Edition No. 24 · 18 Sep 2026
Twelve repositories for building and keeping a small product running
The best-known tool for updating Docker containers was archived in December, and today's smallest entry does the same job.
Friday, 18 September 2026 · Watchtower has 24,700 stars and was archived nine months ago
The web version carries the English / Русский switch. The Russian text is in the file radar-2026-09-18-ru.md, delivered into the chat on the day. This archive stays English only.
Watchtower is the program most people use to keep the software on their server up to date. It has about 24,700 stars. Today we opened it while checking a comparison list, and GitHub showed a grey banner: "This repository was archived by the owner on Dec 17, 2025. It is now read-only." Its last release was November 2025. Nothing about that is announced to the people who installed it, and a tool whose job is telling you about updates has stopped receiving its own. Entry #8 is the small script that does the same work and is still being written.
There is no theme. Twelve repositories, picked on how good they are, across nine of the sixteen areas. Three of them have fewer than three thousand stars.
Two things worth knowing
The best-known container updater was archived in December, and almost nobody was told. Watchtower watches the sealed boxes your programs run in and restarts them when a new version of the software inside is published. It has about 24,700 stars and it is in a very large number of home servers and small company servers. GitHub now shows the banner "This repository was archived by the owner on Dec 17, 2025. It is now read-only." The last release was v1.7.1 in November 2025. This is not our reading of a stale date. It is the owner's own decision, recorded by GitHub, and it is the kind of fact this radar exists to find, because nothing about it reaches the person who installed the tool two years ago and has not thought about it since. One detail is worth adding, because it was true before the archive too: Watchtower's own documentation says plainly that it is meant for home servers and small setups, and that they do not recommend it in a commercial or production environment. Entry #8 is the direct replacement and it asks you before it changes anything.
A third project in three days turned out not to be plainly open source. Typebot is a form and chat builder that this radar published in Edition 2, and it came up today as a comparison for OpnForm (#10). Its repository now states that it ships under the Functional Source License, which lets you run it yourself under conditions but is not an open-source licence in the usual sense. Edition 22 found the same thing on Chartbrew on 16 September. Edition 23 found it on Open WebUI on 17 September. Three in three days is not a trend yet, but it is worth saying out loud what it means in practice. A licence like this is almost always fine for running something for yourself. It only starts to matter when you build a product on top of it and sell that product. None of the three is being held back for it, and none of them will be. It is a warning to read, not a reason to hide a good tool.
If you only do three things
- astral-sh/ruff (#2) — tonight, five minutes, one command, and it works on code you already have. It reads every Python file you own, tidies the spacing, removes what is unused and reports real mistakes. It replaces three or four separate tools with one, and it is fast enough that you can run it every time you save. Cheapest thing on the page for what it gives back.
- ankane/dexter (#6) — half an hour, and it closes a chain four editions have been building. Edition 18 gave you pgBadger, which names your slow queries. Edition 20 gave you pev2, which explains why one of them is slow. Edition 23 gave you HypoPG, which lets you test an index you thought of yourself. This one thinks of the index for you, tests it with HypoPG, and prints the ones that actually helped.
- mag37/dockcheck (#8) — twenty minutes, one file, nothing left running. It lists every container on your server that has a newer version published, and updates the ones you pick, keeping the old image in case you need to go back. It is the entry this edition is named after, and also one of today's three gems.
Every link in one place
| # | Repository | Official site or docs | Stars | Licence | Latest |
|---|---|---|---|---|---|
| 1 | honojs/hono | hono.dev | 31.8k | MIT | v4.13.8 (15 Sep 2026) |
| 2 | astral-sh/ruff | docs.astral.sh/ruff | 49.6k | MIT | 0.16.8 (16 Sep 2026) |
| 3 | jdx/mise | mise.jdx.dev | 32.4k | MIT | v2026.9.11 (18 Sep 2026) |
| 4 | benbjohnson/litestream | litestream.io | 14.4k | Apache-2.0 | v0.5.17 (31 Aug 2026) |
| 5 | noborus/trdsql 💎 | noborus.github.io/trdsql | 2.2k | MIT | v1.2.3 (29 May 2026) |
| 6 | ankane/dexter 💎 | README | 2.1k | MIT | no GitHub releases; gem pgdexter 0.6.3 (15 Oct 2025) |
| 7 | getsops/sops | getsops.io | 23.1k | MPL-2.0 | v3.13.3 (23 Jul 2026) |
| 8 | mag37/dockcheck 💎 | mag37.org | 2.5k | GPL-3.0 | v0.8.3 (4 Aug 2026) |
| 9 | sitespeedio/sitespeed.io | sitespeed.io | 5.0k | MIT | v42.7.0 (11 Sep 2026) |
| 10 | OpnForm/OpnForm | opnform.com | 3.7k | AGPL-3.0, with a separate paid Enterprise Edition | v2.5.0 (2 Sep 2026) |
| 11 | immich-app/immich | immich.app | 110k | AGPL-3.0 | v3.2.2 (15 Sep 2026) |
| 12 | OpenBB-finance/OpenBB | openbb.co | 73.2k | AGPL-3.0 | v1.0.2 (25 Apr 2026) |
Watchtower has 24,700 stars and was archived nine months ago
Twelve repositories, checked and reviewed. Every version verified against the GitHub API and dated.
