Week 43, Oct 19-25, 2026

This week: 187 releases, 129 news items. Notable: kuma v3.0.0.

👋 Welcome

This week in Cloud Native saw a substantial number of patch releases across various projects, focusing on stability and security. Key developments included advancements in Kubernetes’ ability to manage AI agent workloads and expanded open-source security initiatives. The community also explored ways to integrate sustainability metrics into observability stacks.

🚀 Notable Releases

CI/CD

  • Argo CD v3.5.5 - This release provides installation manifests for both non-HA and HA configurations, and container images are signed by cosign.
  • Argo CD v3.4.11 - Offers installation manifests for non-HA and HA setups, with container images signed by cosign.
  • Argo CD v3.3.16 - Includes installation manifests for non-HA and HA deployments, with container images signed by cosign.
  • Werf v3.10.0 - Adds support for fetching only the pinned commit of a submodule if missing locally during build and introduces Helm-compatible release storage with streamed reads for deployment.
  • Werf v2.83.0 - Enables fetching only the pinned commit of a submodule missing locally during build and fixes recovery for interrupted file imports.
  • Werf v3.9.0 - Exposes Git source provenance to build commands and accepts unsuffixed list environment variables during build and deploy.
  • Werf v2.82.0 - Exposes Git source provenance to build commands and supports separate metadata repositories in v2.

Networking

  • Cilium v1.20.3 - Adds IMDSv2 (token-based) instance metadata access for Alibaba Cloud and fixes conntrack garbage collection issues that could lead to NAT mapping deletion for live connections.
  • Cilium v1.19.9 - Fixes incorrect deletion of new endpoints during garbage collection and addresses silent ignoring of ip6tables chain rename errors during rule reconciliation.
  • Cilium v1.18.15 - Fixes incorrect deletion of new endpoints during garbage collection, silent ignoring of ip6tables chain rename errors, and restoration of terminating backends.
  • Envoy v1.40.0 - Switches from WORKSPACE to bzlmod, requiring downstreams to migrate to MODULE.bazel and add Envoy’s custom Bazel registry.
  • Envoy v1.39.4 - Fixes race conditions in AWS request signing, AWS Lambda, and composite filters where route-level configurations could be destroyed prematurely.
  • Envoy v1.38.7 - Bumps wasmtime to 24.0.10 to resolve CVE-2026-54786 and fixes race conditions in AWS and dynamic_modules filters.
  • Envoy v1.37.9 - Bumps wasmtime to 24.0.10 to resolve CVE-2026-54786 and fixes race conditions in AWS and local rate limit filters.
  • Envoy v1.36.13 - Bumps wasmtime to 24.0.10 to resolve CVE-2026-54786 and fixes race conditions in AWS and local rate limit filters.
  • K8GB v1.0.1 - Includes documentation updates for README badges, typos, and alignment of K8s, Go, and Liqo versions with CI.
  • Kgateway v2.4.7 - Fixes PreferNetwork and other network-aware traffic distribution splitting traffic across networks when pods lack the topology.istio.io/network label.
  • Kgateway v2.3.11 - Updates the Envoy dependency to v1.37.9.
  • Kuadrant Operator v1.5.4 - Enables installations of Authorino Operator v0.25.4, Limitador Operator v0.18.5, DNS Operator v0.17.3, WASM Shim v0.14.3, ConsolePlugin v0.4.3, and Developer Portal Controller v0.2.3.
  • Kube-OVN v1.15.31 - Allocates unique MAC addresses for SwitchLB VIPs, preserves VM and StatefulSet subnets when reusing IP addresses, and restores provider bridge NORMAL flows after OVS restarts.
  • Kube-OVN v1.16.14 - Preserves subnet and network identity during VM migration or StatefulSet Pod recreation, removes orphaned Chassis_Private rows, and maintains SecurityGroup rule hash accuracy.
  • Kube-OVN v1.16.13 - Fixes orphaned U2O overlay address-set cleanup and refreshes network policies when Pod, Namespace, cluster, or admin policy labels change.
  • Kube-VIP v1.3.0 - Introduces a breaking change that restricts shared VIPs to same-lease Cluster Services.
  • Submariner v0.26.0-m0 - A maintenance release.
  • Praxis v0.7.4 - Fixes policy handling to give each runtime its own sub-request connector and improves TLS verification for IP-literal hostnames.

