Edition No. 35 · 29 Sep 2026
Twelve repositories for checking your code, your files and your bills
A file manager with 35,900 stars was archived last month and will get no more security patches.
Twelve open-source repositories, opened and checked this morning. There is no theme. The spread is deliberate, the quality bar is not negotiable.
We aim for twelve every day. Some candidates fall out while we check them — those are listed at the end, with the reason.
The thing to read first. While checking alternatives to entry 9, we opened filebrowser/filebrowser. It has 35,900 stars. Its own README says: "File Browser is being archived on 2026-09-01. On that date this repository becomes read-only." The repository page shows the archive happened on 31 August 2026. After that date there are no further releases and no security fixes, though the existing downloads and container images stay online. File Browser puts a web page in front of a folder so people can upload, edit and delete files in a browser. A very large number of copies are reachable from the internet. If one of them is yours, that is today's most useful sentence on this page.
Three things worth knowing, separate from the recommendations
- A project can end quietly and stay installed everywhere. File Browser has 35,900 stars and was archived on 31 August 2026. Its README announces the date as 2026-09-01, one day apart from the banner, and states that there will be no further releases and no security fixes. The downloads and container images remain available, which means new installations will keep happening for years. - The author of a tool is the best source on what replaced it. xsv has 10,800 stars, was archived on 24 April 2025, and its last release is dated May 2018. Its README names two successors, and one of them is entry 7. Entry 7's own licence file carries the original author's copyright line from 2015 beside the current company's from 2026, which the README never mentions. - A date with no year is not a date. Five of today's twelve had their newest release misread by exactly this: the year was missing from the page and got filled in wrongly. Four were read as two years old, and one as nine. Every one was settled against a second source, and the table is in the appendix.
If you only do three things
- restish (entry 5) — five minutes, one command, nothing to configure. It reads an API's own description file and turns it into short commands with readable, coloured output. It replaces long, fiddly
curllines you retype every day. - qsv (entry 7) — twenty minutes, on CSV files that already exist. One downloaded program that sorts, joins, de-duplicates, validates and describes a table of data, at speeds a spreadsheet cannot reach.
- TruffleHog (entry 4) — half an hour, on a code repository that already exists, and the strongest thing on this page. It reads the whole history for passwords and keys, and then it checks whether each one still works.
Every link in one place
| # | Repository | Website | Stars | Licence |
|---|---|---|---|---|
| 1 | awesome-selfhosted/awesome-selfhosted | awesome-selfhosted.net | 322,645 | CC-BY-SA-3.0 |
| 2 | OpenHands/OpenHands | openhands.dev | 89,500 | MIT |
| 3 | coder/agentapi 💎 | — | 1,500 | MIT |
| 4 | trufflesecurity/trufflehog | trufflesecurity.com | 27,600 | AGPL-3.0 |
| 5 | rest-sh/restish 💎 | rest.sh | 1,400 | MIT |
| 6 | dottxt-ai/outlines | dottxt-ai.github.io/outlines | 15,882 | Apache-2.0 |
| 7 | dathere/qsv | qsv.dathere.com | 3,798 | MIT |
| 8 | pikepdf/pikepdf 💎 | pikepdf.readthedocs.io | 2,774 | MPL-2.0 |
| 9 | veeso/termscp | termscp.rs | 3,105 | MIT |
| 10 | ellite/Wallos | wallosapp.com | 8,600 | GPL-3.0 |
| 11 | tinacms/tinacms | tina.io | 13,813 | Apache-2.0 |
| 12 | TA-Lib/ta-lib-python | ta-lib.org | 12,159 | BSD-2-Clause |
A file manager with 35,900 stars has stopped getting security patches
Twelve repositories, checked and reviewed. Every version verified against the GitHub API and dated.
322,645 stars · CC-BY-SA-3.0, read from /blob/master/LICENSE on 2026-09-29. A content licence rather than a software licence: attribution required, share-alike on any adaptation, no sublicensing, and adaptations must be marked as changed. · 1.0.0, dated 22 August with no year readable from here; the release note records the move to awesome-selfhosted.net and the split of the raw data into awesome-selfhosted-data. Currency rests on the code date, 2026-09-29, the morning of the run. · Track this in Scout
A hand-curated list of free software that can be run on a computer of your own, sorted by what the software does.
▶Repo detailsspecs
- sindresorhus/awesome
510,300 stars, CC0-1.0, and it is the index of lists rather than a list of software; you would use it to find this one, not instead of it.