31.8k stars · MIT · v4.13.8 (2026-09-15), read from /releases/latest; the GitHub date carried no year and falls in the past, so it is this year · Track this in Scout
A small, fast web framework for JavaScript built on Web Standards, so one copy of the code runs on Node.js, Bun, Deno, Cloudflare Workers and AWS Lambda.
▶Repo detailsthe review · specs · pros & cons · install
What it is
A web framework for JavaScript and TypeScript. A framework is a starting kit that handles the boring parts of answering a web request, so you only write the part that is yours. Hono is built on the same request and response objects that browsers already use, which is why one copy of the code runs on Node.js, on Bun, on Deno, on Cloudflare Workers and on AWS Lambda without being rewritten.What it is good for. Anyone building a small API (an address that other programs call, rather than a page a person reads) who does not want to be tied to one hosting company. The problem it removes is the rewrite you do when you move hosts. A short line about Grasppy: its main backend is Python and this does not replace that, but the React side often needs a tiny server of its own for sign-in callbacks and webhooks, and this is the smallest honest way to have one.
- The smallest preset is under 12 kB, so it starts almost instantly, which matters on services that charge by the millisecond.
- The same code runs on five or six different hosts without change.
- MIT licence, and a release most weeks.
- JavaScript and TypeScript only. There is nothing here for a Python or Go project.
- Running everywhere means some libraries written for Node.js will not work, and you find that out late.
- Express has twenty years of answers written about it and this does not. You will read the documentation more often.
- expressjs/express
The framework almost every Node.js tutorial is written against, and it is slower and tied to Node.js alone.
Track this in Scout - fastify/fastify
A faster Node.js framework with a large plugin system and schema-based validation, and it also runs only on Node.js.
Track this in Scout - elysiajs/elysia
A TypeScript framework with very strong type checking from the server to the client, built for the Bun runtime rather than for many hosts.
Track this in Scout
# Start a new project. It asks which host you are targeting. npm create hono@latest my-app cd my-app npm install npm run dev # Or add it to something you already have: npm install hono
49.6k stars · MIT · 0.16.8 (2026-09-16), read from /releases/latest, which printed the year explicitly · Track this in Scout
One fast program that both checks and formats Python code, carrying the rules of Flake8, isort and pyupgrade and a formatter close to Black.
▶Repo detailsthe review · specs · pros & cons · install
What it is
A linter and a formatter, written in Rust. A linter is a program that reads your code without running it and reports mistakes and bad habits. A formatter rewrites the spacing and line breaks so every file looks the same. Ruff carries the rules of Flake8, isort, pyupgrade and several other tools, and its formatter produces output very close to Black's.What it is good for. Any Python project, and especially one with more than a few hundred files, because the older tools take long enough on a big project that people quietly stop using them. The problem it removes is the review argument about spacing. A short line about Grasppy and ScalpingMate: both are Python, and both are written mostly by a coding assistant. An assistant produces a lot of code quickly, and this is the cheapest way to keep all of it in one style and catch the unused import it left behind.
- Fast enough to run on every file save without noticing, which is what makes it actually get used.
- One tool instead of four, so there is one configuration file and one version to keep up to date.
- MIT licence, a release most weeks, and it reads the configuration files you already have.
- Turning it on for an existing project makes one enormous commit where every file changed. Do that on its own, before anything else.
- A few rules from the older tools have no equivalent yet, so a very strict setup may not move across whole.
- It checks style and simple mistakes. It does not check types, so you still need mypy or something like it for that.
- psf/black
The formatter whose style Ruff copies, and it only formats, so a separate checker is still needed.
Track this in Scout - pylint-dev/pylint
A much deeper checker that follows the code's logic and finds problems Ruff does not, and it is far slower and licensed GPLv2.
Track this in Scout 
biomejs/biomeThe same idea for JavaScript, TypeScript, CSS and JSON, published in Edition 17, and the two together cover a mixed project.