Container Runtime

  • Containerd v2.4.2 - Includes security updates for CVE-2026-95839, GHSA-8647-2jxj-p2rc, and GHSA-hc94-p972-ch66.
  • Containerd v2.3.7 - Includes security updates for CVE-2026-95839, GHSA-5p7c-hggf-c748, and GHSA-8647-2jxj-p2rc.
  • Containerd v2.2.10 - Includes security updates for CVE-2026-95839, GHSA-5p7c-hggf-c748, and GHSA-8647-2jxj-p2rc.
  • Containerd v2.0.14 - Includes a security update for GHSA-hc94-p972-ch66 and applies hardening to not follow symlinks for container log files in CRI.
  • Hyperlight v0.18.0 - Adds Windows on ARM64 support using the WHP backend and virtqueue-based host-guest communication.
  • Podman v6.1.4 - Fixes an issue where Podman would not function under WSL 3 and updates gvproxy to v0.9.0, resolving CVE-2026-107935.
  • Podman v5.8.9 - Fixes an issue where Podman would not function under WSL 3 and addresses a bug with podman machine VMs on Mac where machines could be left in an inconsistent state.

Security

  • Open Policy Agent v1.21.2 - Builds OPA binary artifacts with Go v1.27.2 and addresses a mismatch in handling encoded slashes in authorization policy input and the Data API.
  • SPIFFE/SPIRE v1.15.4 - Adds support for configuring TLS policies on TLS listeners and fixes an issue where the server accepted PROXY protocol headers with non-TCP source addresses when PROXY protocol support is enabled.
  • SPIFFE/SPIRE v1.14.8 - Fixes a crash in the agent’s SDS v3 API when a client sent a DiscoveryRequest with an empty node user agent build version.
  • AthenZ v1.12.50 - Sanitizes error objects before logging in the UI and fixes a microsegmentation functional test race condition.
  • Cedar v4.14.0 - Adds support for the external keyword to declare undefined entity types and actions, allowing schemas to hold partial definitions.
  • Cedar Policy Symcc v0.8.0 - Changes IP address ordering (via Ord and PartialOrd) where a prefix-less address is now greater than an otherwise equivalent address with a prefix.
  • Cedar Policy CLI v4.14.0 - Provides prebuilt binaries and scripts for installation.
  • External Secrets v2.13.0 - Validates manifest Secret candidates.
  • External Secrets Helm Chart 2.13.0 - Helm chart release for external secrets management.
  • Keycloak 26.8.1 - Fixes CVE-2026-15943, where OIDC identity provider update reuses masked client secret after token URL changes.
  • Kubescape v4.0.16 - Adds RBAC parity differential testing and honors control exclusions in HTTP scans.
  • KubeArmor v1.7.6 - Fixes vulnerabilities in dependencies and adds OSV scanning to the CI workflow.
  • Open Key Management v0.11.0 - Adds key config limit override to tenant configurations and introduces System Grouping.
  • OpenSSF Scorecard v5.6.0 - Marks the first release since hosted services migrated to AboutCode Foundation infrastructure.
  • OpenSSF OSV-Schema v1.9.2 - Updates schema documentation to clarify semantically neutral ID guidance.
  • OpenSSF Scorecard Action v2.5.0 - Moves the action to Scorecard v5.6.0, with its container image built with Go 1.27.2 on a refreshed distroless base.
  • Seebom BOMHort v0.8.0 - Fixes GHSA-943f-mm2v-j478 by injecting SERVICE_TOKEN only on GET/HEAD requests in the UI’s nginx, preventing anonymous write requests from being authenticated.
  • Trivy v0.76.0 - A new release with detailed changelog available.

Observability

  • OpenTelemetry Collector v0.163.0 - Adds dist.resource.detection.detectors to the builder config, allowing distributions to opt into a smaller set of resource detection processor detectors.
  • Open-Feature Provider TCK v0.1.0 - Adds provider conformance assets.
  • Kubernetes Headlamp Helm 0.46.0 - Helm chart release for Headlamp, a Kubernetes web UI.
  • Kubernetes Headlamp v0.46.0 - Introduces alpha support for Kubernetes Dynamic Resource Allocation, making device classes, GPU claims, and claim templates visible in the dashboard.
  • HolmesGPT v0.45.0 - Implements multi-tenant Prometheus toolset routing by a Kubernetes label for Mimir X-Scope-OrgID.
  • HolmesGPT v0.44.0 - Prices Robusta models whose upstream name isn’t provider/id and defaults the auto executor to one conversation at a time.

