Edition No. 33 · 27 Sep 2026

Twelve repositories for running your own tools

A drawing library with 49,000 stars turns out to check your licence and report back, and eleven other projects opened and verified this morning.

By Genn·12 repositories·14 min read

tldraw is the drawing engine behind a great many whiteboard and diagram tools, and it has 49,889 stars. Its terms are not open source. Putting it in front of real users needs a licence key you buy. Without one the canvas prints a watermark, and the terms forbid you to hide or remove it. The code carries measures to detect where it has been deployed, and it may send usage data back to check the licence. That is entry 11, and the terms were found by opening the licence file rather than trusting the one-word summary on the GitHub page.

The rest is a scraper that still finds the right element after a site is redesigned, visitor analytics you run yourself with session replay and no cookies, a database structure kept as one file instead of a pile of migration scripts, and a one-time secret page that has been maintained for nine years.

We aim for twelve every day. Some candidates fall out while we check them — those are listed at the end, with the reason.

Three things worth knowing, separate from the recommendations

A drawing library with 49,000 stars sends usage data home. tldraw is excellent software and its terms are not open source. Production use needs a bought key, the unlicensed version shows a watermark the terms forbid you to remove, and the code contains measures to "detect deployment environments" and may "collect and transmit usage data to tldraw for license compliance purposes." The GitHub sidebar says only "tldraw license", which tells you nothing. Three editions have now found a licence that a sidebar summary would have got wrong.

A cache can be behind its own self. This report uses a free public mirror of GitHub's data to prove a project is still alive. This morning that mirror's release information was behind GitHub's own pages on five of the twelve — and on one project it was two whole major versions and three months behind, while its record of that same project's code date was current to the minute. Twice it reported a release as published after the last code change it had recorded for the same project, which cannot be true. The rule it produces is narrow and useful: a mirror can be right about one field and wrong about another at the same moment, so check the field you are relying on, not the source.

A date with no year fired backwards for the first time. GitHub often prints a release date without the year. Every earlier time this has caught us, it made a project look older than it was. This time it went the other way: jqp's newest release reads "28 Sep", and 28 September has not happened yet this year, so the year cannot be 2026. It is 28 September 2025, which makes that release twelve months old rather than a day away. A date in the future is not a date — it is a year that has been lost.

If you only do three things

  1. noahgorstein/jqp (#7) — two minutes, one command, nothing to configure. You type a filter for a JSON data file and the answer appears as you type. When the filter is right, you copy it into your script.
  2. sqldef/sqldef (#8) — half an hour, and it changes nothing on the first run. Point it at a database that already exists, ask it to export, and out comes one file describing the whole thing. From then on you edit that file instead of writing migration scripts.
  3. Luzifer/ots (#6) — twenty minutes. A password you send to somebody stops living in the chat history forever. The link works once and then the secret is gone.

A drawing library with 49,000 stars sends usage data home

Twelve repositories, checked and reviewed. Every version verified against the GitHub API and dated.

83,999 stars · BSD-3-Clause, read from /blob/main/LICENSE on 2026-09-27; no restriction on commercial use, no enterprise carve-out · v0.4.15 (2026-08-23), read from /releases/latest and confirmed on PyPI · Track this in Scout

A Python scraping toolkit that stores structural context alongside each selector, so an element can still be found after a site is redesigned.

▶Repo detailsthe review · specs · pros & cons · install

What it is

Scrapling is a scraping framework for the Python programming language, covering everything from a single page fetch to a large crawl across a whole site. It offers three ways to fetch a page — a plain request, a "stealthy" mode aimed at anti-bot systems, and a real browser — behind one way of reading the result.

What it is good for. Anyone who runs a scraper that has to keep working for months rather than a weekend. Price monitoring, job listings, competitor pages and public records all break the same way: the site is redesigned and the selector (the short instruction that says which part of the page you want) quietly matches nothing. Scrapling stores structural context alongside each selector so the element can be relocated instead of silently returning empty. It also packages a command-line shell for pulling data out without writing a program, and an MCP server (a standard way to let an AI assistant drive a tool) so a model can run the scraping itself.

Stars83,999
LicenceBSD-3-Clause, read from /blob/main/LICENSE on 2026-09-27; no restriction on commercial use, no enterprise carve-out
Latestv0.4.15 (2026-08-23), read from /releases/latest and confirmed on PyPI
Good
  • The adaptive relocation of elements attacks the single biggest running cost of scraping, which is repairing selectors. None of the alternatives below offers it.
  • BSD-3-Clause, with no conditions on commercial use, so it can sit inside a paid product.
  • Genuinely fast-moving. Four releases between 26 July and 23 August 2026, and code landed on 26 September 2026.
Watch for
  • Installing it has two stages and is easy to get wrong. pip install scrapling on its own gives you only the page reader, and the first line that fetches anything then fails with a missing-module error. You have to install the extra and run scrapling install separately.
  • Neither the README nor the documentation states any memory or disk figure anywhere. The install step downloads browsers, and the download size is not published, so you cannot plan disk space. Stealth fetching runs real browsers, which is heavy in a way the documentation never quantifies.
  • Still before version 1.0, at v0.4.15. One release, v0.4.14, exists only to work around another installer refusing v0.4.13. The way you call it can change between versions.
Similar repositories
Install
python3 -m venv venv
source venv/bin/activate        # on Windows: venv\Scripts\activate
pip install "scrapling[fetchers]"
scrapling install
Screenshots
D4Vinci/Scrapling: GitHub preview cardD4Vinci/Scrapling: Screenshot 1

