Edition No. 11 · 5 Sep 2026
Taking payment
Payments, licences, invoices, and the parts of billing nobody wants to build twice.
Refreshed on 13 October 2026. The repositories are the ones first published; any that are no longer maintained are left out.
The first ten editions of this report were about getting people to a website and measuring what they did once they arrived. None of them covered the moment a visitor decides to pay. That is a large gap. A price list is part of how a product describes itself, and a product with no way to accept money loses every visitor who would have paid, quietly and for good. The steps on either side of that moment matter too: the sign-in form, the consent notice that European law requires once measurement is running, and the visitors who cannot use the page at all.
This edition covers those steps. Three repositories take money, three handle sign-in, consent and access, three cover documentation, measurement and email, and three sit inside a product or beside it.
Every figure below was read again on 13 October 2026. The twelve repositories are the ones first published on 5 September 2026. All twelve are still maintained, so none was left out.
If you only do three things
- PostHog/posthog (#8) — this evening. It is one script tag that brings event measurement, session recording, feature switches and surveys together. The hosted free tier needs no server at all, which is why this is an evening rather than a project.
- polarsource/polar (#2) — this weekend. Polar becomes the legal seller of the product, so European VAT and sales tax are its job to collect and file. That one fact turns a pricing page that says "coming soon" into a working paid tier.
- orestbida/cookieconsent (#5) — in the same sitting as PostHog, about thirty minutes. Once a measurement script runs on a site with European visitors, consent stops being optional. Doing it in the same sitting is the whole point; a gap of weeks is a gap of weeks of exposure. ---
Every link in one place
| # | Repository | What it is | Stars | Licence | Project site |
|---|---|---|---|---|---|
| 1 | getlago/lago | Counts usage and produces invoices | 10,674 | AGPL-3.0 | getlago.com |
| 2 | polarsource/polar | Sells the product and files the tax | 10,188 | Apache-2.0 | polar.sh |
| 3 | openmeterio/openmeter 💎 | Counts usage and enforces allowances | 2,248 | Apache-2.0 | openmeter.io |
| 4 | logto-io/logto | Handles sign-in and accounts | 14,377 | MPL-2.0 | logto.io |
| 5 | orestbida/cookieconsent | A consent notice that blocks scripts | 5,696 | MIT | cookieconsent.orestbida.com |
| 6 | pa11y/pa11y | Finds accessibility faults on a page | 4,493 | LGPL-3.0-only | pa11y.org |
| 7 | scalar/scalar | Turns an API description into readable docs | 16,249 | MIT | scalar.com |
| 8 | PostHog/posthog | Measurement, recording, switches, surveys | 40,236 | MIT, with one directory excluded | posthog.com |
| 9 | maizzle/framework 💎 | Builds HTML email from code | 1,596 | MIT | maizzle.com |
| 10 | TradingView/lightweight-charts | Draws price charts in a browser | 17,549 | Apache-2.0 | tradingview.com/lightweight-charts |
| 11 | smithyhq/sqladmin 💎 | An admin screen over database tables | 2,844 | BSD-3-Clause | smithyhq.github.io/sqladmin |
| 12 | Stirling-Tools/Stirling-PDF | Edits PDF files on a machine you control | 93,974 | MIT, with ten directories excluded | stirling.com |
The till
Twelve repositories, checked and reviewed. Every version verified against the GitHub API and dated.
10.5k stars · AGPL-3.0 · v1.52.1 (2026-08-27) · Track this in Scout · Share this tool
Open-source metering and usage-based billing API — counting what someone used and turning it into a number they owe.
▶Repo detailsthe review · specs · pros & cons · install
What it does
You send it a usage event for every billable thing a customer did. It adds those events up per customer and per billing period. It then applies the price plan you defined: a flat fee, a price per unit, a package of included units, or a combination. It handles subscriptions, prepaid wallets, credits and coupons. It can show a customer what they have spent so far in the current period, before any invoice arrives. It produces the invoice itself and reports on revenue. It is an API, which means a program talks to it rather than a person. What it does not do is move the money: the card charge is handed to a payment processor such as Stripe, and there is no checkout page here for a visitor to see.