Storage

  • Rook v1.20.9 - Enforces secure msgr2 mode for Ceph monitor connections, rejects purely numeric topology values in validation, and adds trafficDistribution to the RGW service spec.
  • Rook v1.19.12 - Allows missing lifecycle notification events for objects and waits for OSD upgrades before reconciling.
  • Kubernetes CSI External Snapshotter v8.7.0 - Volume snapshotting is a GA feature since Kubernetes v1.20, supporting CSI Spec Versions 1.0-1.13. VolumeGroupSnapshot moves to GA in CSI spec v1.11.0.
  • Kubernetes CSI External Snapshotter Client v8.7.0 - Enables the VolumeGroupSnapshot feature gate.

Build

  • Helm v4.3.1 - A patch release encouraging users to upgrade for a better experience.
  • Helm v3.22.1 - A patch release encouraging users to upgrade for a better experience.
  • KubeVirt v1.9.1 - A patch release following v1.9.0, consisting of 83 changes.
  • Podman Desktop v1.30.5 - Fixes JavaScript exception pop-ups when the main window is gone and enforces directory boundaries in the webview file server.
  • Shipwright Build v0.21.9 - A rebuild of all components to address vulnerabilities in the base images.
  • Buildah v1.45.2 - Updates storage to v1.64.2.
  • Buildah v1.43.5 - Updates storage to v1.62.2 and fixes a typo in bud test.

Service Mesh

  • Istio 1.31.2 - Release notes available on the Istio website.
  • Istio 1.30.6 - Release notes available on the Istio website.
  • Istio 1.29.9 - Release notes available on the Istio website.
  • Kuma v3.0.0 - A major release that removes 12 legacy policies (TrafficPermission, TrafficRoute, TrafficLog, TrafficTrace, HealthCheck, CircuitBreaker, Retry, Timeout, FaultInjection, ExternalService, RateLimit, VirtualOutbound) and changes several defaults. Requires changes before upgrading.
  • Kuma v2.14.6 - Bumps Envoy from 1.38.4 to 1.38.7 and golang.org/x/net from 0.58.0 to 0.60.0.

Database

  • Vitess v24.0.5 - VTGate now rejects unsupported sql_mode values by implementing MySQL 8.x’s sql_mode assignment semantics and validating every assignment against them.
  • Vitess v23.0.8 - VTGate now rejects unsupported sql_mode values by implementing MySQL 8.x’s sql_mode assignment semantics and validating every assignment against them.
  • OpenEverest v1.17.0 - Requires built-in account passwords to be at least 8 characters.
  • Crate v6.5.0 - Release notes available on the CrateDB website.

Chaos Engineering

  • Chaos Mesh v2.8.5 - Includes fixes for HTTPChaos, multi-cluster experiments, and the Dashboard.
  • LitmusChaos v3.33.0 - Fixes subscriber adminModeNamespace for chaos engine probe check and adds unit tests for ChaosHub output mapping and Loader component.
  • Chaosblade v1.8.2 - Provides full packages and Docker images for various platforms.
  • Chaosblade v1.7.6 - Provides full packages and Docker images for various platforms.

Orchestration

  • Volcano v1.16.0 - Introduces NamespaceQueue and the fairshare plugin to support different tenancy models, allowing tenants to manage queue hierarchies and quotas within their namespaces.
  • Agent Substrate v0.5.0 - Introduces breaking changes: SandboxConfig now holds multiple named versions with a default, and SnapshotContentScope is replaced with SnapshotFidelity ladder and preferred_fidelity.
  • Armada v0.22.14 - A patch release for the Armada batch job queueing system.
  • Armada v0.22.13 - A patch release for the Armada batch job queueing system.
  • CozyStack v1.6.5 - A patch release with backported fixes for tenant Kubernetes cluster bootstrap, Application updates, suspended HelmRelease handling, Cilium and Kube-OVN address allocation, tcp-balancer on HAProxy 3.3+, and Alertmanager delivery.
  • KAI-Scheduler v0.16.12 - Adds Helm chart OCI tags without a ‘v’ prefix, enabling semver ranges, and allows the post-delete cleanup job to run on OpenShift.
  • KAI-Scheduler v0.18.6 - Changes node scoring and sorting for tasks without per-worker score maps and fixes the retention of replacement subgroups in the job’s required topology domain.
  • NVIDIA OpenShell v0.1.4 - Runs the gateway as a user service by default in snap.