156,173 stars · Dify Open Source License - Apache 2.0 with added conditions, read from /blob/main/LICENSE on 2026-09-27: no multi-tenant operation without written authorisation, and the logo and copyright information may not be removed or modified · v1.17.1 (2026-09-10), read from /releases/latest and confirmed by ungh · Track this in Scout

A self-hosted platform for building applications on language models, with document search, tools, monitoring and an API in one deployable unit.

▶Repo detailsthe review · specs · pros & cons · install

What it is

Dify is a platform for building applications on top of large language models, which are the AI systems that read and write text. It bundles the whole surrounding kit: document ingestion and search, a registry of tools the model can call, prompt version history, monitoring, and a way to publish a finished application as an API.

What it is good for. A small team that has proved an AI idea in a notebook and now has to run it properly. Assembling that stack yourself means choosing an orchestration library, a vector database, a prompt store and a monitoring layer, and then rebuilding the lot when the prototype becomes a product. Dify is one deployable unit that covers all of it, and because it abstracts over model providers, a workflow can be pointed at a different model without being rewritten.

Stars156,173
LicenceDify Open Source License - Apache 2.0 with added conditions, read from /blob/main/LICENSE on 2026-09-27: no multi-tenant operation without written authorisation, and the logo and copyright information may not be removed or modified
Latestv1.17.1 (2026-09-10), read from /releases/latest and confirmed by ungh
Good
  • Very large and very active. About 156,000 stars, started in April 2023, code landed on 17 September 2026, on a stable 1.x release line.
  • Genuinely full-stack. Model routing, document search, tools, monitoring and an API arrive together, so a team integrates one project rather than five.
  • Self-hosting is a first-class path, with a documented quick start and a stated minimum of 2 processor cores and 4 GB of memory.
Watch for
  • The licence is the trap, and the sidebar does not show it. GitHub summarises it as Apache 2.0. The LICENSE file is the "Dify Open Source License", which is Apache 2.0 with conditions added. It says plainly that "you may not use the Dify source code to operate a multi-tenant environment" without written permission, and that "you may not remove or modify the LOGO or copyright information in the Dify console or applications". Running a service for other people on it, or putting your own name on the screen, needs a commercial agreement.
  • The stated 4 GB of memory is a floor, not a working figure. The bundled stack runs the API, a worker, the web front end, a database, Redis and a vector store together, so real use sits well above that. No disk figure is published at all.
  • Two ongoing costs. Every model call is billed to your own provider keys, and a 1.x release every few weeks against a live database means database migrations to manage at each upgrade. Docker Compose version 2.24.0 or newer is a hard requirement that older systems do not ship.
Similar repositories
Install
git clone https://github.com/langgenius/dify.git
cd dify/docker
cp .env.example .env
docker compose up -d
Screenshots
langgenius/dify: Screenshot 1langgenius/dify: Screenshot 2langgenius/dify: Screenshot 3langgenius/dify: Screenshot 4

10,754 stars · Apache-2.0, read from /blob/main/LICENSE on 2026-09-27; plain, with no added conditions · electron-v0.9.11-beta (2026-09-21), read from /releases/latest and confirmed by ungh · Track this in Scout

Generates editable PowerPoint decks from a prompt or a document, on your own machine, using whichever model provider you point it at.

▶Repo detailsthe review · specs · pros & cons · install

What it is

Presenton runs as a small web application inside a container and turns a text prompt or an uploaded file into a presentation. It also ships desktop builds for macOS, Windows and Linux for people who would rather not touch a command line.

What it is good for. Anyone who makes the same shape of deck over and over — a weekly report, a course module, a client summary — and pays a per-seat subscription to a hosted deck generator for the privilege. The output is a real PPTX file rather than a locked page, so it opens in PowerPoint, Keynote or LibreOffice and can be finished by hand. The same generation path is exposed as a single web address, /api/v1/ppt/presentation/generate, so it can be wired into an existing pipeline instead of being clicked.

