Edition No. 58 · 22 Oct 2026
A browser tool that says it is not a security boundary
A browser tool that warns it is not a security boundary, a media player whose code moved this morning but whose newest release is from December, and a database extension that admits what it cannot protect.
Refreshed on 22 October 2026. The repositories are the ones first published; any that are no longer maintained are left out.
Thursday, 22 October 2026. Twelve open-source repositories, opened and checked today. Four tools for working with language models, three for watching whether a service is up, two for working with code on your own machine, and three for documents, media and the database underneath.
We aim for twelve every day. Some candidates fall out while we check them — those are listed at the end, with the reason.
If you only do three things
- microsoft/playwright-mcp — two minutes, one command. It gives an AI coding assistant a real browser to click around in. Read the warnings first: the project says plainly that it is not a security barrier.
- banga/git-split-diffs — two minutes, two commands. After it, every set of changes you read in a terminal appears side by side and properly coloured, instead of as one long wall of red and green.
- bluewave-labs/Checkmate — twenty minutes with Docker. After that it checks whether a site answers, and tells you when it stops.
Every link in one place
| # | Repository | Project site | Stars | Licence |
|---|---|---|---|---|
| 1 | deepset-ai/haystack | haystack.deepset.ai | about 26,200 | Apache-2.0 |
| 2 | Giskard-AI/giskard-oss | docs.giskard.ai | about 5,900 | Apache-2.0 |
| 3 | Kilo-Org/kilocode | kilo.ai | about 27,600 | MIT |
| 4 | microsoft/playwright-mcp | npm package page | about 38,000 | Apache-2.0 |
| 5 | vectordotdev/vector | vector.dev | about 22,500 | MPL-2.0 |
| 6 | bluewave-labs/Checkmate | checkmate.so | about 11,000 | AGPL-3.0 |
| 7 | statping-ng/statping-ng | statping-ng.github.io | about 2,000 | GPL-3.0 |
| 8 | jj-vcs/jj | jj-vcs.dev | about 32,100 | Apache-2.0 |
| 9 | banga/git-split-diffs | none set on the repository | 2,744 | MIT |
| 10 | mozilla/pdf.js | mozilla.github.io/pdf.js | about 54,000 | Apache-2.0 |
| 11 | mpv-player/mpv | mpv.io | about 36,900 | GPL-2.0 or later |
| 12 | michelp/pgsodium | none set on the repository | 612 | PostgreSQL Licence |
A browser tool that says it is not a security boundary
Twelve repositories, checked and reviewed. Every version verified against the GitHub API and dated.
26.8k stars · Apache-2.0 · v3.4.1 (2026-10-21) · Track this in Scout · Share this tool
A Python framework for joining language models, document search and tools into one working pipeline.
▶Repo detailsthe review · specs · pros & cons · install
What it does
You describe a pipeline as a set of parts joined together, then run it. The parts cover retrieval, which means finding documents; routing, which means choosing which way to go next; memory, which means keeping earlier turns; and generation, which means writing the answer. A pipeline can run step by step or run several steps at once, and it can send the answer back a few words at a time as the model produces them. There is also an agent, which is a loop that lets the model call tools until the job is done. Agents count how many steps they took, how many words they spent and which tools they called, and they can run hooks at fixed points in that loop. Version 3.4.1 was released on 21 October 2026, it needs Python 3.11 or newer, and code was pushed again on the morning of 22 October 2026. It connects to many model providers, including OpenAI, Anthropic, Mistral, Cohere, Hugging Face, Google, Azure and Amazon Bedrock, and to models running on the same machine. Three things are deliberately elsewhere: putting a pipeline behind a web address is a separate project called Hayhooks, ready-made agents live in a separate repository called haystack-core-integrations, and support, templates and managed hosting are paid products from the company behind it.
Why it matters
Who it suits. Anyone who has to put a language model in front of a private pile of documents and wants the steps written down rather than hidden inside one library call. It suits a team that may change model provider later, because the provider is one part of the pipeline and not the whole program. It also suits anyone who has to show where an answer came from, since the retrieval step has its own readable output. Skip it if a single call to a model would do the whole job, because then a pipeline framework is work nobody gets back.