Remote Procedure Call

  • Connect-Go v2.0.1 - Fixes draining gRPC response bodies after rejecting messages and keeps sending unary request bodies after an early response.
  • Connect-Go v1.21.1 - Fixes draining gRPC response bodies after rejecting messages and keeps sending unary request bodies after an early response.

Configuration

  • Metal3-io Baremetal Operator v0.14.2 - Fixes setting image_type in Ironic to avoid unnecessary HEAD calls and bumps Go to 1.26.9.
  • Metal3-io Baremetal Operator v0.13.6 - Bumps Kubernetes and CAPI group dependencies.
  • OpenTofu v1.12.8 - Addresses a security advisory regarding potential excessive CPU usage if connecting to an attacker-controlled HTTP2 server during dependency installation in tofu init.
  • KCL v0.13.2 - Populates source locations in arcanist/SARIF output, publishes kcl-lib for windows/arm64, and fixes LSP completion behavior.
  • Kubean v0.39.2 - Bumps Docker setup-buildx-action and GitHub actions/setup-go dependencies.

Messaging

  • Strimzi Kafka Operator 1.3.0 - Supports Kubernetes 1.32 and newer, and only supports CRD API v1 (older v1beta2, v1beta1, v1alpha1 APIs are no longer supported).

Operating System

Sustainability

  • Chantico v0.18.2 - Fixes deployment for the DCR graph visualization webapp.
  • Chantico v0.18.1 - Removes a patch helper and uses an external patch package for referenced DCR.