Stars10,754
LicenceApache-2.0, read from /blob/main/LICENSE on 2026-09-27; plain, with no added conditions
Latestelectron-v0.9.11-beta (2026-09-21), read from /releases/latest and confirmed by ungh
Good
  • Plain Apache 2.0 with nothing added. In a category full of restrictive terms, this one has none.
  • Genuinely free in its choice of model. OpenAI, Anthropic, Google, Azure, Bedrock, OpenRouter and several others are supported, and so are Ollama and LM Studio, which run a model on your own hardware with no bill and no data leaving the machine.
  • The output is an editable PPTX and the interface is one documented endpoint, so it fits into work you already do rather than replacing it.
Watch for
  • Every release is a beta. The whole published history is 0.9.x-beta and there is no 1.0. There is no stable version to pin to.
  • No resource figures are published anywhere. The README, the documentation site and the hosting page give no memory, disk or graphics-card numbers. If you take the local-model route, the model download is the dominant cost and its size is not documented at all.
  • The setup is a command line, a container, a mounted folder and an API key held as an environment variable. That is a real barrier for someone who does not use a terminal, and the desktop build is the only way around it. Everything lives in the mounted app_data folder, so losing that folder loses every deck.
Similar repositories
Install
mkdir -p app_data
docker run --detach --name presenton \
  --publish 5001:80 \
  --volume "./app_data:/app_data" \
  --env LLM=openai \
  --env OPENAI_API_KEY="YOUR_API_KEY" \
  --env OPENAI_MODEL=gpt-4.1 \
  ghcr.io/presenton/presenton:latest
Screenshots
presenton/presenton: GitHub preview cardpresenton/presenton: Screenshot 1presenton/presenton: Screenshot 2presenton/presenton: Screenshot 3presenton/presenton: Screenshot 4

13,067 stars · AGPL-3.0, read from /blob/master/LICENSE.md on 2026-09-27 after /blob/master/LICENSE returned 404; plain AGPL, with the section 13 network clause the material obligation · v2.9.0 (2026-09-12), read from /releases/latest · Track this in Scout

Self-hosted website and product analytics with funnels, retention, session replay and error tracking, and no cookies.

▶Repo detailsthe review · specs · pros & cons · install

What it is

Rybbit is a self-hosted analytics server that records visits, sessions and custom events and shows them on a live dashboard. It goes well past page counting into product analytics: funnels, retention, user journeys, goals, session replay and error tracking.

What it is good for. Anyone running a site who wants to know what visitors do without sending that record to an advertising company. It is the most complete self-hosted option in this category right now, and the practical difference from a simple visitor counter is that you can answer why a number moved, not just that it moved. Because nothing is stored in a cookie, the usual consent banner is not required in most places, which removes a piece of work as well as a piece of clutter.

Stars13,067
LicenceAGPL-3.0, read from /blob/master/LICENSE.md on 2026-09-27 after /blob/master/LICENSE returned 404; plain AGPL, with the section 13 network clause the material obligation
Latestv2.9.0 (2026-09-12), read from /releases/latest
Good
  • Unusually wide coverage for a self-hosted tool. Session replay, funnels, retention and error tracking sit in one product instead of three.
  • One command on a blank server sets up the whole stack, the web server and the HTTPS certificate. Nothing else in this category is that direct.
  • Moving quickly and in public. Code landed on 27 September 2026, the day this was checked, with version 2.9.0 released on 12 September 2026, on a project that only started in January 2025.
Watch for
  • It needs a rented server, a domain name and a working DNS record before anything appears. There is no shared-hosting route and no desktop version.
  • The documented floor is 2 GB of memory, and the stack runs ClickHouse, PostgreSQL, the application and a web server together, so 2 GB is the minimum rather than the comfortable figure. ClickHouse on ARM processors needs ARMv8.2-A or newer, so older small boards will not run it. Stored analytics grow with traffic, so disk needs watching.
  • AGPL-3.0 carries a condition many people miss. If you modify it and let other people use it over a network, section 13 obliges you to offer those users the source of your modified version. Running it unmodified for yourself is unaffected. Maps also need a Mapbox token, which is a separate account.
Similar repositories
Install
# on a fresh server, with Docker already installed
git clone https://github.com/rybbit-io/rybbit.git
cd rybbit
chmod +x *.sh
./setup.sh your.domain.name
Screenshots
rybbit-io/rybbit: GitHub preview cardrybbit-io/rybbit: Screenshot 1rybbit-io/rybbit: Screenshot 2rybbit-io/rybbit: Screenshot 3rybbit-io/rybbit: Screenshot 4

32,881 stars · GPL-3.0, read from /blob/dev/LICENSE on 2026-09-27; verbatim upstream GPLv3 with no added terms and no enterprise carve-out · v2.4.0 (2026-09-17), read from /releases/latest · Track this in Scout

One self-hosted page that links to every service you run and shows a live figure from each of them.

▶Repo detailsthe review · specs · pros & cons · install

What it is

Homepage is a self-hosted start page and dashboard, shipped as a container image. It builds a grid of service tiles, bookmarks and information widgets from configuration files you put in a folder it can read.

What it is good for. Anyone running more than three or four services on a machine of their own. The tiles are not just links: they call each service's own API and show a real figure, so the page doubles as a status board. It can also find containers on its own by reading the Docker socket, and it can read Kubernetes services by label. Edition 30 covered glanceapp/glance, which answers the same question with feeds and machine statistics; homepage is the one with the deeper catalogue of service widgets.