Verdict. Worth a day if answering questions over private documents is on the plan, and most of that day goes on learning the vocabulary rather than fighting the library. The project is plainly busy: version 3.4.1 arrived on 21 October 2026 and code landed again the next morning. Two things to settle before building on it. It sends anonymous usage statistics when pipeline parts start up, and the switch to turn that off is in the documentation rather than on the repository page. And the repository states no limits of any kind, so questions about how much it can handle only get answered by running it. The nearest neighbours are run-llama/llama_index, which is narrower, and langchain-ai/langchain, which is much larger.
- A pipeline is written down as named parts, so the route an answer took can be read.
- Apache-2.0, a plain permissive licence, with a release one day before this entry was checked.
- The model provider is one swappable part, so a price change is not a rewrite.
- Usage statistics are collected by default, and the opt-out is documented away from the repository.
- Serving a pipeline, and using ready-made agents, each need a separate project.
- Support, templates and managed hosting are sold by the company behind it, so part of what a team may want is not in the repository.
run-llama/llama_indexMIT, the same job with a narrower aim: retrieval over private documents first, with less machinery around agents.
Track this in Scout- langchain-ai/langchain
MIT, a much larger framework for the same idea, with far more integrations and examples, and correspondingly more to learn.
Track this in Scout
python3 -m venv venv source venv/bin/activate pip install haystack-ai # needs Python 3.11 or newer
5.9k stars · Apache-2.0 · giskard-agents/v1.0.5 (2026-10-20) · Track this in Scout · Share this tool
A Python library that writes tests for language-model programs and tries to break them on purpose.
▶Repo detailsthe review · specs · pros & cons · install
What it does
It is split into packages so you can take only the part you need. The checks package gives you a way to describe a scenario and then assert things about the answer: that it contains a string, that it matches a pattern, that it means roughly the same as an expected answer, that it is grounded in the documents it was given, and that it follows a stated rule. Some of those checks are done by another language model acting as a judge, and the grounded check is one of them, with a default judge model of gpt-4o-mini. The scan package does the breaking: it probes for prompt injection, which is text that tricks a model into ignoring its instructions, and for jailbreaks, which are attempts to get past its rules. It can also score the quality of a document collection the program reads from. The giskard-checks package reached version 1.0.5 on 2 October 2026 and needs Python 3.12 or newer. What it no longer does is the old version-2 work on ordinary machine-learning models over tables: that scan stays on version 2, which the project says is no longer actively maintained.
Why it matters
Who it suits. Anyone shipping a feature built on a language model who wants a test suite rather than a feeling. It suits the case where answers must stay inside a set of documents, because the grounded check is aimed exactly at that. It also suits anyone who has to answer a question about prompt injection before a launch, since the scan produces a list rather than an opinion. Skip it if the model is doing something small and internal where a wrong answer costs nothing, and skip it if your models are the older kind that read tables rather than text.
Verdict. Worth half a day, and the half day is mostly deciding what a correct answer actually is, which is the valuable part. Two practical notes. Python 3.12 is a hard floor and that is newer than many projects are on, so check before you plan. And the judge-based checks need a provider key and bill per check, so a large test suite has a running cost that an ordinary test suite does not. The honest limit is that a model judging a model is a useful signal and not a proof, so keep the cheap string and pattern checks as the backbone and use the judges for the parts that cannot be written down. For a test-runner feel there is confident-ai/deepeval; for red-teaming alone there is promptfoo/promptfoo.
- Apache-2.0, and split into small packages so you can install only the checks.
- The scan looks for prompt injection and jailbreaks, which are hard to test by hand.
- Telemetry can be switched off with one environment variable before the first import.
- Python 3.12 or newer is required, which rules out a lot of existing projects.
- The judge-based checks need a provider key and cost money every time they run.
- The older table-based scan is version-2 only, and version 2 is no longer actively maintained.
confident-ai/deepevalApache-2.0, the same idea shaped like a unit-test framework, so it fits a project that already runs tests on every change.
Track this in Scout
promptfoo/promptfooMIT, a command-line tool for comparing prompts and red-teaming; stronger on comparing two prompts side by side, weaker on assertions inside a test suite.