Workflow Orchestration

  • Hive v5.186.4 - Fixes an issue where an agent whose live CLI pane remains off its input prompt after repeated undeliverable kicks would stay wedged.
  • Hive v5.186.3 - Prevents partial re-reviews from displacing prior changes_requested or reject aggregates, retaining requires_human status.
  • Hive v5.186.2 - Improves hub-side plumbing for lane-scoped queue depth, preferring laneQueuedWork over the hive-wide backlog for idle rules.
  • Hive v5.186.1 - Routes Hive-authored non-risk reviewer findings with concrete remediation through the normalized changes-requested fixer path.
  • Hive v5.186.0 - Adds single-click global cadence setting templates in the dashboard Governor matrix and hivectl hives preset adopt/refresh commands.
  • Hive v5.185.0 - Adds contributor repository scope, allowing a hive to advertise its contribution-eligible repositories and accept a versioned repo_scope from a relay.
  • Hive v5.184.0 - The hub evidence drill-down now keeps “Revert rate by author kind” when filters are active and adds a per-axis criteria table to GET /api/hub/evidence.
  • Hive v5.183.1 - Trusted human GitHub approval reviews on the exact PR head now clear L6 self-authored requires_human review holds without weakening changes-requested verdicts.
  • Hive v5.183.0 - Adds default-off Hive-self experiment flags delivered per hive over heartbeat and shows pooled revert rates by human, agent, and bot author in the hub evidence drill-down.
  • Hive v5.182.0 - Adds a separate Hive-self experiment model and validated persistent ledger and hivectl evidence backfill-issues for writing GitHub issue series files.
  • Hive v5.181.1 - Fixes hive-open-pr rejecting pull requests with 300 or more files in their base...head comparison.
  • Hive v5.181.0 - Nous observations now use the hub self-report relay to create parked, fingerprint-deduplicated issues in hivecommons/hive without exposing watched project files.
  • Hive v5.180.0 - Adds a deterministic background-only Hive-self experiment decision core for registered snapshot windows, metric thresholds, and fast-fail revert requests.
  • Hive v5.179.0 - Evidence bundles now record merge.opened_at (the PR’s GitHub creation time) on live merges and in hivectl evidence backfill, making time to merge measurable per PR.
  • Hive v5.178.0 - The dashboard Throughput section gains an Evidence sub-panel with reviewer calibration and accuracy by model family.
  • Hive v5.177.5 - Go builder images now pin golang:1.27-alpine index digest resolving to Go 1.27.2, picking up standard-library fixes for various net and crypto packages.
  • Hive v5.177.4 - Exposes more governor settings in the dashboard Settings dialog, including eval-loop pacing knobs and auto-merge queue labels.
  • Hive v5.177.3 - Exposes remaining GitHub connection settings in the dashboard Settings dialog, such as API quota floors and PR detail cache TTL.
  • Hive v5.177.2 - Fixes the dashboard agent card showing stale drift and ensures kick_failed_repeatedly self-reports state why a kick was undeliverable.
  • Hive v5.177.1 - Fixes hive parking its own work on hard-suppress labels and never lifting them, instead applying a soft needs-sha label for trusted reporters.
  • Hive v5.177.0 - The bead synthesizer now sends conditional (If-None-Match) PR GETs and reuses cached PRs on 304, capping charged calls per cycle.
  • Hive v5.176.0 - Exposes review gate settings in the dashboard Settings dialog (Features → Review gate) and allows editing global agent_sandbox.* scalar settings.
  • Hive v5.175.0 - Exposes retro lane settings (scan interval, fix-attempt, kick and long-stall thresholds, recent-closed window) in the dashboard Settings dialog.
  • Hive v5.174.0 - Exposes ioscan and OpenTelemetry settings in the dashboard Settings dialog.
  • Hive v5.173.1 - Fixes the dashboard Channel card reporting a successful upgrade to a commit other than the one the hive is running.
  • Hive v5.173.0 - Exposes every release_sentinel.* key on the Governor Features tab in dashboard settings, and governor project observability target, claims, rotation, and trajectory settings.
  • Hive v5.172.0 - Exposes governor question auto-close settings in the dashboard Settings dialog. Hosted hives with auto_upgrade: true but no auto_upgrade_mode now upgrade on a daily schedule.
  • Hive v5.171.0 - Context7 is now a connector card in Knowledge → Integrations and exposes governor stall replan settings in the dashboard Settings dialog.
  • Hive v5.170.0 - Exposes governor advisory digest and queue-health settings in the dashboard Settings dialog.
  • Hive v5.169.0 - Standalone contributors now publish their own subscription quota readings, and adds the owner-gated review.contributor_prs.base_sync setting.
  • Hive v5.168.0 - Exposes every notifications.* key in dashboard settings and the hive now closes an advisory-only dedupe checklist with a one-line comment once every #N it references is closed or merged.
  • Hive v5.167.0 - Adds src/scripts/dashboard-mobile-shots.mjs, a headless-Chrome harness that screenshots the dashboard at various mobile resolutions.
  • Hive v5.166.5 - The close-on-merge ledger sweep no longer re-reads every merged-PR claim’s issue from GitHub on every governor pass.
  • Hive v5.166.4 - The dashboard agent card now shows the full inference backend error from hive’s proxy while Claude Code is still retrying.
  • Hive v5.166.3 - The reporter-trust wait comment now links GOVERNANCE.md with the full owner/repo path.
  • Hive v5.166.2 - Kick log headers now record hive_version:, hive_commit:, backend:, model: and tmux_session: alongside existing keys.
  • Hive v5.166.1 - Fixes naming the upstream URL in inference-backend error responses and makes TestEvalIntervalForConfigWithoutWebhooksMatchesBudget deterministic.
  • Hive v5.166.0 - A Kubernetes or Podman hive expected to run per-agent UID isolation but booted on the shared dev UID now raises a failing uid_isolation health check.
  • Hive v5.165.3 - The built-in project.label_driven_trusted_bots default no longer includes github-actions[bot] due to shared identity risks.
  • Hive v5.165.2 - Hub-managed upgrades now patch a spoke Deployment directly if the heartbeat fallback stays armed too long, allowing crash-looping spokes to receive the target image.
  • Hive v5.165.1 - The arm64 agent image now ships an arm64 Go toolchain, fixing Exec format error for go in-pod.
  • Hive v5.165.0 - Adds label-driven approval via triage/accepted on Prow-style repos, strictly opt-in per repository.
  • Hive v5.164.0 - Introduces a scheduled issue+PR duplicate-triage lane with a dedupe agent, reading open issues and pull requests to verify near-duplicates.
  • Hive v5.163.1 - An assigned hive that stops heartbeating now keeps its critical offline alert after the hub prunes its registry entry.
  • Hive v5.163.0 - CreatePR now redirects to an existing PR instead of opening a duplicate when an open PR already closes the same issue or edits an overlapping file set.
  • Hive v5.162.0 - Kick work lists now surface open folded-tracker issues (<!-- hive-finding-folded -->) so agents comment on the tracker instead of filing new issues.
  • Hive v5.161.6 - The same-component fold for agent-filed findings now also counts App-bot issues on the shared path that were closed as completed in the last 14 days.
  • Hive v5.161.5 - Bumps omp from 18.9.1 to 18.10.1.
  • Hive v5.161.4 - The API budget now uses the remaining count GitHub returns on every response, going to conserve / critical even when the /rate_limit reading is stale.