Stars32,881
LicenceGPL-3.0, read from /blob/dev/LICENSE on 2026-09-27; verbatim upstream GPLv3 with no added terms and no enterprise carve-out
Latestv2.4.0 (2026-09-17), read from /releases/latest
Good
  • Active to the day. Code landed on 27 September 2026 and version 2.4.0 was released on 17 September 2026, on a project running since August 2022.
  • The widget catalogue for self-hosted applications is large, so the page reports live state instead of being a list of links.
  • Plain GPL-3.0 read from the LICENSE file, with no paid tier and no feature held back.
Watch for
  • Everything is configured by editing YAML files. The project's own documentation says "Homepage uses YAML for configuration" and advises checking it with a linter before deploying. There is no settings screen, and one misplaced space breaks the page. For someone who does not edit configuration files, that is the entire cost.
  • The documented install mounts the Docker socket into the container. The documentation itself calls this optional and "not recommended as primary integration method for non-root setups", because it hands the container control of Docker.
  • No memory or disk figures appear anywhere in the installation documentation, so sizing is guesswork. Two smaller frictions: the default branch is dev rather than main, and a source install has to be rebuilt on every upgrade.
Similar repositories
Install
docker run -p 3000:3000 \
  -e HOMEPAGE_ALLOWED_HOSTS=your.host:3000 \
  -v /path/to/config:/app/config \
  -v /var/run/docker.sock:/var/run/docker.sock:ro \
  ghcr.io/gethomepage/homepage:latest
Screenshots
gethomepage/homepage: GitHub preview cardgethomepage/homepage: Screenshot 1gethomepage/homepage: Screenshot 2gethomepage/homepage: Screenshot 3
06

Luzifer/ots

💎 hidden gem

799 stars · Apache-2.0, read from /blob/master/LICENSE on 2026-09-27; standard text, no added conditions · v1.22.0 (2026-09-27), read from /releases/latest and confirmed by ungh · Track this in Scout

A one-time secret page: the text is encrypted in the browser with 256-bit AES and destroyed the first time it is read.

▶Repo detailsthe review · specs · pros & cons · install

What it is

ots stores a secret and hands back a link that works exactly once. The browser generates a key and encrypts the text with 256-bit AES before anything leaves the machine, and the key travels in the part of the link that browsers never send to the server.

What it is good for. Anybody who has ever pasted a password into a chat window or an email. Those messages are searchable and permanent, and they outlive the reason they were sent. The README puts the design plainly: "The password is never sent to the server so the server will never be able to decrypt the secrets it delivers with a reasonable effort." There is an API for creating a secret from a script, and a companion command-line tool, so it can be built into a process rather than only used by hand. At 799 stars it is the smallest project in this edition and has been maintained since August 2017 — nine years.

Stars799
LicenceApache-2.0, read from /blob/master/LICENSE on 2026-09-27; standard text, no added conditions
Latestv1.22.0 (2026-09-27), read from /releases/latest and confirmed by ungh
Good
  • The encryption happens in the browser, so a server that is stolen or seized gives up scrambled text and no keys.
  • Nine years of unbroken maintenance, and version 1.22.0 was released on the morning this edition was written.
  • One small program with no database needed to start, configured entirely by environment variables, under plain Apache-2.0 with no conditions.
Watch for
  • Two defaults are wrong for real use. Storage defaults to memory, which the documentation describes as "wiped on restart of the daemon", so every pending secret is lost when it restarts. And SECRET_EXPIRY defaults to 0, which means no expiry at all, so unread secrets sit there forever. Durable operation means adding Redis, which is a second service to run and secure.
  • The documentation is split up and thin in places. The README says it moved to the wiki, and it contains no complete docker run command at all — only the name of the image.
  • Building from source needs a very new toolchain: Go 1.25.7 or newer, and Node 22 or newer for front-end work. No memory or disk figures are given, and putting HTTPS in front of it is your job.
Similar repositories
Install
# container
docker run -d -p 3000:3000 \
  -e STORAGE_TYPE=redis \
  -e REDIS_URL=redis://user:password@redis-host:6379/0 \
  -e SECRET_EXPIRY=604800 \
  ghcr.io/luzifer/ots:latest
Screenshots
Luzifer/ots: GitHub preview card
07

noahgorstein/jqp

💎 hidden gem

2,845 stars · MIT, read from /blob/main/LICENSE on 2026-09-27; copyright 2022 Noah Gorstein, no added conditions · v0.8.0 (2025-09-28), read from /releases/latest and settled by ungh · Track this in Scout

A terminal window where a jq filter is written against a JSON file and the result updates as you type.

▶Repo detailsthe review · specs · pros & cons · install

What it is

jqp is a small program that loads a JSON file and lets you write a jq filter against it with the result shown live beside it. jq is the standard command-line tool for pulling values out of JSON, and its syntax is powerful and easy to get wrong.

What it is good for. Anyone who works with an API and keeps rewriting the same filter at the shell prompt to see what it does. The normal loop is edit, run, squint, edit again. Here the feedback is immediate and the text is highlighted, so a complicated expression is assembled visually instead. It reads a file with -f or takes input piped in, and it handles both ordinary JSON and the line-by-line kind. The finished expression is then copied into a script, which is the actual point of the tool.