Why it matters
Who it suits. Products whose real cost rises with use, such as model calls, document processing or storage. For those, a flat monthly price either loses money on heavy customers or overcharges light ones, and nobody can tell which until the use is counted. It also suits a team that expects to change its price plan more than once, because the plan lives in configuration rather than in code. Skip it if a fixed monthly subscription is the whole pricing story; the counting machinery earns nothing then.
Verdict. Worth the work only once usage-based pricing is a decision already taken. Two things to weigh first. The licence is AGPL-3.0, which is fine for software run as a service inside one company but needs reading by a lawyer before any of it is linked into something distributed to customers. The production setup wants Rails with PostgreSQL, Redis, Kafka and ClickHouse behind it, which is several services to keep alive rather than one container. If the need is to accept money this month, entry 2 is the answer and this is the thing to revisit later. openmeterio/openmeter at entry 3 overlaps it directly; pick one, because two counters that disagree is worse than neither.
- Built for usage from the start, with wallets, credits and mid-period spend visible to the customer.
- Releasing often: version 1.55.0 landed on 7 October 2026 and code landed on 9 October 2026.
- An API first, so any language can talk to it and there is no required client library.
- AGPL-3.0, which has real consequences for anything distributed rather than hosted.
- Four supporting services in production, so this is not a small container on a shared machine.
- Choosing what to count is a product decision that is expensive to change once customers are billing against it.
git clone https://github.com/getlago/lago.git cd lago docker compose up -d
10.2k stars · Apache-2.0 · sdk/1.0.0-alpha.20 (2026-09-04) · Track this in Scout · Share this tool
Merchant-of-record checkout for software products — the EU VAT problem legally stops being yours.
▶Repo detailsthe review · specs · pros & cons · install
What it does
You create a product and a price on the hosted service, and it gives you a payment link to put on a pricing page. Because it is the merchant of record, which means the legally recognised seller, it charges the customer, collects and files European VAT and other sales taxes, issues the invoice, and pays the balance out to you. It provides a customer portal where buyers manage their own subscriptions, licence keys for software that needs activating, usage-based add-ons for charges that vary, and webhooks, which are messages sent to your own server when something happens. There are client libraries for several languages. What it does not do is run on your own hardware in any useful way: the code is published, but the tax registrations and the payouts are the service, and those are not something a self-hosted copy can provide.
Why it matters
Who it suits. Anyone with a finished product and no paid tier, selling to customers in more than one country, who would rather give away a percentage than open tax registrations. It also suits a small team selling a desktop application, because licence keys and the customer portal are included rather than built. Skip it if the product is already selling through an existing payment setup that works, or if a percentage of every sale is unacceptable for the margins involved.
Verdict. The fastest route from no paid tier to a working one, and that speed is the whole recommendation. Two cautions. This is a vendor relationship with a percentage attached, not software you control, and the merchant of record owns the payment relationship, so moving away later means asking every customer to subscribe again somewhere else. The repository releases constantly under per-package tags rather than one version number: the newest, @polar-sh/better-auth 2.1.0, is dated 6 October 2026, which tells you the pace but makes "which version am I on" an awkward question. Read the pricing page before the README.
- The tax and filing burden genuinely transfers, which no self-hosted tool can offer.
- Payment page, customer portal, licence keys and webhooks all work with no server to run.
- Apache-2.0 and releasing constantly, with package tags dated 6 October 2026.
- The value is the hosted service, so this is a vendor you depend on rather than software you own.
- Per-package release tags mean there is no single version number to pin or to report.
- Leaving later means re-subscribing every customer by hand, because the payment relationship is theirs.
Set beside Lago (#1) the division is clean — Polar is how you take money now; Lago is how you meter it later, if and when usage-based pricing is worth building.
Nothing to install.
2.2k stars · Apache-2.0 · v1.0.0-beta.232 (2026-08-04) · Track this in Scout · Share this tool
Real-time usage metering with entitlements and balances — built for products whose unit of cost is a model call.
