• 3.18.3, published October 6, 2026. First change listed: Restore orderbyprecedence from 3.18.1 to fix broken return value (source)
• 3.18.2, published October 6, 2026. First change listed: GHSA-33wh-fxxf-88vv: Harden content negotiation against large Accept headers by @jisung-02 in 148ab65. Thanks @jisung-02 for the report. (source)
• 3.18.1, published September 7, 2026. First change listed: Fix duplicate validation errors for GenericIPAddressField with protocol (source)
• 3.18.0, published August 7, 2026. First change listed: Drop support for Django 4.2, Django 5.0 and Django 5.1 (source)
• 3.17.2, published August 5, 2026. First change listed: Fix disclosure of GET-protected data in case of validation error with AdminRenderer by @browniebroke in https://github.com/encode/django-rest-framework/pull/10012. Thanks, @zainnadeem786 for the… (source)
• 3.17.1, published March 24, 2026. First change listed: Fix HTMLFormRenderer with empty datetime values (source)

From the README

• Full documentation for the project is available at [https://www.django-rest-framework.org/][docs]. (source)

Who ships it

• lovelydinosaur: 3,816 commits on the default branch (source)
• xordoquy: 558 commits on the default branch (source)
• jpadilla: 250 commits on the default branch (source)
• minddust: 153 commits on the default branch (source)
• auvipy: 123 commits on the default branch (source)
• markotibold: 114 commits on the default branch (source)

go-swagger/go-swagger

Goswagger · github.com/go-swagger/go-swagger

Merged pull requests

• fix(cli): fix typos in usage strings + panic in init (#3498, merged September 11, 2026 by fredbi) (source)
• feat(cli): added a "init config" command to generate a seed config file (#3497, merged September 11, 2026 by fredbi) (source)
• codegen(model): honor new flag option to turn all string enum to case-insensitive (#3496, merged September 11, 2026 by fredbi) (source)
• fix(generator): continue array context validation after zero item (#3495, merged September 11, 2026 by ghost) (source)
• chore: update deps (onboards go-openapi fixes) (#3494, merged September 10, 2026 by fredbi) (source)
• chore: moved fixture to testdata (#3493, merged September 9, 2026 by fredbi) (source)
• fix(cli): fix doc command (#3492, merged September 8, 2026 by fredbi) (source)
• removed deprecated PreferServerCipherSuites from generated server (#3490, merged September 5, 2026 by pyrohedgehog) (source)
• fix:#3485 support params with getters generation. (#3491, merged September 5, 2026 by pyrohedgehog) (source)
• doc(cli): generate CLI usage documentation as markdown (#3483, merged August 30, 2026 by fredbi) (source)
• fix(generator): handle discriminator allOf models (#3474, merged August 26, 2026 by 014-code) (source)
• fix: onboards minor patches from go-openapi (#3479, merged August 26, 2026 by fredbi) (source)
• chore: updated deps (security patches) (#3519, merged October 29, 2026 by fredbi) (source)
• perf(generator): analyze the spec once per generation run (#3517, merged October 29, 2026 by Sczlog) (source)
• Add serve command line to argument to configure assets url (#3518, merged October 29, 2026 by gintrator) (source)

Releases

• v0.36.7, published October 31, 2026. First change listed: feat(cli): added a "init config" command to generate a seed config file by @fredbi in #3497 ... (source)
• v0.36.6, published September 10, 2026. First change listed: fix(cli): fix test in CLI with doc by @fredbi ... (source)
• v0.36.5, published August 24, 2026. First change listed: Codescan updgrade with perf improvements (source)
• v0.36.4, published August 15, 2026. First change listed: security(docker): update base image to patch golang by @fredbi in #3469 ... (source)
• v0.36.3, published August 14, 2026. First change listed: feat(generator): add --no-default-omit-empty CLI flag by @RubenPari in #3423 ... (source)
• v0.36.2, published August 7, 2026. First change listed: fix(specgen): updated codescan to v0.36.3, onboards minor quirk fixes by @fredbi in #3417 ... (source)

From the README

• This project contains a golang implementation of Swagger 2.0 (aka OpenAPI 2.0). It provide tools to work with swagger specifications. (source)

Who ships it

• casualjim: 1,937 commits on the default branch (source)
• fredbi: 452 commits on the default branch (source)
• key-amb: 35 commits on the default branch (source)
• youyuanwu: 33 commits on the default branch (source)
• GlenDC: 31 commits on the default branch (source)
• pieter-lazzaro: 29 commits on the default branch (source)