Track this in Scout - awesome-foss/awesome-sysadmin
34,900 stars, CC-BY-SA-4.0, the same idea aimed at people running servers, so it leans towards infrastructure rather than applications a person opens.
Track this in Scout - mikeroyal/Self-Hosting-Guide
21,900 stars, and it explains how to run things rather than cataloguing what to run, which makes it the companion to this list rather than a replacement.
Track this in Scout
89,500 stars · MIT, read from /blob/main/LICENSE on 2026-09-29; plain, copyright 2025 OpenHands contributors, no added conditions and no paid key · v1.24.0 (2026-09-25), read from /releases/latest. ungh's pushedAt of 2026-09-20 on the OLD name is stale, because it predates that release. · Track this in Scout
A self-hosted control screen that runs several coding assistants and shows what each one is doing.
▶Repo detailsspecs
- anomalyco/opencode
196,600 stars, MIT, a coding agent for the terminal; far more popular, but it is the agent itself rather than a console for running several.
Track this in Scout - cline/cline
67,600 stars, Apache-2.0, an agent available as a library, an editor extension or a command-line assistant; it lives inside an editor rather than giving you a separate screen.
Track this in Scout 
Aider-AI/aider49,200 stars, Apache-2.0, covered in Edition 25; it commits every change to git as it goes, which is a different and smaller promise.
Track this in Scout
1,500 stars · MIT, read from /blob/main/LICENSE on 2026-09-27 and confirmed on 2026-09-29; plain, copyright 2025 Coder Technologies, Inc., no added conditions · v0.12.2 (2026-05-27), read from /releases/latest; the code moved on 2026-09-13, so a pinned release tag is four months behind the branch · Track this in Scout
Puts one HTTP interface in front of eleven terminal coding assistants, so other software can drive them instead of pretending to be a keyboard.
▶Repo detailsspecs
OpenHands/OpenHandsEntry 2 in this edition, 89,500 stars; it gives you a finished screen, where this gives you an interface to build your own screen on.
Track this in Scout
aaif-goose/goose54,600 stars, Apache-2.0, covered in Edition 29; it is one of the assistants this program drives, not a way of driving assistants.
Track this in Scout- anomalyco/opencode
196,600 stars, MIT; also one of the eleven it supports, and it has its own server mode, so for that one assistant alone you may not need this.
Track this in Scout
27,600 stars · AGPL-3.0, read from /blob/main/LICENSE on 2026-09-29 and PLAIN AND UNMODIFIED, with no enterprise carve-out, which was checked specifically because the company behind it sells an enterprise product · v3.97.9 (2026-09-24). THE YEAR TRAP, settled by contradiction rather than by a second date: /releases/latest prints "24 Sep" with no year and it was read as 2024, while ungh's releases endpoint gives v3.97.4 published 2026-09-03; a lower version cannot be published after a higher one, so v3.97.9 postdates 3 September 2026. ungh was stale on both fields for this row, with pushedAt 2026-08-23. · Track this in Scout
Finds passwords and keys in a code history, container images and storage buckets, and then checks which of them still work.
▶Repo detailsspecs
gitleaks/gitleaks29,400 stars, MIT, covered in Edition 28 as that edition's strongest entry; its README now states the project is feature complete and that future releases will be security patches only.
Track this in Scout- Yelp/detect-secrets
4,600 stars, Apache-2.0, aimed at stopping new secrets from being committed rather than digging through the past, and it does not verify what it finds.
Track this in Scout - GitGuardian/ggshield
2,000 stars, MIT, v1.52.2 of 17 June 2026; over 500 kinds of secret, but detection runs on the vendor's service, so it needs an account and it sends your content away.
Track this in Scout
1,400 stars · MIT, read from /blob/main/LICENSE.md on 2026-09-29 after both /blob/main/LICENSE and /blob/master/LICENSE returned 404; plain, copyright 2020 Daniel G. Taylor · v2.3.0 (2026-06-30). THE YEAR TRAP: /releases/latest prints "June 30" with no year and it was read as 2024; pkg.go.dev settles it as 2026. No code date could be read for this row, because ungh returned HTTP 429 all morning; currency rests on a release three months old, which is comfortably inside the eighteen-month bar. · Track this in Scout
A command-line tool for calling web APIs that builds short commands from the API's own description and remembers a login for each service.
▶Repo detailsspecs
- httpie/cli
38,600 stars, BSD-3-Clause, the best-known friendly HTTP client; more popular and simpler, but it does not read API descriptions and has no profile system of this kind.