▶Repo detailsthe review · specs · pros & cons · install
What it does
You send it a usage event for each billable action. It aggregates those events continuously rather than at the end of the month. From that running total it answers two questions: how much has this customer used, and are they still inside their allowance. An allowance here is called an entitlement, meaning a limit attached to a customer that the software checks before letting an action through. It also keeps balances, so prepaid credit can be drawn down. Because the totals are current, a product can show a live figure such as "62 of 100 documents used", which is useful both as a warning and as a prompt to upgrade. It is aimed at products billed by tokens, requests, or megabytes. What it does not do is produce invoices or charge a card: it counts and it gates, and something else bills.
Why it matters
Who it suits. Products with a free tier and a marginal cost per use, where the allowance check happens on the hot path and has to be cheap. It also suits any product that wants to show a customer their remaining allowance inside the interface rather than in a monthly email. Skip it if the pricing is a flat fee with no limits, and skip it if invoices are the actual requirement, because that is entry 1.
Verdict. The right choice when gating matters more than billing, and a genuine gem at 2,248 stars. Two honest reservations. It is still tagged 1.0.0-beta, now at beta.236 dated 9 October 2026, so the project has not yet promised a stable interface after more than two hundred releases. And the light footprint shown in the quickstart is the development one; production wants ClickHouse and Kafka, the same weight as entry 1. Apache-2.0 is the practical advantage over Lago here: this can sit inside a paid feature without a licence conversation.
- Built for allowances and balances, not just end-of-period invoicing.
- Apache-2.0, so it can live inside a commercial product without a licence problem.
- Active and small: beta.236 on 9 October 2026, with code on 8 September 2026.
- Still a beta after 236 tags, with no promise of a stable interface.
- The production deployment wants ClickHouse and Kafka, so the quickstart understates the real cost.
- 2,248 stars and a young company behind it, which is a bet on the vendor as well as the code.
The remaining balance reads straight into the React header; the totals feed Lago or Polar for the actual charge.
git clone https://github.com/openmeterio/openmeter.git cd openmeter/quickstart docker compose up -d
14.5k stars · MPL-2.0 · v1.43.0 (2026-08-31) · Track this in Scout · Share this tool
Identity service with social sign-in — because 'choose a password' is the most expensive field on the internet.
▶Repo detailsthe review · specs · pros & cons · install
What it does
The application redirects a visitor to Logto, and Logto sends back a token proving who they are. It speaks OIDC and OAuth 2.1, the two standard protocols for this, so most libraries already understand it. It provides hosted sign-in and sign-up pages that can be styled. It connects to social and enterprise accounts through a list of connectors, including Google, GitHub, Apple, and Yandex and VK for Russian-speaking visitors. It supports multi-factor sign-in, role-based access control, which means permissions attached to named roles rather than to individuals, and multi-tenancy, which means one installation serving several separate customer organisations. It takes over password resets, session revocation and protection against repeated guessing. What it does not do is store the application's own data: it answers who somebody is, and nothing about what they own.
Why it matters
Who it suits. A product being built now, before it has paying users, where sign-in should not be hand-written. It is one of the few options shipping connectors for Russian-language accounts alongside the usual American ones, which matters for a product with an audience in both places. Skip it if the product already has working sign-in and no complaints about it, because swapping identity systems on a live product moves every user record and is not worth doing without a reason.
Verdict. A good default, and the licence is the quiet reason to prefer it. MPL-2.0 is file-level copyleft, which in practice means obligations attach to the files you change rather than to the whole program, and that is markedly easier to live with commercially than the AGPL options elsewhere on this page. Version 1.44.0 landed on 30 September 2026, so it is actively maintained. Two things to know: it is a Node service with its own PostgreSQL database, so it is another two things to keep running; and the right moment to adopt it is before the first customer, not after. keycloak/keycloak is the heavier, older alternative with far more enterprise features, and zitadel/zitadel sits between the two.
- Connectors covering both American and Russian account providers, not only the usual list.
- MPL-2.0, which is easier to live with commercially than AGPL.