gotify/server

Gotify · github.com/gotify/server

Merged pull requests

• fix: match allowed regex fully (#1054, merged September 24, 2026 by jmattheis) (source)
• Fix create user permission (#1048, merged September 12, 2026 by jmattheis) (source)
• fix: don't panic when a Let's Encrypt request fails (#1046, merged September 9, 2026 by NotAFlightRisk) (source)
• fix: reject password changes when local auth is disabled (#1041, merged September 6, 2026 by justadityaraj) (source)
• feat: add support for mapping user admin status from OIDC claims (#1033, merged August 26, 2026 by UiP9AV6Y) (source)
• fix: panic when write on closed channel (#1035, merged August 23, 2026 by jmattheis) (source)
• feat: auto-redirect to OIDC IdP (#991) (#1029, merged August 20, 2026 by DerDummePunkt) (source)
• chore: update go module path to github.com/gotify/server/v3 (#1030, merged August 16, 2026 by eternal-flame-AD) (source)
• #991 ux improvements: OIDC Login Label (#1022, merged August 15, 2026 by DerDummePunkt) (source)
• feat: #1007 - Option to disable local login when OIDC is enabled (#1020, merged August 13, 2026 by DerDummePunkt) (source)
• feat(ui): highlight current client session (#1025, merged August 12, 2026 by SulimanAbdulrazzaq) (source)
• fix: remove panic() and relay password hashing errors to UI (#1014, merged August 10, 2026 by eternal-flame-AD) (source)
• fix: limit sortKey to at most 255 bytes (#1084, merged November 9, 2026 by jmattheis) (source)
• fix: don't recreate deleted entities (#1080, merged November 8, 2026 by jmattheis) (source)
• ci: don't depend on toolchain version (#1070, merged October 25, 2026 by jmattheis) (source)
• Bound client elevation duration to prevent overflow and permanent elevation (#1058, merged October 25, 2026 by piyush295) (source)
• fix(ui): send only one DELETE per message when leaving with pending deletes (#1075, merged October 18, 2026 by shivampwm2020) (source)
• fix: hide app/client token in update methods (#1076, merged October 15, 2026 by jmattheis) (source)
• feat: limit request body size (#1073, merged October 14, 2026 by TameTheGame) (source)
• fix: clean up application images when an upload fails (#1057, merged October 11, 2026 by SulimanAbdulrazzaq) (source)
• fix: close image file handle (#1071, merged October 11, 2026 by jmattheis) (source)
• feat: add MCP endpoint for sending messages (#1066, merged October 10, 2026 by RedwindA) (source)
• fix: update swagger-ui to 5.29.1 and add SRI hashes (#1060, merged September 30, 2026 by lbellows) (source)

Releases

• v3.1.1, published September 15, 2026. First change listed: Require an elevated session for creating users (GHSA-phfm-q6fr-wv34 via #1048) (source)
• v3.1.0, published August 27, 2026. First change listed: Add setting GOTIFYLOCALAUTHENABLED for disabling local user authentication Docs (#1007 via #1020 by @DerDummePunkt) (source)
• v3.0.0, published July 18, 2026. First change listed: Add OIDC login support. See OIDC Docs (#433 via #941, #977, #982, #1003) (source)
• v2.9.1, published February 28, 2026. First change listed: Fix crash at startup for MySQL (#920 via #923) (source)
• v2.9.0, published February 13, 2026. First change listed: Add "push message" dialog to UI (#276 via #897 by @AlliotTech) (source)
• v2.8.0, published January 2, 2026. First change listed: Allow deleting application image (#448 via #855, #873) by @xavier-GitHub76, @LaurenceJJones (source)

From the README

• We welcome all kinds of contribution, including bug reports, feature requests, documentation improvements, UI refinements, etc. Check out CONTRIBUTING.md for guidelines. (source)

Who ships it

• jmattheis: 732 commits on the default branch (source)
• eternal-flame-AD: 60 commits on the default branch (source)
• martinfrancois: 9 commits on the default branch (source)
• DerDummePunkt: 8 commits on the default branch (source)
• RedwindA: 5 commits on the default branch (source)
• mateuscelio: 5 commits on the default branch (source)

kemalcr/kemal

Kemalcr · github.com/kemalcr/kemal

Week of October 5, 2026

• The connection is now ended when an exception arrives after the response headers are sent, so keep-alive does not read the next request from the same connection. Pull request #827
• A Range whose If-Range does not match the file being sent is now ignored, sending the full representation with 200. Pull request #825
• The connection is closed after every refused WebSocket handshake. Pull request #824
• A path that names no static file is left to the routes instead of being redirected. Pull request #823
• Content_for blocks are yielded into a buffer so a partial's reach the layout. Pull request #826

Merged pull requests

• Answer 400 to a multipart part header the stdlib cannot parse (#831, merged October 26, 2026 by hahwul) (source)
• Ignore .DS_Store files (#830, merged October 24, 2026 by hahwul) (source)
• Harden the examples against common security mistakes (#829, merged October 15, 2026 by hahwul) (source)
• Run every top-level path filter that matches the request (#828, merged October 13, 2026 by hahwul) (source)
• End the connection when an exception arrives after the headers are sent (#827, merged October 11, 2026 by sdogruyol) (source)
• Leave a path that names no static file to the routes instead of redirecting it (#823, merged October 11, 2026 by sdogruyol) (source)
• Hand content_for blocks the buffer they are yielded into, so a partial's reach the layout (#826, merged October 11, 2026 by sdogruyol) (source)
• Ignore a Range whose If-Range does not match the file being sent (#825, merged October 11, 2026 by sdogruyol) (source)
• Close the connection after every refused WebSocket handshake (#824, merged October 11, 2026 by sdogruyol) (source)