Track this in Scout
# Inside your project's virtual environment: source venv/bin/activate pip install ruff # Or system-wide on this kind of Linux: pip install ruff --break-system-packages # Then, from the project folder: ruff check . # report problems ruff check --fix . # fix the ones it can fix safely ruff format . # reformat everything
32.4k stars · MIT · v2026.9.11 (2026-09-18), read from /releases/latest on the morning of the edition; the version number is a calendar version and the eleventh release of September 2026 · Track this in Scout
One tool that installs language versions per project, loads that project's environment, and runs its commands.
▶Repo detailsthe review · specs · pros & cons · install
What it is
A version manager, an environment loader and a task runner in one program, written in Rust. A file called mise.toml in a folder lists the tools and versions that folder needs. When you enter the folder, mise puts those versions on the path and loads the settings; when you leave, it puts them back.What it is good for. Anyone with more than one project on the same machine, and anyone who has lost an afternoon to the wrong Python running. The problem it removes is the readme line that says "requires Node 20" and the hour you spend finding out you have 22. A short line about Grasppy and ScalpingMate: they are both Python projects on the same laptop and they do not have to agree about versions any more.
- Replaces asdf, nvm, pyenv and direnv with one program, and reads asdf's
.tool-versionsfile so moving over is not a rewrite. - It installs the version it needs rather than telling you to go and get it.
- MIT licence, and
mise doctortells you what is wrong with your setup instead of leaving you guessing.
- It hooks into your shell's startup, so a bad setup can break every new terminal you open. Read the activation step twice.
- If your current setup works and you only use one language, this is a change with no reward.
- It releases very often, sometimes several times a week, so pin the version on anything that has to keep working.
- asdf-vm/asdf
The tool mise was built to replace, with a larger plugin list and noticeably slower on every shell start.
Track this in Scout - direnv/direnv
Loads and unloads environment variables per folder and nothing else, which is a smaller thing to trust with your shell startup.
Track this in Scout 
casey/justA command runner published in Edition 13, overlapping only the task half of mise.
Track this in Scout
# macOS or Linux: curl https://mise.run | sh # Add this line to ~/.bashrc (or ~/.zshrc), then open a new terminal: eval "$(~/.local/bin/mise activate bash)" # In a project folder: mise use python@3.13 mise use node@22 mise doctor
14.4k stars · Apache-2.0 · v0.5.17 (2026-08-31), read from /releases/latest; the release page states nine commits have landed since · Track this in Scout
Streams a SQLite database to S3-compatible object storage as it changes, so it can be restored to a chosen moment after a failure.
▶Repo detailsthe review · specs · pros & cons · install
What it is
A small program that sits beside your application and streams SQLite's write-ahead log to object storage such as Amazon S3, Backblaze B2 or any S3-compatible service. SQLite is a database that lives in one ordinary file with no server of its own. Restoring is one command, and you can restore the file as it was at a chosen moment rather than only as it is now.What it is good for. Anyone running a small service on SQLite, which is far more people than admit it. PocketBase from Edition 21 is SQLite. So is a great deal of small Go and Python software. The problem it removes is the honest answer to "what happens if this disk dies", which for most one-server projects is currently "I lose today". This does not replace pgBackRest from Edition 18 — that is for PostgreSQL and this is not.
- Your application does not change at all. Litestream runs beside it and reads the same file.
- You can restore to a point in time, so a mistake made at 14:30 can be undone by restoring to 14:29.
- Apache-2.0 licence, one binary, and it costs a few cents a month in storage for a small database.
- SQLite only. If your data is in PostgreSQL or MySQL this does nothing for you.
- The project still calls itself beta, and version 0.5 changed how replication works, so read the notes before upgrading from 0.3.
- A backup you have never restored is not a backup. Do the restore once now, while nothing is wrong.
- superfly/litefs
By the same author, and it copies a SQLite database live between several machines instead of into storage, which is harder to run.
Track this in Scout - rqlite/rqlite
A distributed database built on SQLite with copies on several machines, and it replaces your database rather than backing up the one you have.
Track this in Scout
# Download the .deb or the .tar.gz for your machine from # https://github.com/benbjohnson/litestream/releases/latest # then, for Debian or Ubuntu: sudo dpkg -i litestream-*.deb # /etc/litestream.yml — one database, one destination: # dbs: # - path: /var/lib/myapp/data.db # replicas: # - url: s3://my-bucket/myapp sudo systemctl enable --now litestream # Restoring, on a new machine: litestream restore -o /var/lib/myapp/data.db s3://my-bucket/myapp
2.2k stars · MIT · v1.2.3 (2026-05-29), read from /releases/latest on 2026-09-18; the release page states ten commits have landed since · Track this in Scout
Runs SQL queries directly against CSV, LTSV, JSON, YAML and TBLN files, with no database involved.