- Self-hostable, with a paid hosted tier for teams that would rather not run it.
- A Node service plus its own PostgreSQL database, so two more things to keep alive.
- Replacing sign-in on a live product is a user migration, not an installation.
- Releases are roughly monthly rather than weekly, so a reported fault may wait.
MPL-2.0 is file-level copyleft, the mildest of the copyleft licences to live next to a commercial product.
git clone https://github.com/logto-io/logto.git cd logto docker compose up -d
5.7k stars · MIT · v3.1.0 (2025-02-04) · Track this in Scout · Share this tool
Vanilla-JS GDPR consent with real script blocking — the banner that becomes necessary the day analytics goes live.
▶Repo detailsthe review · specs · pros & cons · install
What it does
You include one script and one stylesheet, then describe your categories in a configuration object. A category is a group of scripts, such as measurement or advertising, that the visitor accepts or refuses as a unit. Scripts marked as belonging to a category do not run until that category is accepted; the plugin controls the order rather than reporting on it afterwards. It supports per-service switches inside a category, so a visitor can accept one tool and refuse another. It has a documented interface for reading and changing consent later, so a "manage preferences" link works. Translations are built in, so a Russian-speaking visitor sees a Russian notice without a second copy of the code. It is written in plain JavaScript with no dependencies and no framework. What it does not do is decide which categories the law requires, and it does not read your scripts to find out what they do: both of those remain your decision.
Why it matters
Who it suits. Any site that is about to add measurement, advertising or any other script that writes to a visitor's browser, and that has visitors in Europe or the United Kingdom. It suits a site built with a static site generator particularly well, because there is nothing to compile. Skip it if a consent platform is already in place and audited, and skip it if the site genuinely sets nothing beyond what it needs to function.
Verdict. The cheapest useful item on this page and one of the three things to do, specifically because of ordering: install it in the same sitting as the measurement script or carry the exposure for however many weeks pass before anyone returns to it. Version 3.1.0 is dated 4 February 2026 and code landed on 23 July 2026, so it is finished rather than abandoned, which for a 30 kB plugin with a settled interface is the right state to be in. Two practical notes: the default styling is generic and matching a site is an afternoon of CSS, and the documentation is clear that the legal judgement is not included. AmauriC/tarteaucitron.js is the main alternative if you want a large catalogue of pre-written service definitions.
- Plain JavaScript with no dependencies, so it drops into a static site and a single-page application alike.
- It actually holds scripts back, which is the half most implementations get wrong.
- Translations are built in, so a second language is configuration rather than a second copy.
- Slow-moving: version 3.1.0 is from February 2026, and code last landed in July 2026.
- It supplies the mechanism and not the legal advice, so which categories apply is still a decision somebody has to make.
- The default appearance is generic, and matching a site's design takes a session of CSS work.
npm i vanilla-cookieconsent@3.1.0
4.5k stars · LGPL-3.0 · 10.0.0 (2026-08-28) · Track this in Scout · Share this tool
Command-line accessibility auditing that names the failing element, not just the score.
▶Repo detailsthe review · specs · pros & cons · install
What it does
You give it a web address. It loads the page in headless Chrome, which is the Chrome browser running with no window on screen, and runs the page through published rule sets: HTML CodeSniffer and axe, the two widely used accessibility rule engines. It reports each failure with the rule it broke and the element that broke it. Rules can be ignored individually, and a threshold can be set so a build fails only above a certain number of problems. It can act on a page before testing, such as filling a form or clicking through a dialogue, so pages behind an interaction can be reached. A companion command, pa11y-ci, takes a list of addresses or a sitemap and checks them all in one run, which is how it belongs in an automated build. What it does not do is judge: it cannot tell whether a focus order makes sense or whether alternative text describes the picture, and automated checks find roughly a third of real accessibility problems.
Why it matters
Who it suits. Any site facing consumers in the European Union, where the European Accessibility Act has applied to consumer digital services since mid-2025, so this is a compliance question rather than a nicety. It also suits anyone with an interactive screen built on a canvas element, which is invisible to assistive software unless deliberately made reachable. Skip it if accessibility work is already audited by a person on a schedule, because a person finds more than this does.