Releases

• v1.15.0, published October 17, 2026. First change listed: (SECURITY) Never route a request-target that does not start with /, and refuse a malformed one (GHSA-x97g-6h7h-q9w6). The route key is the method followed by the path with nothing in between, so the… (source)
• v1.14.0, published September 15, 2026. First change listed: (BREAKING) Answer a request whose path is routed for another HTTP method with 405 Method Not Allowed and the Allow header instead of 404, per RFC 9110 §15.5.6. With only get "/posts" registered, POST… (source)
• v1.13.0, published August 24, 2026. First change listed: (SECURITY) Delete uploaded temporary files for every request, not only for requests that reach Kemal::RouteHandler #776. Kemal::ParamParser spools multipart file parts to File.tempfile as soon as… (source)
• v1.12.0, published July 21, 2026. First change listed: Crystal 1.21.0 support :tada: (source)
• v1.11.0, published April 13, 2026. First change listed: (SECURITY) Fix chunked multipart body limits #748. Thanks @canermastan :pray: (source)
• v1.10.1, published March 24, 2026. First change listed: Add shutdowntimeout configuration for graceful shutdown: after Kemal.stop, Kemal can wait before exit so in-flight work can finish #745. Thanks @sdogruyol :pray: (source)

From the changelog

• 1.15.0: (SECURITY) Never route a request-target that does not start with /, and refuse a malformed one (GHSA-x97g-6h7h-q9w6). The route key is the method followed by the path with nothing in between, so the… (source)
• 1.15.0: (SECURITY) Run Kemal::Router filters for every request the router's routes serve, ws routes included (GHSA-89xc-29wg-6mm5). A router's filters were registered by path only for its HTTP and SSE… (source)
• 1.15.0: (BREAKING) Filters around a WebSocket handshake, following the fix above: (source)
• 1.15.0: The GET filters run for a handshake - top-level and router, including a pathless beforeget, which therefore runs on every handshake. A filter that assumes an HTTP route, such as env.route.path… (source)
• 1.15.0: A filter refuses a handshake with halt, or with a status a registered error handler covers; the refusal closes the connection. A status alone still upgrades, as it still runs an HTTP route's handler. (source)
• 1.15.0: after filters do not run for a handshake, since they would run once the 101 is on the wire - also where an HTTP route shares the path, which used to run them. (source)
• 1.15.0: (BREAKING) A router's filters apply to the router's own routes only. A top-level route or ws on the same path no longer runs them; guard it with top-level filters. For a request no route serves, the… (source)
• 1.15.0: (BREAKING) Run every top-level path filter whose path matches the request, in the order their paths were first registered, instead of only the most specific one. Global filters (beforeall and friends… (source)

From the README

• Build web applications and APIs with minimal code. 3.8k+ ⭐, 5M+ downloads since 2015. (source)

Who ships it

• sdogruyol: 685 commits on the default branch (source)
• Sija: 32 commits on the default branch (source)
• hahwul: 24 commits on the default branch (source)
• f: 19 commits on the default branch (source)
• mamantoha: 17 commits on the default branch (source)
• crisward: 14 commits on the default branch (source)

Laravel-Backpack/CRUD

Backpackforlaravel · github.com/Laravel-Backpack/CRUD

Week of September 14, 2026

• Released 7.1.20 with a fix for morphTo fields. Release
• Released 7.1.19 fixing grouped errors that were not rendering on the update operation. Release
• Released 7.1.18 with a fix for export columns to include those hidden by the mobile plugin. Release
• Released 7.1.17 with fixes and robust validation for uploaders to ensure only allowed file extensions are accepted. Release
• Released 6.8.17 with code style fixes. Release

Merged pull requests

• Save pivot data according to the field definition (#6097, merged November 10, 2026 by pxpm) (source)
• update docs (#6096, merged November 10, 2026 by pxpm) (source)
• Multiple fixes: Reorder, Uploads, Cache, Relations (#6095, merged November 10, 2026 by pxpm) (source)
• Memoize backpack_users_have_email() so N avatars no longer run N schema queries (#6089, merged November 1, 2026 by tabacitu) (source)
• fix search term in ListOperation (#6092, merged November 1, 2026 by pxpm) (source)
• set locale on item to fix translation issues (#6088, merged October 8, 2026 by pxpm) (source)
• Fix AuthenticateSession logging users out on Laravel 12.69.3+ and 13.33+ (#6086, merged October 6, 2026 by promatik) (source)
• fix morphTo fields (#6084, merged September 17, 2026 by pxpm) (source)
• Fix grouped errors not rendering on the update operation (#6083, merged September 17, 2026 by tabacitu) (source)
• fix export columns (#6082, merged September 16, 2026 by pxpm) (source)

Releases

• 7.1.26 🌈, published November 10, 2026. First change listed: Save pivot data according to the field definition (source)
• 7.1.25 🌈, published November 10, 2026. First change listed: Multiple fixes: Reorder, Uploads, Cache, Relations (source)
• 7.1.24 🌈, published November 1, 2026. First change listed: Memoize backpackusershaveemail() so N avatars no longer run N schema queries (source)
• 7.1.23 🌈, published November 1, 2026. First change listed: fix search term in ListOperation (source)
• 7.1.22 🌈, published October 8, 2026. First change listed: set locale on item to fix translation issues (source)
• 7.1.21 🌈, published October 6, 2026. First change listed: Fix AuthenticateSession logging users out on Laravel 12.69.3+ and 13.33+ (source)