▶Repo detailsthe review · specs · pros & cons · install
What it is
A command-line program written in Go. SQL is the language you use to ask a database questions. Trdsql loads your file into a temporary database in memory, runs your query against it, and prints the result. It reads CSV, TSV, LTSV, JSON, YAML and TBLN, and it can write out as CSV, JSON, a Markdown table or several other shapes.What it is good for. Anyone with a folder full of exports that nobody ever looks at properly. The problem it removes is the small program you write, use once and throw away. It will also join a CSV against a JSON file in a single query, which is the thing a spreadsheet cannot do at all. A short line about ScalpingMate: trade exports arrive as CSV, and counting how many trades in a month closed at a loss is now one line rather than a script.
- It joins two files of different formats in one query, which nothing else in this ledger does as simply.
- It prints the answer as CSV, JSON, a Markdown table or an aligned table, so the result goes straight into a document.
- MIT licence, a single binary, and it can be pointed at a real PostgreSQL or MySQL server when the file is too big for memory.
- You have to know some SQL. If you do not, this is a thing to learn rather than a thing to install.
- By default the file is read into memory, so a very large file needs the PostgreSQL mode instead.
- There is no screen and no history. It answers one question and exits.
- harelba/q
The same idea in Python, older and simpler, and it handles fewer file formats.
Track this in Scout - johnkerl/miller
Processes CSV and JSON with its own commands rather than SQL, which is better for reshaping a file and worse for asking it a question.
Track this in Scout 
tstack/lnavPublished in Edition 22, it answers SQL questions about log files specifically, with a full screen and history.
Track this in Scout
# With Go installed: go install github.com/noborus/trdsql/cmd/trdsql@latest # Or on macOS: brew install noborus/tap/trdsql # Or download a binary from # https://github.com/noborus/trdsql/releases/latest # Ask a question: trdsql -ih "SELECT symbol, COUNT(*) FROM trades.csv GROUP BY symbol" # Join two files of different formats, and print a Markdown table: trdsql -omd "SELECT t.id, a.name FROM trades.csv AS t JOIN accounts.json AS a ON t.acct = a.id"
2.1k stars · MIT · no GitHub releases at all, which is a determination and not a gap; the Ruby gem pgdexter is at 0.6.3, released 15 October 2025, read from rubygems.org · Track this in Scout
Reads your slow PostgreSQL queries, tests candidate indexes without building any of them, and prints the ones that would actually help.
▶Repo detailsthe review · specs · pros & cons · install
What it is
A command-line program. You give it your database and either a log file or a list of queries. For each query it creates hypothetical indexes using HypoPG — the extension published in Edition 23, which makes an index that exists only in the planner's head — then asks PostgreSQL to plan the query with and without each one and keeps the indexes that made a real difference.What it is good for. Anyone with a PostgreSQL application that has got slower as it filled up. The problem it removes is the guessing. Most small applications have three slow queries and two missing indexes, and this finds both without you learning how the planner thinks. A short line about Grasppy: its data is in PostgreSQL on one server, and this is the last step of a chain this radar has been building for six editions.
- Nothing is built while it tests. Every index it tries is hypothetical, so the database keeps working normally throughout.
- It can read PostgreSQL's own log file directly, so you point it at real traffic rather than at queries you remembered.
- MIT licence, and it prints its suggestions for you to approve rather than changing your database behind you.
- It needs Ruby on the machine and the HypoPG extension inside the database. A managed database that does not allow extensions cannot run it.
- It has never published a GitHub release at all, so the version to trust is the Ruby package
pgdexter, and the newest of those is 0.6.3 from 15 October 2025. - It suggests. It does not know that an index costs you on every write, so do not create everything it prints.
HypoPG/hypopgPublished in Edition 23, it is the extension Dexter uses underneath, so the two are a pair rather than a choice.
Track this in Scout- powa-team/powa
Collects query statistics over time and draws them in a web page, and it can call HypoPG from inside that page.
Track this in Scout 
darold/pgbadgerPublished in Edition 18, it reads the same log file and names which queries are slow, which is the step before this one.