Track this in Scout
python3 -m venv venv source venv/bin/activate pip install giskard-checks # needs Python 3.12 or newer # add the breaking tests and one provider pip install "giskard[scan]" pip install "giskard[openai]" # turn telemetry off before anything is imported export DO_NOT_TRACK=1
27.7k stars · MIT · jetbrains/v7.1.12 (2026-10-22) · Track this in Scout · Share this tool
An open-source coding assistant for VS Code, JetBrains editors and the terminal, which can edit several files at once.
▶Repo detailsthe review · specs · pros & cons · install
What it does
You install it as an editor extension or as a command-line program, open a project, and describe the change you want. It works across multiple files rather than one at a time, suggests completions as you type, and reviews what it produced before handing it back. It has four modes, named Code, Plan, Ask and Debug, so you can ask it to think before it edits. It can run commands in a terminal and drive a browser when a task needs one. Model choice is the headline: the project says more than five hundred models are available, billed at the provider's own rate with nothing added, and that you can switch model part-way through a task. Prebuilt programs are published for Windows, macOS on both chip families, and Linux on both Intel and ARM, with a separate build for older processors and another for small container images. The command-line part is a fork of another project called OpenCode, which the project states openly. The one thing to be careful of is the switch named --auto, which approves the assistant's requests for permission without asking you, except where a rule says no.
Why it matters
Who it suits. Anyone who already works with an AI coding assistant and wants to choose the model instead of being given one. It suits a person who switches between editors, because the same assistant exists as a VS Code extension, a JetBrains plugin and a terminal program. It also suits anyone who wants the plan written out before any file is touched, which is what Plan mode is for. Skip it if you want one provider, one price and no decisions, because that is the opposite of what this offers.
Verdict. A good choice if the model menu is the thing you want, and it is clearly in heavy use: a release went out at 13:52 on the day this edition was written, and the repository carries more than thirty-three thousand commits. Three things to keep in mind. Do not use --auto anywhere you would mind a wrong command being run, and the project says this itself. The repository states no minimum version of anything, so install problems are discovered rather than predicted. And a fork carries a question that only time answers: the terminal part came from OpenCode, so it is worth watching whether the two keep in step. If you want the narrower, more settled version of this idea, cline/cline and Aider-AI/aider are both there.
- MIT, so it can be read, changed and used commercially with attribution kept.
- More than five hundred models at provider prices, switchable in the middle of a task.
- One assistant covering VS Code, JetBrains editors and a terminal, with prebuilt programs for six platforms.
- The
--autoswitch approves actions without asking, and the project warns about it in writing. - No minimum editor, runtime or operating-system version is stated anywhere on the page.
- The terminal part is a fork of another project, so its future depends partly on that one.
cline/clineApache-2.0, the same job as an editor extension, a command-line tool and a software kit; a smaller feature list and a longer track record.
Track this in Scout
Aider-AI/aiderApache-2.0, a terminal-only assistant that works through git commits, so every change it makes is a commit you can undo.
Track this in Scout
# the terminal program npm install -g kilo kilo # run it inside a project folder # or with Homebrew brew install kilo
38.5k stars · Apache-2.0 · v0.0.83 (2026-09-28) · Track this in Scout · Share this tool
A server that lets an AI assistant drive a real browser, using the page's own structure rather than screenshots.
▶Repo detailsthe review · specs · pros & cons · install
What it does
It speaks the Model Context Protocol, which is a common way for AI assistants to call outside tools, and the tools it offers are browser actions. It drives the browser through Playwright, Microsoft's browser automation library. Instead of sending pictures of the page, it sends the page's accessibility tree, which is the structured description browsers already build for screen readers. That means no vision model is needed by default, and far fewer words are spent per step. It needs Node.js 18 or newer and an assistant that speaks the protocol. Default timings are an action timeout of five seconds, a navigation timeout of sixty seconds and a settling pause of half a second. Now the limits, and the project states all of them itself. It says plainly that this is not a security boundary. A tool named browser_run_code_unsafe runs whatever code it is given inside the server process, which the project describes as equivalent to letting someone run programs on that machine. The --allowed-origins option is not a security boundary either and does not apply to redirects, and the feature for handling passwords is described as a convenience rather than a protection. A saved browser profile can only be used by one browser at a time, so two assistants in the same folder will collide unless each is given --isolated or its own profile folder. The container image runs headless Chromium only.