From the README

• https://user-images.githubusercontent.com/33960976/228454020-91f42000-919e-413c-92c7-d406725f6dd2.mp4 (source)

Who ships it

• tabacitu: 5,066 commits on the default branch (source)
• pxpm: 2,040 commits on the default branch (source)
• StyleCIBot: 425 commits on the default branch (source)
• promatik: 308 commits on the default branch (source)
• maurohmartinez: 118 commits on the default branch (source)
• OwenMelbz: 58 commits on the default branch (source)

Lightning-AI/LitServe

Lightning · github.com/Lightning-AI/LitServe

Week of October 5, 2026

• HTTP request headers are now exposed to LitAPI hooks through context["headers"], so auth tokens, trace IDs and user agents can be read without repeating them in the body. Pull request #730
• Queue timeouts in the async loops are now passed by keyword, so the timeout actually applies instead of silently binding to block. Pull request #757
• DefaultContinuousBatchingLoop.add_request now accepts the transport argument, fixing a TypeError on the first request. Pull request #758
• Test_default_continuous_batching_prefill now passes headers in its requests, fixing a failure on main caused by the new five-value prefill unpacking. Pull request #772
• The flaky test_collate_requests case on Windows now uses a wider batch_timeout of 0.5 instead of 0.1, with unchanged runtime. Pull request #773
• CI workflows are pinned to ubuntu-24.04, macos-26 and windows-2025 instead of floating latest labels. Pull request #774

Merged pull requests

• fix(server): parse string max_payload_size values (#766, merged October 13, 2026 by bhimrazy) (source)
• fix(middlewares): skip configured internal paths in RequestCountMiddleware (#765, merged October 13, 2026 by bhimrazy) (source)
• fix(loops): don't kill the worker on an unpicklable exception (#759, merged October 12, 2026 by bhimrazy) (source)
• ci: cap pydantic<2.14 in the oldest-deps job (#784, merged October 12, 2026 by bhimrazy) (source)
• ci: pin runner images to ubuntu-24.04, macos-26, windows-2025 (#774, merged October 7, 2026 by bhimrazy) (source)
• test: widen batch_timeout in flaky test_collate_requests[0.1-2] (#773, merged October 7, 2026 by bhimrazy) (source)
• test(loops): pass headers in test_default_continuous_batching_prefill requests (#772, merged October 7, 2026 by bhimrazy) (source)
• Expose HTTP request headers to LitAPI via context["headers"] (#730, merged October 5, 2026 by OnePunchMonk) (source)
• fix(loops): accept transport in DefaultContinuousBatchingLoop.add_request (#758, merged October 5, 2026 by bhimrazy) (source)
• fix(loops): pass queue timeout by keyword in async loops (#757, merged October 5, 2026 by bhimrazy) (source)
• Add pyproject-fmt and validate-pyproject hooks (#755, merged September 22, 2026 by bhimrazy) (source)
• fix: reset active request count after errors (#748, merged September 22, 2026 by emecii) (source)

Releases

• Release v0.2.19, published September 9, 2026. First change listed: fix(ci): pin fastmcp below 4 to keep mcp on the 1.x line (source)
• Release v0.2.18, published August 12, 2026. First change listed: Support context argument in batch/unbatch methods by @discobot in #711 (source)
• Release v0.2.17, published December 23, 2025. First change listed: Add support for restarting the inference worker when they die (source)
• v0.2.16, published October 14, 2025. First change listed: bump linting to min python version py3.9 (source)
• v0.2.15, published July 31, 2025. First change listed: ci: add testing cron (source)
• v0.2.14, published July 22, 2025. First change listed: Bump mypy from 1.16.0 to 1.16.1 by @dependabot[bot] (source)

Who ships it

• williamFalcon: 300 commits on the default branch (source)
• aniketmaurya: 225 commits on the default branch (source)
• bhimrazy: 65 commits on the default branch (source)
• Borda: 31 commits on the default branch (source)
• lantiga: 23 commits on the default branch (source)
• andyland: 10 commits on the default branch (source)

mockoon/mockoon

Mockoon · github.com/mockoon/mockoon

Week of October 26, 2026

• Released version 9.10.0. Release
• Added an undo toast so deleted entities can be recovered, with insertion preserving the original position. Pull request #2436
• Added a new CLI flag to validate TLS certificates of proxied APIs. Pull request #2435
• Added support for Pro workspaces, including filtering remote environments by workspace and fetching workspaces periodically. Pull request #2420
• Updated dependencies, migrating to Express 5. Pull request #2438
• Fixed the Linux Snap build failing for the 9.10.0 release. Pull request #2441
• Published web-v9.10.0 with the release build fix, downgrading electron-builder to address the Snap build. Release
• Published libs-v9.10.0 with the release build fix, downgrading electron-builder to address the Snap build. Release
• Set the version to 9.10.0. Pull request #2440

Week of October 19, 2026

• Fixed removing an environment so the removal is no longer propagated to the sync after an EL event, correcting the presence shown on a cloud environment converted to local. Pull request #2417
• Introduced a new design for toasts. Pull request #2416
• Removed the discussion workflow. Pull request #2421
• Updated README.md. Pull request #2423
• Updated the README illustrations. Pull request #2422