Track this in Scout
```bash
23.1k stars · MPL-2.0, confirmed by opening the LICENSE file directly on 2026-09-18; no added conditions · v3.13.3 (2026-07-23), read from /releases/latest; the GitHub date carried no year and falls in the past, so it is this year · Track this in Scout
Encrypts the values inside a YAML, JSON, ENV or INI file while leaving the names readable, so the file can live in your code history.
▶Repo detailsthe review · specs · pros & cons · install
What it is
A command-line editor for settings files. It works on YAML, JSON, ENV and INI files, and it encrypts each value while leaving each name in plain text. The key can come from age, from PGP, or from a cloud key service such as Amazon KMS, Google KMS or Azure Key Vault. It began at Mozilla in 2015 and is now a project of the Cloud Native Computing Foundation.What it is good for. Anyone who has ever emailed a .env file to themselves, or kept the only copy of a production password on one laptop. The problem it removes is the gap between "the settings are in the repository" and "the secrets are somewhere else". A short line about Grasppy: its deploy needs a database password, an email key and a model key, and this lets all three live beside the code they belong to.
- Only the values are encrypted, so a change to the file still reads as a change to one setting instead of a wall of unreadable text.
- It works with age from Edition 20, so you can use a single small key file and no cloud account at all.
- MPL-2.0 licence, confirmed by reading the LICENSE file directly, with no added conditions.
- Lose the key and the file is gone for good. Keep a second copy of the key somewhere that is not the same machine.
- It adds a step before every deploy, and a deploy script that forgets to decrypt fails in a confusing way.
- It protects the file while it is stored. Once the program is running the values are in memory like any others, so this is not a secrets manager.
FiloSottile/agePublished in Edition 20, it locks one whole file with one key, which is simpler and hides the shape of the file as well.
Track this in Scout- AGWA/git-crypt
Encrypts whole files automatically as git stores them, which needs no extra command and makes every change unreadable in the history.
Track this in Scout - bitnami-labs/sealed-secrets
Solves the same problem specifically inside Kubernetes, so it is the right answer only if you already run Kubernetes.
Track this in Scout
```bash Download the binary for your machine from https://github.com/getsops/sops/releases/latest or on macOS: brew install sops age
2.5k stars · GPL-3.0 · v0.8.3 (2026-08-04), read from /releases/latest; the GitHub date carried no year and falls in the past, so it is this year · Track this in Scout
One shell script that lists which of your containers have a newer image published and updates the ones you choose, keeping the old image for a rollback.
▶Repo detailsthe review · specs · pros & cons · install
What it is
A single shell script. Docker is a way to run a program inside its own sealed box, and each box is called a container. Dockcheck asks each container's registry whether a newer image exists, without downloading it, and shows you the list. It can then update the containers you pick, keep a copy of the previous image, remove old images afterwards, and send a message through a long list of notification services.What it is good for. Anyone whose server has quietly grown to a dozen containers that were installed at different times and never touched again. The problem it removes is not knowing. A short line about the Hetzner server: twenty-four editions of this radar have suggested things to install on it, and this is the one that tells you when any of them has moved on.
- One file and nothing left running. You can also put it on a timer and have it only send you the list.
- It asks before it changes anything, which is the whole difference between this and the automatic updaters.
- It keeps the previous image, so going back after a bad update is one command rather than an afternoon.
- GPL-3.0 licence. That is fine for running it and it matters if you ever want to ship it inside something of your own.
- It is a shell script that you will run with enough power to restart your services. Read it once before you do.
- Updating restarts containers. Run it when you can watch, not at three in the morning on a timer.
- containrrr/watchtower
The best-known tool for this job, and GitHub says it was archived by its owner on 17 December 2025 and is now read-only.
Track this in Scout - crazy-max/diun
It only watches and reports, and never updates anything, which some people prefer.
Track this in Scout 
louislam/dockgePublished in Edition 22, it is a web page for managing Compose stacks that updates a stack on a button press rather than telling you one is available.
Track this in Scout
# One file, anywhere on the server: curl -L https://raw.githubusercontent.com/mag37/dockcheck/main/dockcheck.sh -o dockcheck.sh chmod +x dockcheck.sh # Look, and change nothing: ./dockcheck.sh -n # Look, then pick what to update from a list: ./dockcheck.sh # Keep a copy of the old image before each update: ./dockcheck.sh -b
5.0k stars · MIT · v42.7.0 (2026-09-11), read from /releases/latest on 2026-09-18 · Track this in Scout
Measures how fast your pages really load, using real browsers, and can run the same test on a schedule.