Why it matters
Who it suits. Anyone using an AI assistant for work that involves a web page: checking that a form still submits, reading a page that needs a login, filling in a slow administrative screen, or walking through a sign-up to see where it breaks. It suits testing especially well, because the assistant describes what it saw in words you can read back. It also suits anyone who has tried the screenshot-based approach and found it slow and expensive. Skip it if the pages you care about hold money, credentials or anything irreversible, because the project's own warning tells you that is the wrong place for it.
Verdict. This is the gold entry today and it is also the one with the clearest warning attached, which is exactly why it earns the slot. The install is one command and the payoff is immediate: an assistant that can see a page properly instead of guessing. Version 0.0.83 was published on 28 September 2026 and the version number is honest about how young this is. Two rules to follow. Never switch on browser_run_code_unsafe on a machine that holds anything you care about, and treat --allowed-origins as a convenience rather than a fence. Also worth knowing, because the project says it: for a coding assistant that mainly needs to run browser tests, the plain Playwright command-line tool may spend fewer words than this does. The library underneath is microsoft/playwright, and browserbase/stagehand is the nearest alternative.
- One command to install, with nothing to configure for a first run.
- It reads the page's own structure, so no image-reading model is needed and each step is cheap.
- Apache-2.0, and the project lists its own weaknesses in plain language rather than burying them.
- It is not a security boundary, and one of its tools is equivalent to letting someone run programs on the machine.
- A saved browser profile allows only one browser at a time, so parallel use needs extra flags.
- Version 0.0.83, with no stated promise that the tool names will stay as they are.
microsoft/playwrightApache-2.0, the browser automation library this is built on; the right choice when a person is writing the test rather than an assistant.
Track this in Scout
browserbase/stagehandMIT, a software kit for the same idea in the other direction: you write code that gives instructions in plain language and gets structured data back.
Track this in Scout
# any assistant that speaks the protocol npx @playwright/mcp@latest # needs Node.js 18 or newer # Claude Code claude mcp add playwright npx @playwright/mcp@latest # as a server on a port npx @playwright/mcp@latest --port 8931 # in a container, headless Chromium only docker run -i --rm --init --pull=always mcr.microsoft.com/playwright/mcp
22.8k stars · MPL-2.0 · v0.60.0 (2026-10-19) · Track this in Scout · Share this tool
One collector that gathers logs and numbers from machines and sends them to one or more monitoring services.
▶Repo detailsthe review · specs · pros & cons · install
What it does
You run it on each machine as a small agent, and optionally once more in the middle as a hub that everything reports to. It reads from files, programs and network sources, reshapes what it finds, and writes to one or more places at once. Being able to write to several places matters because it is how you test a new monitoring provider without turning off the old one. It is written in Rust, which the project says it chose for reliability, and it is maintained by Datadog's community open-source team. Version 0.60.0 was released on 19 October 2026. The project publishes its own benchmark table, and that table is worth a look for an unusual reason: on one of the tests, parsing text with patterns, it reports 13.2 MiB per second against a competitor's 20.5. Here is the boundary. Traces, which record one request's whole journey through several services, are listed as not supported yet. Metrics are marked as still in beta. And the claim of being up to ten times faster than every alternative is the project's own marketing line, not a figure verified here.
Why it matters
Who it suits. Anyone running more than two or three machines who has lost track of which collector is installed where. It suits a move between monitoring providers more than anything else, because sending to both at once turns a risky switch into a dull one. It also suits anyone paying per record, since filtering noise before it leaves the machine is the cheapest place to do it. Skip it if one machine writes one log file and a single hosted agent already handles it, and skip it if traces are the thing you actually need.
Verdict. The right tool for the job it claims, and the job is narrower than the front page suggests. Treat the headline speed claim as a direction rather than a number, especially since the project's own table shows it losing one of the five tests. Two practical notes. The repository gives no install commands and no stated requirements, so everything about setting it up lives on the documentation site. And traces being absent after more than fourteen thousand commits is a real signal about what this project is for: it is a logs and metrics pipeline, and if you need traces you want open-telemetry/opentelemetry-collector instead. The licence is also worth a glance. MPL-2.0 is a middle-ground licence: you may use it in a commercial product, but changes to the project's own files have to be published.