Track this in Scout - Orange-OpenSource/hurl
19,200 stars, Apache-2.0, version 8.0.1; it runs and tests requests written in a plain text file, which makes it better for repeatable checks and worse for exploring.
Track this in Scout - ducaale/xh
8,100 stars, MIT, a fast Rust rewrite of the HTTPie style of command; quick and small, with no API discovery.
Track this in Scout
15,882 stars · Apache-2.0, read from /blob/main/LICENSE on 2026-09-29; plain, copyright "2023- The Outlines developers", no added conditions · v1.3.3 (2026-08-06). THE YEAR TRAP: /releases/latest prints the date without a year and it was read as 2024; PyPI settles it as 2026. Code on 2026-09-21. · Track this in Scout
It makes a model return valid structured output by constraining what the model is allowed to generate.
▶Repo detailsspecs
BoundaryML/baml9,174 stars, Apache-2.0, covered in Edition 32; it asks you to learn a small new language for the same job, where this is a library you import.
Track this in Scout
567-labs/instructor14,000 stars, MIT; it validates the answer after the model has written it and retries on failure, which is simpler to adopt and weaker as a guarantee.
Track this in Scout- guardrails-ai/guardrails
7,300 stars, Apache-2.0; broader in scope, covering content checks as well as shape, and correspondingly heavier.
Track this in Scout
3,798 stars · MIT, read from /blob/master/LICENSE-MIT on 2026-09-29; it carries TWO copyright lines, "(c) 2015 Andrew Gallant" and "(c) 2026 datHere, Inc.", which is the xsv lineage the README never states · 23.0.1 (2026-09-13), the "Context is King" release, 270 commits since 22.0.1. Code on 2026-09-28. · Track this in Scout
A fast command-line toolkit for sorting, joining, checking and describing CSV files, with around 140 commands.
▶Repo detailsspecs
- BurntSushi/xsv
10,800 stars, Unlicense and MIT, and archived by its owner on 24 April 2025; its README now recommends qsv or xan in its place, which is the author of the original naming its successors.
Track this in Scout - medialab/xan
4,500 stars, the other project named in that sentence; it leans towards exploring and drawing data in the terminal, where qsv leans towards processing pipelines.
Track this in Scout - johnkerl/miller
10,000 stars, BSD-2-Clause; it handles CSV, TSV and line-by-line JSON with a small query language of its own, which is more expressive and slower to learn.
Track this in Scout
2,774 stars · MPL-2.0, read from /blob/main/LICENSE.txt on 2026-09-29, NOT the MIT most Python libraries carry; file-level copyleft, so modifications to pikepdf's own files must be published while combining it with closed software is free · 10.15.0 (2026-09-28), from PyPI. THE YEAR TRAP: /releases/latest prints "28 Sep" without a year and it was read as 2024. ungh's pushedAt of 2026-07-31 also cannot be right, because that release shipped on 28 September 2026. · Track this in Scout
A Python library for reading and writing PDF files, built on the QPDF engine, that preserves structure rather than redrawing the file.
▶Repo detailsspecs
pdfcpu/pdfcpu8,746 stars, Apache-2.0, covered in Edition 34 as that edition's strongest entry; it is a single downloaded command as well as a library, so it needs no programming for the common jobs.
Track this in Scout- py-pdf/pypdf
10,168 stars, BSD, code on 21 August 2026; pure Python with no compiled dependency, which makes it easier to install and slower on large files.
Track this in Scout - pymupdf/PyMuPDF
10,797 stars, code on 28 September 2026, and the licence is the difference: AGPL-3.0 with a paid commercial option, where this one is MPL-2.0.
Track this in Scout
3,105 stars · MIT, read from /blob/main/LICENSE on 2026-09-29; plain, copyright 2020-2022 Christian Visintin · v1.2.0 (2026-09-03), read from /releases/latest. Code on 2026-09-16. · Track this in Scout
A two-panel terminal file explorer that connects to remote machines over eight protocols, with saved connections.
▶Repo detailsspecs
sxyazi/yazi42,300 stars, MIT, covered in Edition 28; a much more popular terminal file manager, but it is built for local files and previews rather than remote transfer.
Track this in Scout- rclone/rclone
59,300 stars, MIT, over 150 storage providers; it is the right answer for scripted and scheduled syncing, and it gives you no interactive screen.
Track this in Scout - filebrowser/filebrowser
35,900 stars, Apache-2.0, and archived on 31 August 2026 with no further releases and no security fixes, although the existing downloads and container images stay online.