Application Frameworks

  • Spin Canary - A canary release of the most recent commits on the main branch, not stable.
  • Spin v4.2.3 - Backports patches.

Service Discovery

Platform

  • Greenhouse v0.18.0 - Bumps greenhouse chart to 0.24.2, surfaces Helm error detail in Plugin status when HelmRelease is stalled, and resolves references against the whole object for plugin presets.
  • OpenMCP v1.2.0 - Updates module github.com/onsi/ginkgo/v2 to v2.33.0 and github.com/onsi/gomega to v1.43.1.
  • OpenMCP v1.1.9 - The ClusterAdmin finalizer is now removed even when Authorization and APIServer are already deleted, fixing stuck Terminating namespaces during project deletion.

Cluster Management

  • Gardener v1.153.1 - Relaxes shoot validation in seed-restriction and shoot-restriction handlers and fixes a bug that broke shoot creation when nodeCIDR is provisioned by the Infrastructure provider.

📰 This Week in Cloud Native

The cloud native ecosystem this week demonstrated ongoing efforts to integrate and secure AI workloads, alongside significant updates in core infrastructure and observability. A key theme was the adaptation of Kubernetes to handle the unique demands of AI agents. Discussions focused on the architectural placement of AI agents within the Kubernetes control loop, with insights into how Kubernetes is evolving to manage the increased request volume generated by agentic workflows. For instance, the kagent project demonstrated how to run an agent builder locally, indicating a trend towards more accessible AI agent development within existing cloud native tooling. Security discussions also highlighted the importance of least-privilege principles when granting permissions to AI agents, emphasizing a layered defense strategy.

In the realm of security, several open-source initiatives made progress. The OpenSSF announced that Privateer, an AI-assisted security and compliance evaluation framework, has joined its Sandbox. This project aims to leverage AI for evaluating security posture and compliance. Additionally, the OpenSSF blog detailed how GitHub is integrating malicious-package data into its Advisory Database, expanding malware advisories across eight ecosystems. This collaboration enhances the security of open-source software supply chains. The CNCF also explored extending Kubernetes policy enforcement through tools like Kyverno to include runtime security for AI workloads, addressing potential vulnerabilities at the execution layer. Cloudflare open-sourced Void, a tool designed to help IT manage internally developed applications, contributing to the open-source landscape for enterprise governance.

Observability and sustainability also saw notable developments. A CNCF blog post discussed the integration of “carbon as a first-class signal” into OpenTelemetry. This initiative aims to standardize Software Carbon Intensity (SCI) metrics, allowing applications to report and monitor their environmental impact directly within observability stacks. This development provides a technical pathway for organizations to measure and optimize the carbon footprint of their cloud native deployments. The Kubernetes ecosystem also received tooling enhancements, such as using Headlamp to trace Kueue admission, which aids in diagnosing why Kubernetes jobs might remain in a pending state. Discussions also covered the various ways a Kubernetes control plane can encounter scaling limitations, providing technical insights into managing large-scale clusters. The NeoNephos project announced its collaboration with Open Defense Cloud by BWI, further highlighting open-source contributions to secure and specialized cloud environments.

💬 Community Buzz

Hacker News discussions this week included the prevalence of AI-generated projects, with users asking about their proliferation across the internet. Other topics covered the concept of an “Open Source Discord,” reflecting community interest in open-source alternatives for communication platforms. There was also discussion around OpenTelemetry’s integration with Nix, and various “Show HN” posts showcased new open-source projects, including a self-hosted calendar and contacts application, a self-hosted wiki with Prometheus/SQL charts, an open-source SSH client with an AI assistant, and tools for managing AI agents.

📊 Numbers of the Week

  • Total stable releases: 156 across 35 projects
  • Top 3 projects by commits this week:
    1. hivecommons/hive — 654 commits
    2. kubernetes/kubernetes — 220 commits
    3. agent-substrate/substrate — 194 commits
  • Top 3 projects by merged pull requests this week:
    1. hivecommons/hive — 739 merged PRs
    2. agent-substrate/substrate — 194 merged PRs
    3. kubernetes/kubernetes — 131 merged PRs

📚 View all articles from this week →