Stars2,845
LicenceMIT, read from /blob/main/LICENSE on 2026-09-27; copyright 2022 Noah Gorstein, no added conditions
Latestv0.8.0 (2025-09-28), read from /releases/latest and settled by ungh
Good
  • Immediate feedback with syntax highlighting turns writing a hard filter into a few seconds of iteration instead of a dozen shell commands.
  • Packaged unusually widely for a project this size — Homebrew, MacPorts, the Arch user repository, Snap, and prebuilt binaries — so most people install it with one line and never see the Go toolchain.
  • MIT, one static file, nothing to configure before the first run, and it carries its own copy of jq internally so you do not need jq installed.
Watch for
  • It has slowed down. The last release, v0.8.0, is dated 28 September 2025, which is almost twelve months ago, and no code has landed since 6 February 2026 — about seven and a half months. It works, and it is well inside the line this report draws, but it is the quietest project in this edition.
  • It helps you compose a filter; it does not replace jq in your scripts. The useful output is the expression, and you carry it out of the window by hand.
  • Appearance is configured only by hand-writing a file at $HOME/.jqp.yaml. There is no settings screen, no documentation site, and no stated memory figure — which matters, because the whole input file is held in memory while you filter it.
Similar repositories
Install
brew install jqp                                      # macOS or Linux with Homebrew
sudo snap install jqp                                 # Ubuntu and friends
go install github.com/noahgorstein/jqp@latest         # needs Go 1.24 or newer
Screenshots
noahgorstein/jqp: GitHub preview cardnoahgorstein/jqp: Screenshot 1noahgorstein/jqp: Screenshot 2

3,171 stars · MIT, read from /blob/master/LICENSE on 2026-09-27; the bundled parser/ directory is separately Apache-2.0 per parser/LICENSE.md, which adds the change-notice duty of Apache section 4(b) · v3.11.24 (2026-09-25), read from /releases/latest and confirmed by ungh and pkg.go.dev · Track this in Scout

Four command-line tools that keep one file describing the database you want and apply exactly the difference against the live one.

▶Repo detailsthe review · specs · pros & cons · install

What it is

sqldef is four command-line programs — mysqldef, psqldef, sqlite3def and mssqldef — that manage a database schema by comparison rather than by migration scripts. You keep a single file of ordinary CREATE TABLE statements; it reads the live database, compares, and generates exactly the changes required.

What it is good for. Anyone who has inherited a folder of numbered migration files and no longer trusts that running them from scratch produces the database that is actually in production. That drift is the problem this removes. --export writes the current live schema into the declarative form, so you can adopt it on an existing database in one command without changing anything. --dry-run prints the commands without running them, and --check exits with a distinct code when changes are pending, which makes it usable as an automatic gate before a deploy.

Stars3,171
LicenceMIT, read from /blob/master/LICENSE on 2026-09-27; the bundled parser/ directory is separately Apache-2.0 per parser/LICENSE.md, which adds the change-notice duty of Apache section 4(b)
Latestv3.11.24 (2026-09-25), read from /releases/latest and confirmed by ungh and pkg.go.dev
Good
  • Safe by default where it matters most. The documentation states "By default, DROP operations are skipped (safe mode)"; deleting anything requires --enable-drop explicitly.
  • One small self-contained program per database, with nothing to install underneath it, and --dry-run and --check make it drop straight into an automated pipeline.
  • Genuinely busy. Version 3.11.24 was released on 25 September 2026, code landed on 26 September 2026, and it has been running since August 2018.
Watch for
  • The risk is real once you turn dropping on. With --enable-drop, deleting a column from the description file deletes that column and its data from the live database. An accidental edit becomes an accidental deletion. Always run --dry-run first, and read what it prints.
  • There is no go install line in the documentation. The install section lists only archives, Homebrew and containers, so the Go route has to be worked out from the module path. Building from source also needs Go 1.26, which is very new.
  • A file named v4-migration.md sits in the repository root while the released line is still 3.x, so a version with breaking changes is coming. The documentation is also scattered across files in the repository root rather than a documentation site.
Similar repositories
Install
# Linux, for PostgreSQL
wget -O - https://github.com/sqldef/sqldef/releases/latest/download/psqldef_linux_amd64.tar.gz | tar xvz
# macOS
brew install sqldef/sqldef/psqldef
# from source, needs Go 1.26 or newer
go install github.com/sqldef/sqldef/v3/cmd/psqldef@latest
Screenshots
sqldef/sqldef: GitHub preview cardsqldef/sqldef: Screenshot 1

6,162 stars · MIT, read from /blob/main/LICENSE.md on 2026-09-27 after /blob/main/LICENSE returned 404; copyright 2022 Zef Hemel, no added conditions · 2.11.1 (2026-09-22), read from /releases/latest · Track this in Scout

A self-hosted personal knowledge base that keeps every page as a plain Markdown file in a folder you own, with links, search and live queries on top.