Verdict. Worth an hour, and the output is the reason: a score tells you to feel bad, while a named element tells you what to change. That makes the report something a coding assistant can work through directly. Note a real change since this edition first ran: version 10.0.0 landed on 28 August 2026 and now requires an even-numbered Node.js release, 22.13.0 or later, so an older machine needs upgrading first. The licence is LGPL-3.0-only, which is fine for a tool you run and a problem if any of it is linked into something you ship. dequelabs/axe-core is one of the engines underneath and is the thing to use directly inside a test suite; GoogleChrome/lighthouse gives a score across several areas but not this list of elements.
- Element-level failures rather than a score, so the output is a task list.
- Two rule engines behind one command, which catches more than either alone.
- Headless and scriptable, with a companion command for whole sitemaps in one run.
- Version 10 needs Node.js 22.13.0 or a later even-numbered release, so an older machine must be upgraded.
- LGPL-3.0-only: run it as a tool, and do not link it into anything distributed.
- Automated checks find roughly a third of real problems, so this does not replace a person.
npm install -g pa11y pa11y https://example.com
16.1k stars · MIT · release-2026-09-07-42fc8b1 (2026-09-07) · Track this in Scout · Share this tool
Turns the OpenAPI file FastAPI already generates into documentation a person would read.
▶Repo detailsthe review · specs · pros & cons · install
What it does
You point it at an OpenAPI or Swagger document, which is the standard machine-readable description of an interface. It renders that document as a browsable reference with search, grouped endpoints and example requests in several languages. A client is built into the page, so a reader can send a real request and see the response without leaving the documentation or installing anything. The quickstart is a single HTML file that loads the published build from a content delivery network and calls one function on a container element, so there is no build step at all. Integration guides exist for many frameworks, listed on the project site. Because the output is ordinary indexable pages, it is also material a search engine can read. What it does not do is review the interface it is describing: a badly shaped API documented beautifully is still badly shaped.
Why it matters
Who it suits. Any product with an interface another developer touches: an integration, a webhook, a connector, or a reference shown to a prospective customer. It suits a framework that already generates the description, because then this is a presentation change and nothing else. Skip it if no outsider ever calls the interface, in which case this is a bookmark for later.
Verdict. Close to free, which is the recommendation. The whole cost is swapping one renderer for another, and the result is a reference a stranger can read. It releases constantly: the newest tag is release-2026-10-12, dated 12 October 2026, with code the same week. Two things to watch. It is a large, fast-moving TypeScript monorepo, so pin a version rather than loading whatever a content delivery network serves today. And the release naming is a date rather than a version number, which makes "which version is this" awkward to answer in a change log.
- Almost no effort: point it at the description the application already serves.
- A working request client inside the documentation, so a reader can try a call immediately.
- MIT, and releasing constantly, with a tag dated 12 October 2026.
- Only earns its keep if somebody outside the team calls the interface.
- A large, fast-moving monorepo released under date tags, so pinning a version is a manual decision.
- Good presentation does not fix a badly designed interface.
<div id="app"></div>
<script type="module">
import { createApiReference } from 'https://cdn.jsdelivr.net/npm/@scalar/api-reference/esm.js'
createApiReference(document.getElementById('app'), { url: '/openapi.json' })
</script>
39.6k stars · MIT, with a proprietary ee/ directory · desktop-v0.61.263 (2026-09-08) · Track this in Scout · Share this tool
Analytics, session replay, feature flags, experiments and surveys behind one snippet — four standing recommendations collapsed into one.
▶Repo detailsthe review · specs · pros & cons · install
What it does
You add one script to a page, or a library to a server, and it records events: pages viewed, buttons pressed, steps completed. From those it builds funnels, which show where people drop out of a sequence, and retention charts. Session recording replays what a visitor actually did on screen. Feature switches turn a feature on for a chosen slice of users, and experiments compare two variants against a chosen measure. Surveys ask a question inside the product. Error tracking collects faults from the browser and the server. All of it reads the same event stream, so a session recording can be opened from the step in a funnel where somebody left. It is fully self-hostable. What it does not do is stay small when self-hosted: the full deployment wants ClickHouse, Kafka, PostgreSQL and Redis.