▶Repo detailsthe review · specs · pros & cons · install
What it is
A set of tools that drives Chrome, Firefox, Edge or Safari against a list of your pages. It records the timings a visitor would experience, takes a video of the page loading, runs Lighthouse if you ask, and writes an HTML report. It can run on a schedule and send the numbers to Graphite or InfluxDB so you keep a history rather than a snapshot.What it is good for. Anyone whose site gets slower a little at a time, which is every site with more than one person working on it. The problem it removes is finding out from a visitor. A short line about grasppy.com: the radar pages are long and carry two full languages plus their Markdown, and this is how you find out what that costs a reader on a phone.
- It uses real browsers, so the numbers are what a visitor actually gets rather than a model of one.
- It keeps history, which is the part a one-off audit cannot give you.
- MIT licence, and a release most weeks.
- The Docker image is large and a running browser wants 1 to 2 GB of memory, so this is not something to leave on a small server.
- The numbers mean nothing until you have a few weeks of them, so the value arrives late.
- A page that is slow for a real reason will not tell you the reason. It tells you where, not why.
- GoogleChrome/lighthouse
Scores one page at a time and is the tool inside the browser's developer tools, and it keeps no history.
Track this in Scout 
harlan-zw/unlighthousePublished in Edition 2, it runs Lighthouse across a whole site in one go and does not track change over time.
Track this in Scout
GoogleChrome/web-vitalsPublished in Edition 8, it reports what real visitors experienced from inside their browsers, which is the other half of the picture.
Track this in Scout
# Nothing to install with Docker. Run it from a folder you can write to: docker run --rm -v "$(pwd)":/sitespeed.io sitespeedio/sitespeed.io:latest \ https://grasppy.com/radar/ -n 3 # The report lands in ./sitespeed-result/ — open index.html in a browser. # Or, with Node.js 20 or newer: npm install -g sitespeed.io sitespeed.io https://grasppy.com/radar/ -n 3
3.7k stars · AGPL-3.0-or-later for the main project, with separately licensed paid enterprise features. A warning for the reader, never a disqualifier · v2.5.0 (2026-09-02), read from /releases/latest on 2026-09-18; the release page states seven commits have landed since · Track this in Scout
A self-hosted form builder with a drag-and-drop editor and its own hosted option.
▶Repo detailsthe review · specs · pros & cons · install
What it is
A web application written in PHP and Vue. You build a form by dragging fields, set rules so that one answer shows or hides another field, and publish it as its own page or embedded in yours. It handles file uploads, sends the answers on by webhook, and can be given your own domain.What it is good for. Anyone paying by the response for something that is, in the end, a table of answers. The problem it removes is the per-answer bill and the fact that your visitors' answers sit on somebody else's server. A short line about Grasppy: a waiting list and a feedback form are both this, and both would otherwise be a monthly subscription.
- No limit on forms, fields or answers, because the limit was only ever a price list.
- The answers stay in your own database, which makes the privacy question easy to answer.
- The main code is AGPL-3.0, so you can read all of it and change it.
- There is a separate paid Enterprise Edition, so some features are not in the free code. Check the list before you build a plan around one of them.
- It needs PHP, a database and Redis, which is a real stack to keep running rather than a single binary.
- Note the move:
JhumanJ/OpnFormnow redirects toOpnForm/OpnForm, and old install guides point at the old name.
- formbricks/formbricks
AGPL-3.0 with a separate enterprise directory, aimed at surveys inside a product you already run rather than at a public form.
Track this in Scout - heyform/heyform
Builds one-question-at-a-time conversational forms, which suits a long survey and suits a two-field contact form less well.
Track this in Scout 
baptisteArno/typebot.ioPublished in Edition 2, it builds a chat-shaped form with branching logic, and it now ships under the Functional Source License.
Track this in Scout
git clone https://github.com/OpnForm/OpnForm.git cd OpnForm cp .env.example .env # set the database and app keys here first docker compose up -d # Then follow the setup steps in the project's own docs/ folder # for the first admin account. It is on http://localhost:3000 by default.
110k stars · AGPL-3.0 · v3.2.2 (2026-09-15), read from /releases/latest; the GitHub date carried no year and falls in the past, so it is this year · Track this in Scout
A photo and video library you run on your own server, with real iOS and Android apps that upload in the background and search that works on what is in the picture.
▶Repo detailsthe review · specs · pros & cons · install
What it is
A self-hosted photo and video manager. It has a server, a web interface and real apps for iOS and Android that upload new pictures in the background. A machine-learning part recognises faces, objects and text inside pictures so that search works on what is in the image rather than only on the file name. It has albums, shared albums, a map, and partner sharing between two accounts.What it is good for. Anyone with a monthly bill for phone backup and enough room on a server. The problem it removes is renting space for photographs you already own. There is no connection to Grasppy, ScalpingMate or the channel, and it is here because it is one of the best pieces of self-hosted software on GitHub, which is the only reason it needs.