- One collector reads from many sources and writes to many destinations at once.
- Writing to two providers at the same time makes switching monitoring services safe.
- An active release line, with version 0.60.0 three days before this edition.
- Traces are not supported, and metrics are still described as beta.
- No install commands and no stated requirements on the repository page.
- The speed claim is the project's own, and its own benchmark table shows a competitor winning one test.
- fluent/fluent-bit
Apache-2.0, a smaller and older collector for logs, metrics and traces; it won the pattern-parsing test in the project's own benchmark table.
Track this in Scout - open-telemetry/opentelemetry-collector
Apache-2.0, the vendor-neutral standard collector, and the one to reach for when traces are part of the job.
Track this in Scout
# the project's install script curl --proto '=https' --tlsv1.2 -sSf https://sh.vector.dev | bash # or the container image docker pull timberio/vector:latest-debian
11k stars · AGPL-3.0 · v3.13.0 (2026-10-21) · Track this in Scout · Share this tool
A self-hosted monitor that checks whether sites and services answer, records response times and sends alerts.
▶Repo detailsthe review · specs · pros & cons · install
What it does
You add a thing to watch and choose how it should be checked. The check types cover plain web addresses, including a warning before a certificate expires; network ping; a specific port; name lookups; Docker containers; and three more for gRPC, WebSocket and game servers. There is a check that reads a value out of a structured reply, so you can watch a number rather than just whether the page loaded. On top of the checks it keeps incidents, publishes status pages, holds planned maintenance windows so a known outage does not page anyone, and sends notifications by email, webhook and several chat services. Hardware readings — processor load, memory, disk and temperature — come from a separate small program called Capture, which you install on each machine you want measured. Version 3.13.0 was released on 21 October 2026, the day before this edition. The project says it has been stress-tested with more than a thousand active checks, and shows one instance watching 323 servers every minute. Three things it does not do. It does not bring its own database: MongoDB is still required, and the supplied Docker setup starts one. Capture does not report container restart counts, published ports, mounts or container logs, and it reports a container that is still starting up as healthy. And unencrypted Docker daemons on port 2375 are not supported at all.
Why it matters
Who it suits. Anyone looking after a handful of sites who currently finds out about an outage from a person. It suits the case where several different things need watching at once, because one install covers web addresses, ports, name lookups and containers rather than needing a tool each. It also suits anyone who has to show customers a status page, since that is built in rather than bolted on. Skip it if a single hosted check on a free plan already covers the one site you have, because then you are running a database to solve a solved problem.
Verdict. One of today's three starting points, and the reason is the ratio: twenty minutes of Docker, after which something other than a person notices an outage. Released the day before this edition, so it is plainly maintained. Three things to get right. Set NODE_ENV to production, because the development setting switches off the request rate limiter. Keep the ENCRYPTION_KEY safe if you monitor Docker over TLS, since losing or rotating it wrongly makes those checks fail with decryption errors. And if you were planning to install this on Kubernetes, read carefully first: the project says its Helm chart has not moved to the current image and still deploys older images pinned at v3.8.1 that are no longer updated. The simpler and more widely used alternative is louislam/uptime-kuma; for a version configured from a file rather than a web page, TwiN/gatus.
- Eight kinds of check in one install, including certificate expiry and a value read from a structured reply.
- Status pages, incidents and maintenance windows are built in.
- Released the day before this edition, with more than ten thousand commits behind it.
- MongoDB is required and is not included in the image, so there is a database to look after.
- The Helm chart still deploys older images pinned at v3.8.1 which the project says are no longer updated.
- AGPL-3.0, which is a real constraint if you intend to offer a modified copy to other people as a service.
louislam/uptime-kumaMIT, the best known tool of this kind: fewer check types and no separate hardware agent, but a much simpler install and a far larger community.
Track this in Scout
TwiN/gatusApache-2.0, the same job defined entirely in a configuration file, which suits a setup kept in version control rather than clicked together.