Why it matters
Who it suits. A small team that needs to know why people leave a particular screen and has nobody to spare for running four services. The single event stream is the real advantage: switches, surveys and recordings all refer to the same users, so a question asked in one place can be answered in another. Skip it if the only requirement is page counts, because a small measurement tool does that with far less weight and keeps the data on hardware you control.
Verdict. The clearest single decision on this page, and the recommendation is specifically the hosted free tier rather than the self-hosted build. You get an answer this evening instead of after a ClickHouse deployment. State the trade plainly though: hosted means visitor behaviour is sent to an American company instead of staying on hardware you control, which is the opposite of a privacy-first position and is exactly why entry 5 sits on this page beside it. The licence is MIT with one directory, ee, held under separate terms, so "open source" carries a footnote. It ships continuously: the newest tag, a desktop build, is dated 13 October 2026. matomo-org/matomo is the self-hosted alternative if keeping the data matters more than the feature set.
- Replaces four separate tools with one script, which is a decision as much as an installation.
- A large free hosted allowance, so the cost at low traffic is plausibly nothing.
- An MIT core, so moving to your own hardware later is a real option rather than a claim.
- Self-hosting means ClickHouse, Kafka, PostgreSQL and Redis, which is a project rather than an evening.
- One directory is held under separate terms, so the open-source description is not complete.
- Hosted means visitor data leaves your own machines, which contradicts a privacy-first story if that is the story being told.
The trade deserves stating plainly — you are sending visitor behaviour to a US company instead of keeping it on your own box, which is exactly the privacy position Umami and remark42 (Ed.
5 #1) were chosen for, and exactly why CookieConsent (#5) sits on this page beside it.
Nothing to install for the hosted route.
1.6k stars · MIT · v6.1.3 (2026-09-07) · Track this in Scout · Share this tool
Write email in utility classes; it compiles to the inlined table markup Outlook still requires.
▶Repo detailsthe review · specs · pros & cons · install
What it does
Version 6 is built on Vite, a modern build tool, and lets you write email templates with Vue components and Tailwind CSS, which is a styling system of small single-purpose classes. You write components and reuse them. The build step then does the unpleasant part: it moves styles inline, because several mail programs ignore a stylesheet, lays the result out in tables, and adds the conditional comments that Outlook needs. The output is a set of HTML files ready to hand to whatever sends the mail. Because the input is text, a five-message onboarding sequence is a folder of files, so a coding assistant can draft it and version control keeps every revision. A translated edition of the same sequence is the same templates with a different strings file. What it does not provide is any visual editor: there is nothing to drag, and nothing to click.
Why it matters
Who it suits. Anyone sending transactional or campaign email who already works in code and would rather review a diff than a canvas. It pairs with any sending tool that expects HTML to be supplied. It also suits bilingual sending, because the second language is a strings file rather than five rebuilt messages. Skip it if the person writing the emails is not a programmer, because a visual builder will serve them far better.
Verdict. A small, focused tool that solves the genuinely hard part of email, and the smallest project in this edition at 1,596 stars. Two things to know. Version 6 is a different tool from version 5: the move to Vite, Vue and Tailwind means older guides and older projects do not carry across, and the newest release, 6.2.1, is dated 11 October 2026. And it adds a second build toolchain beside whatever builds the website, which is one more thing to keep working. mjmlio/mjml is the older and better-known alternative with its own markup language, and resend/react-email is the React-shaped equivalent.
- Text in and HTML out, so emails can be drafted in an editor and tracked in version control.
- It solves the hard part: inlining styles, table layout and Outlook's conditional comments.
- MIT, small, and actively released, with 6.2.1 dated 11 October 2026.
- Version 6 is a rewrite onto Vite, Vue and Tailwind, so older guides and projects do not transfer.
- A second build toolchain to maintain beside the one that builds the site.