- The phone apps are the real thing, with background upload, so it can actually replace what you are paying for.
- Search works on what is in the picture, and face recognition runs on your own machine rather than on somebody's service.
- 110,000 stars and a release most weeks, which is an unusual amount of attention for self-hosted software.
- AGPL-3.0 licence, which is fine for running it and matters if you want to build a product on it.
- It runs several containers at once, including a machine-learning one, so it is the heaviest entry in this edition. Do not put it on a small server.
- Once your photographs are only here, this is your only copy. Back up its storage folder and its database, and test the restore.
- photoprism/photoprism
The older self-hosted photo library, lighter to run and without the polished automatic phone backup.
Track this in Scout - LibrePhotos/librephotos
Face recognition and automatic albums under a more permissive licence and with a much smaller team behind it.
Track this in Scout - jellyfin/jellyfin
The same idea for films and television rather than personal photographs, and it pairs with Navidrome from Edition 23 for music.
Track this in Scout
mkdir ./immich && cd ./immich wget -O docker-compose.yml https://github.com/immich-app/immich/releases/latest/download/docker-compose.yml wget -O .env https://github.com/immich-app/immich/releases/latest/download/example.env # Edit .env: set UPLOAD_LOCATION to a folder with a lot of free space, # and set DB_PASSWORD to something of your own. docker compose up -d # It is on http://<your-server>:2283 — the first account you create is the admin.
73.2k stars · AGPL-3.0 · v1.0.2 (2026-04-25), read from /releases/latest, where the tag is labelled ODP for Open Data Platform; the GitHub date carried no year and falls in the past, so it is this year · Track this in Scout
One Python interface in front of many financial data providers, so the answer comes back in the same shape whichever source it came from.
▶Repo detailsthe review · specs · pros & cons · install
What it is
An open data platform for market and economic information. You install a Python package and call it: one command for a share's price history, another for a company's income statement, another for an economic series. Each source is an extension, so adding a paid provider you already have is installing one more package and setting a key.What it is good for. Anyone doing research on markets who is tired of writing a new reader for every source. The problem it removes is the glue code. A short line about ScalpingMate: it trades one currency pair through OANDA and gets its prices there, and what this adds is the surrounding picture — interest-rate decisions, economic releases, and the calendar of the days when a strategy tends to behave differently.
- One shape of answer across many providers, so changing source does not mean rewriting the analysis.
- Several providers work with no key and no account at all, so the first hour costs nothing.
- Very large and very active, with 73,200 stars and a working Python interface rather than only a terminal.
- AGPL-3.0 licence. Running it for research is fine. Building a product that other people use on top of it brings real conditions.
- It is a big install with many dependencies. Use a virtual environment and expect it to take a while.
- Free data sources have limits and gaps, and none of them are meant for live trading decisions.
- ranaroussi/yfinance
Reads one source, Yahoo Finance, and it is a much smaller install when that one source is all you need.
Track this in Scout - microsoft/qlib
A platform for building and testing machine-learning trading models rather than for fetching data.
Track this in Scout - TA-Lib/ta-lib-python
Calculates the 150-odd standard indicators on price data you already have, which is the step after this one.
Track this in Scout
python3 -m venv venv
source venv/bin/activate
pip install openbb
# In Python:
# from openbb import obb
# df = obb.equity.price.historical("AAPL", start_date="2026-01-01").to_df()
# print(df.tail())
# Add a provider you have a key for, for example:
pip install openbb-fmp
Checked, and left out
These were opened for this edition and did not make it, with the reason.
simonw/files-to-prompt - UNVERIFIED, and explicitly NOT called dormant. 2.8k stars, Apache-2.0. Turns a folder of files into one prompt for a language model. PyPI states version 0.6 was released 19 February 2025; the GitHub release page shows the same tag with the yearless date '19 Feb', which by GitHub's habit would mean 2026. Nineteen months against seven, and nothing in this sandbox can settle it. It would have been a fourth hidden gem. New to the ledger, recorded as unverified. Needs a sweep from the Mac.
simonw/files-to-prompt - UNVERIFIED, and explicitly NOT called dormant. 2.8k stars, Apache-2.0. Turns a folder of files into one prompt for a language model. PyPI states version 0.6 was released 19 February 2025; the GitHub release page shows the same tag with the yearless date '19 Feb', which by GitHub's habit would mean 2026. Nineteen months against seven, and nothing in this sandbox can settle it. It would have been a fourth hidden gem. New to the ledger, recorded as unverified. Needs a sweep from the Mac.