Merged pull requests

• Fix urlParams helper after upgrade to latest path-to-regexp (#2453, merged November 9, 2026 by 255kb) (source)
• show callback transactions in logs (#2446, merged November 9, 2026 by sourav7274) (source)
• Stop live updating mocks from the client for Pro instances (#2451, merged November 5, 2026 by 255kb) (source)
• Add warning next to callback URL when the templating controls the destination (#2449, merged November 4, 2026 by 255kb) (source)
• Chore/release build fix (#2441, merged October 29, 2026 by 255kb) (source)
• Set version 9.10.0 (#2440, merged October 28, 2026 by 255kb) (source)
• Update dependencies (#2438, merged October 28, 2026 by 255kb) (source)
• feat: add undo toast to recover deleted entities (#2363) (#2436, merged October 27, 2026 by 255kb) (source)
• Add new CLI flag to validate TLS certificates of proxied APIs (#2435, merged October 27, 2026 by 255kb) (source)
• Add support for Pro workspaces (#2420, merged October 26, 2026 by 255kb) (source)
• Update README.md (#2423, merged October 23, 2026 by 255kb) (source)
• Update readme illustrations (#2422, merged October 23, 2026 by 255kb) (source)

Releases

• v9.10.0, published October 29, 2026. (source)
• v9.9.0, published September 16, 2026. (source)
• v9.8.0, published July 31, 2026. (source)
• v9.7.0, published June 19, 2026. (source)
• v9.6.1, published April 2, 2026. (source)
• v9.6.0, published March 31, 2026. (source)

From the README

• Mockoon is the easiest and quickest way to design and run mock APIs. No remote deployment, no account required, free and open-source. (source)

Who ships it

• 255kb: 778 commits on the default branch (source)
• gabrielperes97: 28 commits on the default branch (source)
• izerozlu: 28 commits on the default branch (source)
• barefootdeveloper: 11 commits on the default branch (source)
• ajatkj: 10 commits on the default branch (source)
• Thanakorn-ki: 9 commits on the default branch (source)

nxtrace/NTrace-core

Nxtrace · github.com/nxtrace/NTrace-core

Merged pull requests

• Add snapshot saving, exit summary, and help shortcuts (#397, merged September 13, 2026 by tsosunchia) (source)
• 同步 dev：扩展 MTR 统计与 Fields 编辑，新增停止摘要隐藏选项 (#396, merged September 11, 2026 by tsosunchia) (source)
• (SYNC) Enhance MTR with JSON output, session recording, and diagnostics (#395, merged September 8, 2026 by tsosunchia) (source)
• 同步 dev：加强 deploy 输入防护并开放显式 traceroute 与 tiny MTR (#394, merged September 6, 2026 by tsosunchia) (source)
• 同步 dev：升级 Go 1.27.1，优化 Geo/MTR 性能与并发生命周期 (#387, merged September 5, 2026 by tsosunchia) (source)
• fix(trace): 在稳定不可达响应后停止额外探测 (#384, merged August 21, 2026 by tsosunchia) (source)
• 同步 traceroute/MTR 终止语义与 NextTrace API 命名 (#383, merged August 15, 2026 by tsosunchia) (source)
• 集成独立 DNS 客户端并升级 Go 工具链 (#379, merged August 2, 2026 by tsosunchia) (source)
• 升级 Go 1.27.3、统一默认 JSON 后端并修复 MTR 终端刷新 (#401, merged October 31, 2026 by tsosunchia) (source)

Releases

• v1.7.6, published November 6, 2026. First change listed: 修复 iTerm2 选字时 MTR TUI 旧画面堆叠的问题：实时与回放统一按行更新变化内容，避免连续刷新写入滚动历史，并改善窗口缩放、残行清理和 Unicode 显示 (source)
• v1.7.5, published October 26, 2026. First change listed: 新增 MTR JSON 输出，覆盖 full、tiny 和 ntr：--mtr --json 输出 NDJSON 事件，-r/-w --json 输出最终汇总报告，诊断信息写入 stderr (source)
• v1.7.4, published October 11, 2026. First change listed: 新增 -k/--traceroute，可显式选择传统 traceroute；nexttrace-tiny 新增可选 MTR TUI、报告和 RAW 模式 (source)
• v1.7.3, published August 26, 2026. First change listed: 新增 traceroute 终止原因：根据 ICMPv4 / ICMPv6、TCP、UDP 的实际响应语义区分 destinationreached、unreachable 和 maxhops，不再通过响应 IP 是否等于目标 IP 判断终点 (source)
• v1.7.2, published August 13, 2026. First change listed: 新增独立 DNS 客户端模式：完整版 nexttrace 支持 -l / --dns，通过 NextTrace adapter 复用 natesales/q v0.19.12 公共子包，提供 q-compatible DNS 查询体验 (source)
• v1.7.1, published June 16, 2026. First change listed: 修复 Fast Trace 初始化流程：--fast-trace / --file 现在会先准备 LeoMoeAPI runtime，再进入快速测试，避免 GeoIP / FastIP 相关初始化缺失 (source)

From the README

• We are extremely grateful to DMIT, Misaka and SnapStack for providing the network infrastructure that powers this project. (source)