Track this in Scout
curl -O https://raw.githubusercontent.com/bluewave-labs/checkmate/master/docker/docker-compose.yaml JWT_SECRET="$(openssl rand -hex 32)" docker compose up -d
2k stars · GPL-3.0 · v0.93.0 (2025-06-04) · Track this in Scout · Share this tool
A single-file status page and uptime checker that works with SQLite, PostgreSQL or MySQL.
▶Repo detailsthe review · specs · pros & cons · install
What it does
You give it a list of services and it checks each one on a schedule, then renders a public page with graphs and a history. It stores its data in SQLite, which is a database held in one file, or in PostgreSQL or MySQL where one of those is already running. It ships as one program per operating system, so there is no runtime to install alongside it, and as a container image of about twenty megabytes. It can obtain a certificate automatically, which needs a name-lookup record pointing at the machine first. The project describes itself as a drop-in replacement for the original Statping, meaning it is meant to work with the same data and configuration. Version 0.93.0 was released on 4 June 2026. Two warnings come from the project itself and both matter. It says the status page should not run on the same machine as the things it is watching, which is obvious once said and easy to get wrong. And the mobile application that exists for the original is not maintained by this project and carries in-app purchases that go to the original author.
Why it matters
Who it suits. Anyone who wants a public status page without running a stack of services to produce one. It suits a small setup best: one small machine, one file of data, one program, and a page visitors can read during an outage. It also suits anyone already using the original Statping, since this is built to take over from it. Skip it if you want the newest features and the busiest project, because this one's reason for existing is continuity rather than ambition.
Verdict. A good narrow choice, and the honest way to describe it is maintenance rather than momentum: version 0.93.0 in June 2026 is current enough to trust and slow enough to tell you what kind of project this is. That is not a criticism of a status page, which is the last thing you want changing under you. Two things to plan. Put it somewhere separate from everything it watches, for the reason above, and do not count on the mobile application, which belongs to someone else. If you want a status page generated without running anything at all, upptime/upptime does it with scheduled jobs and published pages instead of a server.
- One program, about seventeen megabytes, with a database in a single file if you want one.
- A public status page with graphs and history, which is the whole point rather than a side feature.
- Works with SQLite, PostgreSQL or MySQL, so it fits whatever is already running.
- The mobile application is not maintained by this project and charges for features.
- Development is steady rather than fast, with one release in June 2026 and none since.
- It must not run on the machine it is watching, which means a second machine somewhere.
- upptime/upptime
MIT, a status page with no server at all: it runs checks as scheduled jobs on a code-hosting service and publishes the result as a static page.
Track this in Scout - cachethq/cachet
A long-standing self-hosted status page focused on announcements and incident history rather than running the checks itself; its About sidebar links a licence file without naming the licence.
Track this in Scout
# the container image docker run -it -p 8080:8080 adamboutcher/statping-ng # or with a compose file and automatic certificates LETSENCRYPT_HOST=status.example.com LETSENCRYPT_EMAIL=you@example.com \ docker compose -f docker-compose-ssl.yml up -d
32.2k stars · Apache-2.0 · v0.46.0 (2026-10-07) · Track this in Scout · Share this tool
A version control system that stores its history in Git repositories but handles changes and conflicts differently.
▶Repo detailsthe review · specs · pros & cons · install
What it does
It records the files you are working on right now as a saved change, and updates that change as you edit. There is therefore no separate step for staging and no separate idea of uncommitted work. Every operation on the repository is written down, so any command can be undone, including ones that would be hard to recover from in Git. When you edit a change that others are built on top of, it rebuilds those automatically instead of asking you to do it. Conflicts are recorded inside a change rather than stopping the operation, so you can finish what you were doing and fix them afterwards. The default storage is a Git repository, which is why existing hosting and tooling keep working. It has been in development since December 2020 and has close to twelve thousand commits. Now the boundary, and the project is clear about it. Support for nested repositories is not finished. There is no built-in support for sending changes by email. Only commits and files live in Git, so branch names and other bookkeeping are stored separately. Only the Git storage is considered ready for real use, several speed problems are known, and the features for working with others are experimental and may change. The project also notes that despite Google being a major contributor, it is not a supported Google product.