Track this in Scout
8,600 stars · GPL-3.0, read from /blob/main/LICENSE.md on 2026-09-29 after the plain /blob/main/LICENSE path returned 404; unmodified Free Software Foundation text · v5.8.2 (2026-09-27), and it is A SECURITY RELEASE: it enforced server-side authentication restrictions and added foreign-key ownership validation for subscription records. Code the same day. · Track this in Scout
A self-hosted tracker for recurring subscriptions, with renewal dates, several currencies, totals and reminders.
▶Repo detailsspecs
firefly-iii/firefly-iii24,700 stars, AGPL-3.0, covered in Edition 28; a full personal finance manager, so it does far more and takes far longer to set up.
Track this in Scout
actualbudget/actual29,100 stars, MIT; envelope budgeting that works offline first and syncs between devices, which is a different discipline from tracking recurring charges.
Track this in Scout- moneymanagerex/moneymanagerex
2,236 stars, a desktop program rather than a web page, and aimed at household accounts as a whole.
Track this in Scout
13,813 stars · Apache-2.0, read from /blob/main/LICENSE on 2026-09-29, plain and unmodified; the published npm package reports the same licence · tinacms@3.14.1, read from /releases/latest as "23 Sep" with no year and confirmed current by npm; the code landed on 2026-09-29, the morning of the run, so the release is 2026 · Track this in Scout
An editing panel that sits on the rendered page of a site whose content lives as files in a code repository.
▶Repo detailsspecs
- decaporg/decap-cms
19,400 stars, MIT, the long-established option in this category and still taking code; it edits through forms rather than on the page itself.
Track this in Scout 
sveltia/sveltia-cms2,900 stars, MIT, covered in Edition 14; a modern rewrite of the same configuration format, much lighter, with strong support for several languages on one site.
Track this in Scout- hunvreus/pagescms
4,000 stars, MIT; deliberately the simplest of the four, editing content straight in a GitHub repository with almost nothing to configure.
Track this in Scout
12,159 stars · BSD-2-Clause, read from /blob/master/LICENSE on 2026-09-29; short and permissive, and the file carries no named copyright holder · 0.8.1 (2026-09-21), from PyPI. THE LARGEST YEAR-TRAP ERROR IN THIS ARCHIVE: /releases/latest prints "21 Sep" with no year and it was read as 2017, a NINE-YEAR error where the previous record was two years. ungh's pushedAt of 2026-07-29 is also stale, because that release shipped on 21 September 2026. · Track this in Scout
More than 150 standard chart indicators for Python, computed by the long-established TA-Lib engine.
▶Repo detailsspecs
- bukosabino/ta
5,100 stars, MIT, 43 indicators in pure Python with pandas and numpy; far easier to install everywhere and a much smaller set, with 122 open issues.
Track this in Scout 
jealous/stockstats1,500 stars, BSD-3-Clause, covered in Edition 10; indicators appear as columns on a DataFrame when you ask for them, which is the friendliest of the three to read.
Track this in Scout- nardew/talipp
536 stars, MIT; it recomputes incrementally as each new value arrives, which suits live data and is the wrong shape for bulk history.
Track this in Scout
Checked, and left out
These were opened for this edition and did not make it, with the reason.
filebrowser/filebrowser - not-qualified. 35,900 stars, archived by its owner on 31 August 2026 while its README announces the date as 2026-09-01, and it states there will be no further releases and no security fixes although the existing downloads and container images stay online. Found in the comparison list under entry 9, and it is the Edition 35 title.
filebrowser/filebrowser - not-qualified. 35,900 stars, archived by its owner on 31 August 2026 while its README announces the date as 2026-09-01, and it states there will be no further releases and no security fixes although the existing downloads and container images stay online. Found in the comparison list under entry 9, and it is the Edition 35 title.
BurntSushi/xsv - not-qualified. 10,800 stars, archived by its owner on 24 April 2025, last release 0.13.0 of May 2018. Its README now recommends qsv or xan in its place, which is the author of the original naming its successors. Found in the comparison list under entry 7.