Who ships it

• tsosunchia: 1,137 commits on the default branch (source)
• sjlleo: 292 commits on the default branch (source)
• Yunlq: 43 commits on the default branch (source)
• missuo: 10 commits on the default branch (source)
• fakeboboliu: 4 commits on the default branch (source)
• Cryolitia: 3 commits on the default branch (source)

octobercms/october

Octobercms · github.com/octobercms/october

Week of September 21, 2026

• V4.4.8 released with datatable fixes Release
• V4.4.7 released with upstream sync Release
• New php artisan october:admin command added for creating admin users from the command line Pull request #6128
• Fixed sync/async browser events being swapped in ResponseMaker Pull request #6131
• Frontend database queries for theme language lines and template index are now cached to reduce repeated queries Pull request #6126

Merged pull requests

• Fix sync/async browser events being swapped in ResponseMaker (#6129) (#6131, merged September 22, 2026 by wakqasahmed) (source)
• Add october:admin command (#6128, merged September 22, 2026 by scottbedard) (source)
• Cache remaining cms queries (#6126, merged September 21, 2026 by scottbedard) (source)
• Fix Backspace clearing every tag in a customTags TagList (#6117, merged September 17, 2026 by wakqasahmed) (source)
• Cache theme data between requests (#6116, merged September 11, 2026 by scottbedard) (source)
• Fix scope filter option labels being HTML-escaped (#5935) (#6111, merged September 10, 2026 by wakqasahmed) (source)
• Fix MediaFinder paste button not updating across fields on the same page (#6106, merged September 5, 2026 by wakqasahmed) (source)
• Remove the duplicate exists key from the Finnish validation strings (#6102, merged September 3, 2026 by darkdi) (source)
• Allow enabling the change monitor from any form design (#6140, merged November 1, 2026 by wakqasahmed) (source)
• Extend media.auto_rename configuration to support folder creation and renaming (#6146, merged October 26, 2026 by PhilippeBlanko) (source)
• Add cms.component.beforeInit event before component init() (#6138, merged October 14, 2026 by Metallizzer) (source)
• Load demo code highlighting on demand (#6125, merged October 10, 2026 by samuelpatro) (source)

Releases

• v4.4.0 (v4.4 - User Content Release), published August 30, 2026. First change listed: Blog Post: https://octobercms.com/blog/post/user-submitted-content-october-cms-v4-4 (source)
• v4.3.0 (v4.3 - Feature Release), published July 19, 2026. First change listed: Blog Post: https://octobercms.com/blog/post/whats-new-octobercms-v4-3-released-2026 (source)
• v4.2.0 (v4.2 - Modernization Release), published March 30, 2026. First change listed: Blog Post: https://octobercms.com/blog/post/ecommerce-for-october-cms-here (source)
• v4.1.0 (v4.1 - AJAX Release), published January 4, 2026. First change listed: Blog Post: https://octobercms.com/blog/post/introducing-larajax-october-cms-v4-1 (source)
• v4.0.0 (v4.0 - Stable Release), published September 21, 2025. First change listed: Blog Post: https://octobercms.com/blog/post/whats-new-october-cms-v4 (source)
• v3.7.0 (v3.7 - Feature Release), published October 11, 2024. First change listed: Blog Post: https://octobercms.com/blog/post/october-cms-celebrates-10-years-v3-7-release (source)

From the README

• October is a Content Management System (CMS) and web platform whose sole purpose is to make your development workflow simple again. It was born out of frustration with existing systems. We feel building websites has become a convoluted and confusing process that leaves developers unsatisfied. We want to turn you around to the simpler side and get back to basics. (source)

Who ships it

• daftspunk: 9,354 commits on the default branch (source)
• LukeTowers: 570 commits on the default branch (source)
• alekseybobkov: 328 commits on the default branch (source)
• bennothommo: 220 commits on the default branch (source)
• octoberapp: 103 commits on the default branch (source)
• scottbedard: 97 commits on the default branch (source)

OliveTin/OliveTin

Olivetin · github.com/OliveTin/OliveTin

Week of October 19, 2026

• Released 3000.21.0, adding -syntaxcheck and -startuptrace CLI flags and fixing the default dashboard build to hold MapActionBindingsLock. Release
• Fixed a server crash on 3000.20.0 when the config reloaded while a client called Init, by holding MapActionBindingsLock while building the default dashboard. Pull request #1130
• Fixed EventStream client slots being held after a browser tab closes or reloads, so the limited number of concurrent clients is freed on disconnect. Pull request #1136
• Fixed the argument form grid so it can shrink on narrow screens. Pull request #1129
• Added the semantic-release github plugin so released fixes get a success comment on the issues they resolve and a failed release opens an issue. Pull request #1138
• Added a configuration syntax-check mode that reports discovered files and issues with an exit status, plus a latching-toggle solution for state-based actions. Pull request #1137

Merged pull requests

• ci: comment on resolved issues via semantic-release github plugin (#1138, merged October 24, 2026 by jamesread) (source)
• Next (#1137, merged October 23, 2026 by jamesread) (source)
• fix: let the argument form grid shrink on narrow screens (#1129, merged October 22, 2026 by VirtualDisk) (source)
• fix: release EventStream slots when the client disconnects (#1136, merged October 22, 2026 by fannta1990) (source)
• fix: hold MapActionBindingsLock while building the default dashboard (#1130, merged October 22, 2026 by alperu) (source)