Why it matters
Who it suits. Anyone who uses Git every day and keeps hitting the same three walls: a rebase that goes wrong with no way back, a conflict that arrives at the worst moment, and a stash they forgot about. It suits people who work in long chains of small changes, because rebuilding what sits on top of an edit is automatic here. It also suits a cautious experiment, because the data stays in a Git repository and the usual tools keep reading it. Skip it if you share a working copy with people who will not install it, and skip it if your work depends on nested repositories or on sending changes by email.
Verdict. The most interesting thing on this list, and also the one asking for the most patience. Code was pushed on 31 August 2026, so it is active, but the project describes itself as experimental and says the way it works will change before version 1.0, which is a promise about future disruption rather than a warning about present bugs. Try it on an existing repository and keep using Git alongside it: because the storage is a Git repository, that costs nothing and teaches you quickly whether the model fits how you think. Two notes. Read the undo command first, because it is the feature that makes experimenting safe. And do not plan a team move on it yet, since the parts about working with others are the parts still marked experimental. For a gentler improvement on Git that changes nothing underneath, jesseduffield/lazygit is the obvious stop.
- The data lives in a Git repository, so existing hosting, tools and colleagues keep working.
- Every operation is recorded, so almost anything can be undone with one command.
- Conflicts are stored inside a change instead of stopping the work.
- The project calls itself experimental and expects the way it works to change before version 1.0.
- Nested repositories are unfinished and email-based workflows are not supported.
- Several speed problems are known, and the features for working with others are experimental.
- jesseduffield/lazygit
MIT, a terminal interface over ordinary Git: it makes staging, rebasing and committing easier without changing the model underneath.
Track this in Scout 
gitbutlerapp/gitbutlerA desktop and command-line client built around working on several branches at once; its licence is a Fair Source one that becomes MIT after two years, so read the terms before building on it.
Track this in Scout
# macOS, with Homebrew brew install jj # from source, with Rust installed cargo install --locked --bin jj jj-cli # then, inside an existing Git repository jj git init --colocate jj log jj undo # the command to learn first
2.7k stars · MIT · v2.3.0 (2025-10-23) · Track this in Scout · Share this tool
Side-by-side, syntax-highlighted file differences in a terminal.
▶Repo detailsthe review · specs · pros & cons · install
What it does
It takes the output of a comparison and redraws it as two columns. The code is coloured using the same grammars and themes that a widely used editor uses, so the colours are the ones you already read. Inside a changed line it marks the part that actually changed, which means a one-character edit does not look like a whole rewritten line. Lines wrap to fit the window by default, and can be truncated instead. Several themes are supplied, and more can be loaded from a folder. Everything is set through the ordinary configuration system of the version control tool, with names such as split-diffs.wrap-lines and split-diffs.syntax-highlighting-theme, so there is no separate settings file to learn. It needs Node.js 18 or newer, which is the runtime most web tooling already uses. Two boundaries, both documented. On a narrow window it gives up on two columns and falls back to the single-column view, below 160 characters by default. And it expects to be read through a pager, which is the small program that lets you scroll long output, so the documented setup pipes it into one.
Why it matters
Who it suits. Anyone who reads changes in a terminal rather than in a browser. It suits reviewing somebody else's work most of all, because two columns make a moved block obvious where one column makes it look like a deletion followed by an unrelated addition. It also suits anyone who keeps opening a web page just to read a change properly, since this removes that trip. Skip it if you already review everything in an editor or a browser, where this view exists already.
Verdict. One of today's three starting points, for the plainest reason on the list: two commands, and every comparison from then on is easier to read. A genuine find at 2,744 stars. Two notes, and the second is the more interesting. On a narrow window it falls back to the old view without saying so, so if nothing appears to have changed, widen the window before looking for a fault. And the dates need reading carefully. The newest release, version 2.3.0, is dated 23 October with no year, and because 23 October has not yet happened in 2026 that places it in 2025 — about a year ago. Code, meanwhile, was pushed on 11 October 2026. A year-old release on a tool this small and this finished is normal, and the code date is the one that says it is alive. Wilfred/difftastic and dandavison/delta are the two neighbours worth knowing about.
- Two commands, and every comparison from then on is side by side with nothing else to change.
- MIT, and the colouring uses the same grammars and themes as a widely used editor.
- It marks the changed part inside a line, so a one-character edit does not look like a rewrite.