schemathesis/schemathesis - ALIVE: v4.27.3, 17 September 2026. 3.6k stars, MIT. Generates thousands of requests from an API's own OpenAPI description and reports the responses that break the API's stated rules. A natural fit for anything built on FastAPI. Left out because the twelve were full. New to the ledger, queued.
schemathesis/schemathesis - ALIVE: v4.27.3, 17 September 2026. 3.6k stars, MIT. Generates thousands of requests from an API's own OpenAPI description and reports the responses that break the API's stated rules. A natural fit for anything built on FastAPI. Left out because the twelve were full. New to the ledger, queued.
zizmorcore/zizmor - ALIVE. 6.5k stars, MIT. Static analysis for GitHub Actions workflows, aimed at the security mistakes that are easy to make in an automated build. Left out because the twelve were full. New to the ledger, queued.
zizmorcore/zizmor - ALIVE. 6.5k stars, MIT. Static analysis for GitHub Actions workflows, aimed at the security mistakes that are easy to make in an automated build. Left out because the twelve were full. New to the ledger, queued.
unum-cloud/usearch - ALIVE. 4.3k stars, Apache-2.0. A very fast similarity-search engine for vectors, usable from ten languages. Overlaps Vicinity
unum-cloud/usearch - ALIVE. 4.3k stars, Apache-2.0. A very fast similarity-search engine for vectors, usable from ten languages. Overlaps Vicinity (Ed. 8 #9) and model2vec (Ed. 1 #11), and that comparison deserves its own entry. New to the ledger, queued.
crazy-max/diun - ALIVE. 4.9k stars, MIT. Watches container images and reports when an update is published, and never updates anything itself. Dockcheck took the single running-in-production place. New to the ledger, queued.
crazy-max/diun - ALIVE. 4.9k stars, MIT. Watches container images and reports when an update is published, and never updates anything itself. Dockcheck took the single running-in-production place. New to the ledger, queued.
sachaos/viddy - ALIVE: v1.3.1, 14 June 2026. 5.4k stars, MIT. A modern replacement for the watch command that keeps every past run so you can scroll back through what changed. mise took the single the-workshop place. New to the ledger, queued.
sachaos/viddy - ALIVE: v1.3.1, 14 June 2026. 5.4k stars, MIT. A modern replacement for the watch command that keeps every past run so you can scroll back through what changed. mise took the single the-workshop place. New to the ledger, queued.
kepano/defuddle - ALIVE. 9.4k stars, MIT. Extracts the article from a web page and returns it as Markdown. Overlaps trafilatura
kepano/defuddle - ALIVE. 9.4k stars, MIT. Extracts the article from a web page and returns it as Markdown. Overlaps trafilatura (Ed. 6 #5) and metascraper (Ed. 20 #11). New to the ledger, queued.
samuelcolvin/watchfiles - ALIVE. 2.5k stars, MIT. Watches files and reloads Python code when they change; it runs underneath several reload flags people already use. Left out because the twelve were full. New to the ledger, queued.
samuelcolvin/watchfiles - ALIVE. 2.5k stars, MIT. Watches files and reloads Python code when they change; it runs underneath several reload flags people already use. Left out because the twelve were full. New to the ledger, queued.
pmorissette/bt - ALIVE. Exactly 3.0k displayed stars, MIT. A backtesting framework by the author of ffn
pmorissette/bt - ALIVE. Exactly 3.0k displayed stars, MIT. A backtesting framework by the author of ffn (Ed. 13 #11). At 3.0k it is NOT counted as a hidden gem, on the same reading applied to pg_activity on 17 September. OpenBB took the single markets-and-trading place. New to the ledger, queued.
containrrr/watchtower - NOT-QUALIFIED, on the archived rule and on the owner's own statement, not on a date we read. GitHub shows 'This repository was archived by the owner on Dec 17, 2025. It is now read-only.' Last release v1.7.1, November 2025. 24.7k stars, Apache-2.0. Found while checking the Similar repositories list for entry #8, and it became the title of the edition. New to the ledger, recorded as not-qualified.
containrrr/watchtower - NOT-QUALIFIED, on the archived rule and on the owner's own statement, not on a date we read. GitHub shows 'This repository was archived by the owner on Dec 17, 2025. It is now read-only.' Last release v1.7.1, November 2025. 24.7k stars, Apache-2.0. Found while checking the Similar repositories list for entry #8, and it became the title of the edition. New to the ledger, recorded as not-qualified.
Coming tomorrow