Releases

• 3000.21.0, published October 24, 2026. First change listed: aa575380402e5941aca6ff76ffff899df5911505 feat(cli): add -syntaxcheck and -startuptrace (source)
• 3000.20.0, published September 10, 2026. First change listed: d5aa3bfe336bf749d186b8e899ba8c3745562770 feat(locale): added option for zh-Hant to actually have the langauge (source)
• 3000.19.0, published August 11, 2026. First change listed: 5741c8ea2c2b2c105d426e56413643fcc654c0a5 feat: Alpha support for search (behind feature gate) (source)
• 3000.18.1, published July 29, 2026. First change listed: 9e7a397898bb5c905e12d478469a876243d9eccf fix: Action title styling on the argument form (source)
• 3000.18.0, published July 28, 2026. First change listed: fe1ac20935665ee645858ced90d399c2c41ef1c9 feat: Show config issues in diagnostics (source)
• 3000.17.4, published July 22, 2026. First change listed: bcf5324dae77fb1afbe1a04f31531239db8b1f87 fix: macos signing checks (source)

From the README

• OliveTin gives safe and simple access to predefined shell commands from a web interface. (source)

Who ships it

• jamesread: 1,607 commits on the default branch (source)
• hackdefendr: 12 commits on the default branch (source)
• yohanyflores: 4 commits on the default branch (source)
• wushuzh: 4 commits on the default branch (source)
• babraham123: 3 commits on the default branch (source)
• bernard-crnkovic: 3 commits on the default branch (source)

pocketbase/pocketbase

Pocketbase · github.com/pocketbase/pocketbase

Releases

• v0.40.4 Release, published September 12, 2026. First change listed: Fixed migration deadlock if a logs db write happens to run while the migration is still executing (#7836). (source)
• v0.40.3 Release, published September 6, 2026. First change listed: Write the status header for JSON responses only if the fields picker succeed or has acceptable fallback. (source)
• v0.22.55 Release, published September 6, 2026. First change listed: (Backported from v0.40.3) Fixed collection index validator to allow expressions with parenthesis in the optional WHERE clause. (source)
• v0.40.2 Release, published September 2, 2026. First change listed: Return an error when filter params fallback fails to json serialize and optimized params replacement to execute in a single pass. (source)
• v0.22.54 Release, published September 2, 2026. First change listed: (Backported from v0.40.2) Bumped goja and its related dependencies (regex unescaped dash error fix and base64 optimizations). (source)
• v0.40.1 Release, published August 24, 2026. First change listed: Fixes for some reported regressions related to the encoding/json/v2 update: (source)
• v0.40.6 Release, published October 23, 2026. First change listed: Replaced the GitHub update command with update from the new host in relation to #7841. (source)
• v0.22.57 Release, published October 23, 2026. First change listed: (Backported from v0.40.6) Added a global restriction for the max WxH pixels size when generating a thumb to reduce the risk of excessive memory usage. (source)
• v0.40.5 Release, published October 8, 2026. First change listed: Minor improvements for the JSVM migration error handling: (source)
• v0.22.56 Release, published October 8, 2026. First change listed: (Backported from v0.40.5) Bumped the min Go GitHub action version to 1.27.2 as it includes several net/http security fixes. (source)

From the changelog

• 0.40.6: Replaced the GitHub update command with update from the new host in relation to #7841. (source)
• 0.40.6: Additional fileblob bucket escape checks for just in case if the filesystem abstraction is used as standalone without the PocketBase validations. (source)
• 0.40.6: Added a global restriction for the max WxH pixels size when generating a thumb to reduce the risk of excessive memory usage. (source)
• 0.40.6: Bumped the min Go GitHub action version to 1.27.3 as it includes a security fix related to the recent eMudhra CA compromise. (source)
• 0.40.6: Bumped golang.org/x/ dependencies (#7865). (source)
• 0.40.6: Bumped goja and its related dependencies (string allocations optimization, Date.getYear/setYear support and other minor correctness fixes). (source)
• 0.40.6: Minor UI fixes - superuser IPs description grammar fix, rotating btn loader icon alignment fix, slight dark background correction in attempt to minimize the color profile differences between Chrome… (source)
• 0.40.5: Minor improvements for the JSVM migration error handling: (source)

From the README

• ⚠️ The repo has moved to https://ganigeorgiev.com/pocketbase/pocketbase. (source)

Who ships it

• ganigeorgiev: 2,514 commits on the default branch (source)
• ValleyZw: 5 commits on the default branch (source)
• yuxiang-gao: 3 commits on the default branch (source)
• dschissler: 2 commits on the default branch (source)
• KunalSin9h: 2 commits on the default branch (source)
• MarvinJWendt: 2 commits on the default branch (source)

PokeAPI/pokeapi

Pokeapi · github.com/PokeAPI/pokeapi

Week of September 21, 2026

• Released master branch at commit 168b1e89467054cda2e7df43ccebbb69b459497a on 2026-09-27. Release
• Added 63 Alcremie evolution forms with new spin direction and spin duration evolution variables to handle Milcery's complex evolution conditions based on cream type and sweet decoration. Pull request #1682
• Added Spanish (es-419) translations for Mega Stones and Legends: Arceus Poké Balls, and corrected existing es-419 item translations. Pull request #1686
• Added 38 missing Vivillon pattern form references to the Scatterbug and Cascoon evolution lines to represent all 20 pattern variations. Pull request #1677
• Centralized sprite lookup configuration and updated sprite build logic to provide more consistent sprite handling across form variations. Pull request #1681
• Fixed OpenAPI schema by adding nullable annotation for Location.region field. Pull request #1683