- No visual editor at all, which rules it out for anyone who is not comfortable in code.
npx maizzle new
17.2k stars · Apache-2.0 · v5.2.1 (2026-08-12) · Track this in Scout · Share this tool
TradingView's own charting library — the chart a forex trader already knows how to read.
▶Repo detailsthe review · specs · pros & cons · install
What it does
It draws candlesticks, lines, areas, bars and histograms on an HTML5 canvas, which is a drawing area the browser paints directly. It is built for long series, so years of one-minute bars pan and zoom without the page struggling. It handles touch, so it works on a phone. Several series can share a chart, and scales can be configured per series. It includes an option to display the attribution logo on the chart itself, which satisfies part of the licence requirement. What it does not do is calculate anything: no moving averages, no indicators, no drawing tools and no order overlay. Those are left entirely to the application, which is a deliberate choice and the reason it stays small.
Why it matters
Who it suits. Any product that shows price history to people who trade, where recognition matters more than novelty. It suits a product that already computes its own indicator values and only needs them drawn. Skip it if the requirement is a general-purpose chart for business figures, because a general charting library will do that with less work and more chart types.
Verdict. The right default for price data, and the recognition argument is the real one: a trader reads a familiar chart in the first second instead of learning a new one. Apache-2.0 matters here, because this can sit inside a paid screen where an AGPL library could not. Three things to settle before shipping. The licence requires an attribution notice and a link to the company's site on a page users can see, so read the NOTICE file rather than assuming. Version 5 was a breaking rewrite, so most tutorials and forum answers still describe version 4 and will mislead you; the newest release is 5.2.1, dated 12 August 2026, with code on 12 October 2026. And the project publishes no numeric size figure, only a claim of being close to static images, so plan from your own measurement.
- Apache-2.0 and made by the company whose conventions traders already know.
- Built for long series and touch screens, so it survives years of data and a phone.
- Deliberately small, with no features to configure that the product does not need.
- No indicator arithmetic, no drawing tools and no order overlay; all of that is yours to build.
- Version 5 was a breaking rewrite, so most tutorials still describe version 4.
- The licence requires a visible attribution notice and link, which is easy to miss before shipping.
npm install lightweight-charts
2.8k stars · BSD-3-Clause · 0.31.1 (2026-09-01) · Track this in Scout · Share this tool
A SQLAlchemy admin panel mounted inside the FastAPI app he already runs — support without a psql prompt.
▶Repo detailsthe review · specs · pros & cons · install
What it does
You declare which database models to expose and which of their columns to show, and it renders a browsable, searchable, editable interface over them. It mounts as a route inside an application that is already running, using the same database connection, so there is no second service and no second set of credentials. Listing, searching, sorting, creating, editing and deleting are all provided. Optional extras cover sign-in for the admin screens and translation of the interface. It understands the relationships declared on the models, so a row can be followed to the records that reference it. What it does not do is invent structure: it shows the schema exactly as it is, so a confusingly named column stays confusingly named, and a table with no sensible display column is still hard to read.
Why it matters
Who it suits. Any small team running FastAPI or Starlette with SQLAlchemy where support questions currently end at a database prompt. It is most valuable where the people answering those questions do not write SQL from memory, because it turns a query into a search box. Skip it if the application is not built on SQLAlchemy, and skip it if there is already an internal tool doing this job.
Verdict. The cheapest useful thing on this page in hours of work, and the one most likely to be opened every week. One warning dominates everything else: an admin screen over live customer data is a serious authentication problem, so put it behind the identity service in entry 4 or a private network, and never behind a shared password. Note the ownership history too: this project was aminalaee/sqladmin and is now smithyhq/sqladmin, so older guides point at the previous address, which still redirects. It is actively released, at 0.32.0 dated 20 September 2026 with code on 1 October 2026, and still a 0.x version, so expect small breaking changes. pallets-eco/flask-admin is the long-standing equivalent for Flask.
- Mounts inside an existing application, with nothing new to deploy or monitor.
- BSD-3-Clause, the most permissive licence on this page.