▶Repo detailsthe review · specs · pros & cons · install

What it is

SilverBullet is a self-hosted personal knowledge base reached through the browser. Every page is a plain Markdown file on disk, and on top of that it adds linking between pages, full-text search, templates, and a query layer that indexes pages so one page can display a live list drawn from the others.

What it is good for. Anyone who wants Notion-shaped features without a subscription or a lock-in. The strongest argument is what happens when you stop using it: the notes are still a folder of readable text files, so there is nothing to export. Scripting is done in a language called Lua, written directly inside the notes themselves, so commands and small automations live beside the content instead of in a plugin folder. It works offline in the browser too.

Worth knowing: this project changed its foundation. Until recently it was a Deno application. The repository root now carries Cargo.toml and Cargo.lock and no deno.json or package.json at all, and the README describes a Rust back end with a TypeScript client. Anything written about its Deno requirements is now out of date. Running it from the container image is unaffected.

Stars6,162
LicenceMIT, read from /blob/main/LICENSE.md on 2026-09-27 after /blob/main/LICENSE returned 404; copyright 2022 Zef Hemel, no added conditions
Latest2.11.1 (2026-09-22), read from /releases/latest
Good
  • The data is plain Markdown in a plain folder. Readable in any editor, portable to any other tool, and there is nothing to export.
  • Very small appetite. The install documentation says "a few hundred megabytes of RAM is sufficient" and that it runs on a Raspberry Pi.
  • MIT with no carve-out, no paid edition and no limit on use.
Watch for
  • There is no password by default. The documentation says outright that "A single-space server with no credentials set is open to anyone who can reach it." Setting one in single-space mode means putting a username and password in plain text into an environment variable, and the documentation marks single-space mode as legacy. Do not expose it to the internet before you have read that page.
  • The default container image includes a headless copy of Chromium, which makes it considerably larger than the "few hundred megabytes" figure suggests. A -slim image without Chromium exists, and no size is published for either.
  • There has been a lot of churn. The back end was rewritten from Deno to Rust and the scripting model was replaced, so older setups and third-party plugins face breaking migrations. There are 324 open issues.
Similar repositories
Install
docker run -d --restart unless-stopped \
  --name silverbullet \
  -p 3000:3000 \
  -e SB_USER=yourname:yourpassword \
  -v ./data:/data \
  ghcr.io/silverbulletmd/silverbullet:latest
Screenshots
silverbulletmd/silverbullet: GitHub preview card

8,922 stars · AGPL-3.0-or-later, read from /blob/main/LICENSE.md on 2026-09-27 after /blob/main/LICENSE returned 404; composer.json agrees. Section 13 obliges anyone who modifies it and offers it over a network to give those users the corresponding source · v0.21.0 (2026-09-22), read from /releases/latest and confirmed by ungh · Track this in Scout

Self-hosted time tracking for billable work, with clients, projects, tasks, rates at three levels and role-based permissions.

▶Repo detailsthe review · specs · pros & cons · install

What it is

solidtime is a web application for tracking billable time across several organisations and several people. Entries attach to clients, projects, tasks and tags, rates can be set at the organisation, project or person level, and the result is aggregated into reports and PDF exports.

What it is good for. Freelancers and small agencies paying per person per month for a hosted tracker, and anyone who would rather their clients' billing records were not on someone else's server. Permissions are role-based, so a contractor can log time without seeing the whole organisation's figures. It also ships importers for Toggl and Clockify, so moving in does not mean abandoning your history — that is often the thing that keeps people on a paid product.

Stars8,922
LicenceAGPL-3.0-or-later, read from /blob/main/LICENSE.md on 2026-09-27 after /blob/main/LICENSE returned 404; composer.json agrees. Section 13 obliges anyone who modifies it and offers it over a network to give those users the corresponding source
Latestv0.21.0 (2026-09-22), read from /releases/latest and confirmed by ungh
Good
  • It covers the parts that actually matter for invoicing: clients, projects, tasks, billable rates at three levels, several organisations, and role-based permissions.
  • Importers for Toggl and Clockify mean your existing history comes with you.
  • Officially maintained container images and a separate repository of working example configurations, so deploying it is not reverse-engineered from the source.
Watch for
  • It is not a one-command install. A working deployment is four containers plus a separate PDF service, and it needs generated keys, roughly twenty environment variables, and a database migration step. This is a system-administration job.
  • PostgreSQL only. The documentation says plainly that "solidtime only supports PostgreSQL", which rules out most cheap shared hosting. The PHP version is also pinned narrowly to 8.3.
  • Still before version 1.0, at v0.21.0 after about twenty months. There is also a paid "On-Premise Business" plan for self-hosted installations, so some features sit behind a commercial plan rather than in this repository — though the repository itself is fully AGPL, with no enterprise folder inside it.
Similar repositories
Install
# take the compose file from solidtime-io/self-hosting-examples
docker run --rm solidtime/solidtime:main php artisan self-host:generate-keys
# put APP_KEY, PASSPORT_PRIVATE_KEY, PASSPORT_PUBLIC_KEY and the DB_* values into laravel.env
docker compose up -d
docker compose exec scheduler php artisan migrate --force
Screenshots
solidtime-io/solidtime: GitHub preview cardsolidtime-io/solidtime: Screenshot 1

50.2k stars · tldraw licence — free in development, PAID LICENCE KEY REQUIRED IN PRODUCTION · v5.4.0 (2026-09-02) · Track this in Scout

The best infinite-canvas SDK for React, and superficially perfect for Grasppy's map.