Merged pull requests

• Add and correct es-419 item translations (#1686, merged September 26, 2026 by Capuccio) (source)
• feat: Add Alcremie cream and sweet evolution conditions (#1682, merged September 25, 2026 by MiquelRForgeFlow) (source)
• add OpenAPI nullable annotation for Location.region (#1683, merged September 25, 2026 by kayleesk) (source)
• feat: Centralize sprite lookup config, update logic for sprite lookup (#1681, merged September 24, 2026 by FallenDeity) (source)
• feat: Add Vivillon pattern form references to Scatterbug evolution line (#1677, merged September 23, 2026 by MiquelRForgeFlow) (source)
• feat: Add ditto for full regression check (#1676, merged September 17, 2026 by FallenDeity) (source)
• Force Hasura healthcheck (#1675, merged September 16, 2026 by Naramsim) (source)
• feat: Audit and add all divergent/regional evolution lines (#1656, merged September 16, 2026 by FallenDeity) (source)
• Fix k8s cicd (#1673, merged September 12, 2026 by Naramsim) (source)
• Add new mega abilities and Pokemon added Champions 1.2 (#1672, merged September 10, 2026 by jemarq04) (source)
• Fix version groups for Gen 2 baby Pokemon evolutions (#1671, merged September 9, 2026 by jemarq04) (source)
• Fix column indices when building MoveChange from move_changelog.csv (#1669, merged September 8, 2026 by santichausis) (source)
• feat: update openapi schema generation serializers/hooks (#1711, merged November 9, 2026 by FallenDeity) (source)
• Refactor and Type Hint build.py (#1705, merged November 2, 2026 by FallenDeity) (source)
• feat: Add types to build.py and refactor helper methods (#1707, merged November 2, 2026 by Naramsim) (source)
• Avoid per-row queries for evolution condition variables and natures (#1690, merged October 30, 2026 by santichausis) (source)
• Update vm creation/add cache conf (#1703, merged October 30, 2026 by Naramsim) (source)
• fix: nature names in es-419 have been fixed (#1702, merged October 20, 2026 by Capuccio) (source)
• Update ability changelog prose & trace in ability prose (#1699, merged October 17, 2026 by notblisy) (source)
• feat: Add champions sprites, reformat sprite config (#1701, merged October 16, 2026 by FallenDeity) (source)
• feat: Add gen 9 sprites to the sprite config (#1698, merged October 13, 2026 by FallenDeity) (source)
• Fix Omega Ruby/Alpha Sapphire sprite key in generation-vi sprites (#1689, merged October 7, 2026 by santichausis) (source)
• Refactor sprites build (#1691, merged October 7, 2026 by FallenDeity) (source)
• Fix the language id for the Spanish translations of “Heavy Ball” (#1693, merged October 6, 2026 by Dropries) (source)

Releases

• master-branch, a pre-release published July 10, 2026. First change listed: Date: 2026-11-09T11:37:34+01:00 (source)
• 2.9.0, published January 31, 2025. First change listed: remove data from container (source)
• 2.7.0, published January 13, 2024. First change listed: Django upgrade to 3.1 (source)
• 2.6.0, published November 15, 2023. First change listed: data: fix pound id on SV pokemonmoves (source)
• 2.5.0, published May 26, 2023. First change listed: Add growth rate to generation 9 Pokémon (source)
• 2.4.0, published January 23, 2023. First change listed: add new CSV data (source)

From the README

• Each time the build-db script is run, it will iterate over each table in the database, wipe it, and rewrite each row using the data found in data/v2/csv. (source)

Who ships it

• Naramsim: 1,048 commits on the default branch (source)
• jemarq04: 257 commits on the default branch (source)
• zaneadix: 116 commits on the default branch (source)
• phalt: 87 commits on the default branch (source)
• giginet: 83 commits on the default branch (source)
• Indyandie: 65 commits on the default branch (source)

Other APIs and backends repositories

• appwrite/appwrite
• bitwarden/server
• ccxt/ccxt
• EasyCorp/EasyAdminBundle
• fastly/pushpin
• getmaxun/maxun
• go-vikunja/vikunja
• goadesign/goa
• gotenberg/gotenberg
• heroiclabs/nakama
• hoppscotch/hoppscotch
• iii-hq/iii
• Kong/insomnia
• kuzzleio/kuzzle
• loco-rs/loco
• makenotion/notion-sdk-js
• middleapi/orpc
• NangoHQ/nango
• neovim/neovim
• opnsense/core
• ppy/osu-web
• presenton/presenton
• ruby-grape/grape
• scalar/scalar
• Skyvern-AI/skyvern
• stoatchat/stoatchat
• strapi/strapi
• svix/svix-webhooks
• Sylius/Sylius
• tModLoader/tModLoader
• trpc/trpc
• unkeyed/unkey
• wp-graphql/wp-graphql
• wppconnect-team/wppconnect