- Actively released under its new owner: 0.32.0 on 20 September 2026, code on 1 October 2026.
- It exposes live customer data over a web page, so authentication is not optional.
- Still a 0.x version, so breaking changes between releases are expected.
- The project moved address, so a good deal of older advice points at the previous repository.
pip install sqladmin
91.5k stars · MIT at the root, with app/proprietary/, app/saas/, engine/ and several frontend directories carved out under separate licences · v2.14.3 (2026-08-06) · Track this in Scout · Share this tool
About fifty PDF operations in one self-hosted container — nothing leaves the machine.
▶Repo detailsthe review · specs · pros & cons · install
What it does
You run one container and open a page in a browser. From there it offers around fifty operations: split, merge, rotate, reorder, compress, convert to and from other formats, extract images, add or remove passwords, redact, sign, fill forms, and run OCR, which means optical character recognition, the step that turns a scanned picture of text into text a computer can search. A newer editor allows page-level changes in the browser. Everything runs on the machine the container is on, so no file is uploaded anywhere else. What it does not do is stay entirely open: the project now describes itself as open-core, meaning the main code is MIT but a growing list of directories is held under separate terms, and there is a paid server and enterprise offering above it. It also has no authentication worth exposing to the internet.
Why it matters
Who it suits. Anyone who handles PDFs they would not post to a stranger's website: unpublished marketing material, contracts, scanned records, other people's documents. It also suits anyone assembling a set of genuinely messy multi-page files to test a document-reading tool against, because splitting, rotating and OCR are exactly what that needs. Skip it if PDFs come up twice a year and none of them is sensitive, because a command-line tool will do those two jobs with far less running.
Verdict. Worth having on a local machine, and the honest framing is that it is a bench tool rather than a monthly saving. Three things changed since this edition first ran and all three matter. The project is at version 3.1.0, dated 5 October 2026, with code on 11 October 2026, so it is moving fast. Its own description is now "open-core" rather than MIT, and the licence file carves out ten directories under separate terms, including engine/, app/saas/ and several front-end folders; running the free self-hosted build is fine, and assuming the whole repository is MIT is not. And it remains a Java application that wants real memory, so read the requirements before adding it to a small shared machine. Never expose it to the internet without something asking for a login first: it will happily process whatever anyone uploads, using your hardware.
- Around fifty operations in one container, running entirely on hardware you control.
- Very actively released: version 3.1.0 on 5 October 2026, with code on 11 October 2026.
- Useful across a whole workflow rather than in one corner of one task.
- No longer plainly MIT: the licence carves out ten directories under separate terms, and the project calls itself open-core.
- A Java application that wants real memory, so it is a poor neighbour on a small shared machine.
- No authentication fit for public exposure; anyone who can reach it can use it at your expense.
docker run -p 8080:8080 docker.stirlingpdf.com/stirlingtools/stirling-pdf
Checked, and left out
These were opened for this edition and did not make it, with the reason.
juspay/hyperswitch
juspay/hyperswitch (43.0k, Apache-2.0, v1.123.1 2026-05-19) — verified alive; dropped as far too heavy for a founder with no checkout at all. Backlogged.
killbill/killbill
killbill/killbill (5.7k, Apache-2.0) — no readable release date and a Java/Tomcat deployment; Lago covers it with a provable cadence. Backlogged.
usesend/useSend
usesend/useSend (4.7k, AGPL-3.0) — REDIRECT from unsend-dev/unsend. No releases at all, recency unprovable. Backlogged; it fills a real hole and is worth re-checking.
Rikorose/DeepFilterNet
Rikorose/DeepFilterNet (4.6k, MIT/Apache-2.0) — no dated releases, recency unprovable. Was the intended YouTube slot. Backlogged.
google/schema-dts
google/schema-dts (1.2k, Apache-2.0, v2.0.0 2026-03-23) — verified healthy and a real gem; dropped only for slate fit. Backlogged and flagged as a strong candidate for an early edition. PROMOTED AND RECOMMENDED THE NEXT DAY as Edition 12 #9.
Know a repository we should check?