▶Repo detailsthe review · specs · pros & cons · install

What it is

tldraw is a software development kit for building infinite-canvas applications in React. It supplies a complete canvas: freehand drawing, shapes, arrows with bindings, text, selection, camera and undo history, plus a separate package that adds several people editing at once.

What it is good for. A product team that needs a whiteboard, a diagram editor or a spatial workflow screen inside their own application. Writing that yourself is months of work in hit-testing, camera maths and conflict handling, and most of that work is invisible when it is done well. Here it is a dependency. Custom shapes and tools are first-class, so it can be shaped into something specific rather than only a generic whiteboard.

The licence, read from the file, because this is the finding of the edition. It is not open source. The terms say licensees agree "Not to use the Software in Production Environments", where production means any deployment that provides functionality to end users. Production use requires a licence key issued under a separate commercial agreement. Without one, the canvas shows a watermark, and the terms say "Not to disable, hide, remove, or alter the Watermark." Enforcement is built into the code: "The Software includes technical measures to verify License Key validity, detect deployment environments, enforce usage restrictions based on license type, and ensure proper watermark display." And the terms state that "The Software may collect and transmit usage data to tldraw for license compliance purposes." This report prints licences as warnings and never as a reason to leave a project out — but this one is worth reading before, not after.

Stars50.2k
Licencetldraw licence — free in development, PAID LICENCE KEY REQUIRED IN PRODUCTION
Latestv5.4.0 (2026-09-02)checked 7 Sep 2026
Written inTypeScript
Good
  • The editor is complete straight away. Camera, snapping, grouping, undo, redo and export all work with no configuration, which is far beyond most canvas libraries.
  • npm create tldraw@latest offers ready-made starter projects, including a multiplayer one, so a working collaborative canvas exists in minutes.
  • Unambiguously alive and fast-moving: version 5.4.2 was released on 10 September 2026, on a project that started in May 2021.
Watch for
  • Not open source, and production costs money. See the paragraph above. Anyone assuming a permissive licence from the star count is wrong.
  • The licence-compliance telemetry means it may send usage data back. That is a hard stop for an air-gapped deployment or one with strict privacy rules.
  • It is a kit for programmers, not an application. There is no end-user product and no path that avoids React and a build pipeline, and the several-people-at-once feature additionally needs a synchronisation server you run.
Similar repositories
Install
npm create tldraw@latest       # a ready-made starter project
# or, into an existing React application:
npm install tldraw
npm install @tldraw/sync       # only for several people editing at once
Screenshots
tldraw/tldraw: GitHub preview cardtldraw/tldraw: Screenshot 1tldraw/tldraw: Screenshot 2
12

skfolio/skfolio

💎 hidden gem

2,439 stars · BSD-3-Clause, read from /blob/main/LICENSE on 2026-09-27; plain, copyright 2023-2026 The skfolio developers · v1.4.2 (2026-09-27), read from /releases/latest · Track this in Scout

Portfolio optimisation written as scikit-learn estimators, with walk-forward and combinatorial purged cross-validation built in.

▶Repo detailsthe review · specs · pros & cons · install

What it is

skfolio implements portfolio optimisation as scikit-learn estimators, so every optimiser, risk model and return model uses the same familiar fit and predict pattern and drops straight into scikit-learn pipelines and parameter searches. It covers simple allocation, convex optimisation, risk budgeting and clustering methods, with transaction costs, fees and weight constraints available throughout.

What it is good for. Anyone doing quantitative research on allocation who is currently hand-writing optimisation problems for each strategy and hand-writing their own testing splits. The second half is the important one. It ships walk-forward and combinatorial purged cross-validation, which are the methods that stop information from the future leaking into a test of the past. That leak is the most common way a backtest looks wonderful and then loses money, and having it as library code rather than as something you remember to do is the real value here. None of this is advice, and a good backtest is not evidence about the future.