BurntSushi/xsv - not-qualified. 10,800 stars, archived by its owner on 24 April 2025, last release 0.13.0 of May 2018. Its README now recommends qsv or xan in its place, which is the author of the original naming its successors. Found in the comparison list under entry 7.
omkarcloud/botasaurus - unverified. 5,700 stars, MIT read from the LICENSE file, PyPI package at 4.0.97. It was researched in full as the automation-and-scraping entry and pulled at the last step because no code date could be read: it publishes no GitHub releases at all, its commits page is robots-disallowed, and ungh returned HTTP 429 on every attempt. Explicitly not called dead. Replaced in the edition by tinacms.
omkarcloud/botasaurus - unverified. 5,700 stars, MIT read from the LICENSE file, PyPI package at 4.0.97. It was researched in full as the automation-and-scraping entry and pulled at the last step because no code date could be read: it publishes no GitHub releases at all, its commits page is robots-disallowed, and ungh returned HTTP 429 on every attempt. Explicitly not called dead. Replaced in the edition by tinacms.
medialab/xan - queued. 4,500 stars, the second project named by xsv's author. Listed as a comparison under entry 7.
medialab/xan - queued. 4,500 stars, the second project named by xsv's author. Listed as a comparison under entry 7.
johnkerl/miller - queued. 10,000 stars, BSD-2-Clause. Listed as a comparison under entry 7; it has its own query language, which is more expressive and slower to learn than qsv.
johnkerl/miller - queued. 10,000 stars, BSD-2-Clause. Listed as a comparison under entry 7; it has its own query language, which is more expressive and slower to learn than qsv.
guardrails-ai/guardrails - queued. 7,300 stars, Apache-2.0. Listed as a comparison under entry 6; broader than outlines, covering content checks as well as shape.
guardrails-ai/guardrails - queued. 7,300 stars, Apache-2.0. Listed as a comparison under entry 6; broader than outlines, covering content checks as well as shape.
cline/cline - queued. 67,600 stars, Apache-2.0. Listed as a comparison under entry 2; it lives inside an editor rather than giving a separate screen.
cline/cline - queued. 67,600 stars, Apache-2.0. Listed as a comparison under entry 2; it lives inside an editor rather than giving a separate screen.
anomalyco/opencode - queued. 196,600 stars, MIT, and the page figure is lower than the 209,494 recorded on 27 September. Listed as a comparison under entries 2 and 3.
anomalyco/opencode - queued. 196,600 stars, MIT, and the page figure is lower than the 209,494 recorded on 27 September. Listed as a comparison under entries 2 and 3.
Orange-OpenSource/hurl - queued. 19,200 stars, Apache-2.0, version 8.0.1. Listed as a comparison under entry 5; it runs requests written in a plain text file.
Orange-OpenSource/hurl - queued. 19,200 stars, Apache-2.0, version 8.0.1. Listed as a comparison under entry 5; it runs requests written in a plain text file.
py-pdf/pypdf - queued. 10,168 stars, BSD, code 21 August 2026. Listed as a comparison under entry 8; pure Python, easier to install and slower on large files.
py-pdf/pypdf - queued. 10,168 stars, BSD, code 21 August 2026. Listed as a comparison under entry 8; pure Python, easier to install and slower on large files.
pymupdf/PyMuPDF - queued. 10,797 stars, code 28 September 2026. Listed as a comparison under entry 8, and the licence is the difference: AGPL-3.0 with a paid commercial option.
pymupdf/PyMuPDF - queued. 10,797 stars, code 28 September 2026. Listed as a comparison under entry 8, and the licence is the difference: AGPL-3.0 with a paid commercial option.
GitGuardian/ggshield - queued. 2,000 stars, MIT, v1.52.2 of 17 June 2026. Listed as a comparison under entry 4; detection runs on the vendor's service, so it needs an account.
GitGuardian/ggshield - queued. 2,000 stars, MIT, v1.52.2 of 17 June 2026. Listed as a comparison under entry 4; detection runs on the vendor's service, so it needs an account.
nardew/talipp - queued. 536 stars, MIT, a hidden-gem candidate. Listed as a comparison under entry 12; it recomputes incrementally as each value arrives, which suits live data.
nardew/talipp - queued. 536 stars, MIT, a hidden-gem candidate. Listed as a comparison under entry 12; it recomputes incrementally as each value arrives, which suits live data.
jhspetersson/fselect - queued, unchanged from 25 September. 4,467 stars, code 5 September 2026. The-workshop already carried two entries.
jhspetersson/fselect - queued, unchanged from 25 September. 4,467 stars, code 5 September 2026. The-workshop already carried two entries.
ynqa/jnv - queued, unchanged from 25 September. 6,117 stars, code 24 September 2026. Overlaps jqp, published in Edition 33.
ynqa/jnv - queued, unchanged from 25 September. 6,117 stars, code 24 September 2026. Overlaps jqp, published in Edition 33.
Coming tomorrow