Stars2,439
LicenceBSD-3-Clause, read from /blob/main/LICENSE on 2026-09-27; plain, copyright 2023-2026 The skfolio developers
Latestv1.4.2 (2026-09-27), read from /releases/latest
Good
  • The scikit-learn pattern is real rather than cosmetic, so parameter searches and nested testing work without any adapter code.
  • Time-aware cross-validation is built in, which addresses the most common methodological mistake in this field directly.
  • BSD-3-Clause with no conditions, a real documentation site, packages on both PyPI and conda-forge, and a company offering paid support behind it. Version 1.4.2 was released on the morning this edition was written.
Watch for
  • It is a library with nothing to open. No screen, no command line, and you supply your own price data, because it ships no data feed at all.
  • The version churn is severe. It went from 0.20.x to 1.4.x in roughly five months, with four releases inside eight days in April 2026. Do not assume the way you call it will survive an upgrade, despite the 1.x number.
  • Some advertised constraints need a solver that is not installed with it. Cardinality and threshold constraints require a mixed-integer solver, and two of the three documented options are commercial products you pay for. The dependency set is also several hundred megabytes in practice, and no memory figure is published.
Similar repositories
Install
python3 -m venv venv
source venv/bin/activate        # on Windows: venv\Scripts\activate
pip install -U skfolio
Screenshots
skfolio/skfolio: GitHub preview card

Checked, and left out

These were opened for this edition and did not make it, with the reason.

eliasdabbas/advertools - already-published, Editions 1 and 6. Verified in full as a getting-found candidate and then pulled by the id check before any entry was written. Its one permitted repeat was spent in Edition 6.

eliasdabbas/advertools - already-published, Editions 1 and 6. Verified in full as a getting-found candidate and then pulled by the id check before any entry was written. Its one permitted repeat was spent in Edition 6.

harlan-zw/unlighthouse - already-published, Edition 2. Verified in full and pulled by the id check. Alive: code 22 September 2026, release v0.18.1 the same day.

harlan-zw/unlighthouse - already-published, Edition 2. Verified in full and pulled by the id check. Alive: code 22 September 2026, release v0.18.1 the same day.

towfiqi/serpbear - already-published, Edition 15. Verified in full and pulled by the id check. Alive: code 14 May 2026, release v3.1.0 of 27 March 2026.

towfiqi/serpbear - already-published, Edition 15. Verified in full and pulled by the id check. Alive: code 14 May 2026, release v3.1.0 of 27 March 2026.

abhinavxd/libredesk - already-published, Edition 5. Verified in full as a talking-to-customers gem and pulled by the id check. Alive: code 5 September 2026, v2.8.0 of 22 August 2026, and at about 2,890 stars it is close to crossing the gem line.

abhinavxd/libredesk - already-published, Edition 5. Verified in full as a talking-to-customers gem and pulled by the id check. Alive: code 5 September 2026, v2.8.0 of 22 August 2026, and at about 2,890 stars it is close to crossing the gem line.

mutonby/openshorts - already-published, Edition 2. This was request id 29. It publishes no tagged releases at all, so nothing since Edition 2 earns a repeat; reported as used rather than repeated.

mutonby/openshorts - already-published, Edition 2. This was request id 29. It publishes no tagged releases at all, so nothing since Edition 2 earns a repeat; reported as used rather than repeated.

coder/agentapi - queued. 1,500 stars, MIT read from the file, code 13 September 2026. One HTTP interface in front of nine terminal coding agents. Held back because its newest release, v0.12.2 of 27 May 2026, is four months behind the code.

coder/agentapi - queued. 1,500 stars, MIT read from the file, code 13 September 2026. One HTTP interface in front of nine terminal coding agents. Held back because its newest release, v0.12.2 of 27 May 2026, is four months behind the code.

kobaltedev/kobalte - queued. 1,818 stars, MIT at LICENSE.md, code 31 July 2026. Accessible unstyled components for SolidJS. Held back because a 2.0 rewrite is in alpha, so anything built on the 0.13 line faces a migration.

kobaltedev/kobalte - queued. 1,818 stars, MIT at LICENSE.md, code 31 July 2026. Accessible unstyled components for SolidJS. Held back because a 2.0 rewrite is in alpha, so anything built on the 0.13 line faces a migration.

SlideSpeak/slidespeak-backend - not-qualified. 96 stars, last code 6 December 2024, twenty-two months. Found in the comparison list under entry 3. No archived banner, so it is called finished on the code date alone.

SlideSpeak/slidespeak-backend - not-qualified. 96 stars, last code 6 December 2024, twenty-two months. Found in the comparison list under entry 3. No archived banner, so it is called finished on the code date alone.

djrobstep/migra - listed as a comparison under entry 8 with its date rather than dropped. 3,047 stars, last code 25 August 2025, and its own GitHub description now begins DEPRECATED.

djrobstep/migra - listed as a comparison under entry 8 with its date rather than dropped. 3,047 stars, last code 25 August 2025, and its own GitHub description now begins DEPRECATED.

Peppermint-Lab/peppermint - listed with its date rather than dropped. 3,159 stars, last code 21 September 2025, visibly slowing.

Peppermint-Lab/peppermint - listed with its date rather than dropped. 3,159 stars, last code 21 September 2025, visibly slowing.

Share this edition
← PreviousNo. 32Next →
Coming tomorrow

Get the next edition in your inbox

A dozen repositories, opened and checked. The licence read, the last release dated, and the ones that did not make it named with the reason. It is the half most lists leave out.

No tracking pixels. One click to leave. The archive stays free either way.

We use your address to send the edition and nothing else. Confirm by email, leave in one click. How we handle it.