- Below a 160-character window it falls back to the single-column view without saying so.
- The newest release is about a year old, although code was pushed eleven days before this edition.
- It needs Node.js 18 or newer, which is one more runtime to keep installed.
Wilfred/difftasticMIT, a comparison tool that reads the structure of the code rather than the lines, so moving a block or reindenting a file produces a much smaller result.
Track this in Scout
dandavison/deltaMIT, a colouring pager for comparisons, searches and blame output, with side-by-side as one of its modes; a wider tool covering more kinds of output.
Track this in Scout
npm install -g git-split-diffs # needs Node.js 18 or newer # make it the default way comparisons are shown git config --global core.pager "git-split-diffs --color | less -RFX" # or use it once, changing nothing permanently git diff | git-split-diffs --color | less -RFX
54k stars · Apache-2.0 · v6.4.299 (2026-10-03) · Track this in Scout · Share this tool
A PDF reader written in JavaScript that renders documents inside a web page with no plugin.
▶Repo detailsthe review · specs · pros & cons · install
What it does
It reads a PDF file and draws it in the browser. It comes in two parts: a library that parses and renders, and a complete viewer built on top with page navigation, zoom, text selection, search and printing. The stated aim is a general-purpose platform for parsing and rendering PDFs built on web standards, rather than a single application. Firefox has shipped it as the built-in PDF viewer since version 19. It is published for other projects as the pdfjs-dist package, currently version 6.4.299, released on 3 October 2026, which asks for Node.js 22.13 or newer to build. Two builds are produced: a modern one that assumes a current browser, and a legacy one for older browsers. The repository has more than twenty-four thousand commits. Three things worth knowing before you use it. The project warns that its files are large and should be compressed before going on a live site. Some browsers refuse to open a PDF loaded from a plain file path, so a small local web server is needed while developing. And the official Chrome extension is maintained by a volunteer rather than by Mozilla, which the README states.
Why it matters
Who it suits. Anyone putting documents on a web page who wants them read rather than downloaded. It suits an invoice, a report, a contract or a manual, because the reader stays on the page and the document can be searched. It also suits a project that needs to draw one page of a PDF as an image, since the rendering part can be used on its own. Skip it if you only need to change PDFs rather than show them, which is a different job and a different tool.
Verdict. As safe a dependency as exists in this area: Apache-2.0, released three weeks before this edition, and shipped inside a browser used by tens of millions of people, which is a kind of testing no test suite provides. Two practical notes. Compress the files before they go live, because the project says so itself and the difference is large. And start from the finished viewer rather than the library if what you want is a reader, since rebuilding page navigation, search and printing is a week you do not need to spend. If the job is pulling text or data out of PDFs rather than showing them, pymupdf/PyMuPDF is the tool; if it is splitting, merging and signing them, Stirling-Tools/Stirling-PDF is.
- Apache-2.0, and the same code Firefox uses, so it is tested by an enormous number of readers.
- A finished viewer with search, zoom and printing, not just a rendering library.
- A legacy build exists for older browsers, so support is a choice rather than a cliff.
- The files are large and must be compressed before going on a live site.
- Building from source needs Node.js 22.13 or newer, which is a recent version.
- The Chrome extension is maintained by a volunteer, not by Mozilla.
pymupdf/PyMuPDFAGPL-3.0, a Python library for pulling text and data out of PDFs and converting them; the right answer when nobody is going to look at the page.
Track this in Scout
Stirling-Tools/Stirling-PDFA self-hosted web application for splitting, merging, signing and converting PDFs; its README describes the project as open-core, so check which features that covers.
Track this in Scout
# use it in a project npm install pdfjs-dist # or build the viewer from source git clone https://github.com/mozilla/pdf.js.git cd pdf.js npm install npx gulp generic # the viewer, for current browsers npx gulp generic-legacy # the viewer, for older browsers npx gulp server # http://localhost:8888/web/viewer.html
37.5k stars · GPL-2.0 or later · v0.41.0 (2025-12-21) · Track this in Scout · Share this tool
A command-line media player that handles most audio, video and subtitle formats and can be scripted.
▶Repo detailsthe review · specs · pros & cons · install
What it does
You give it a file, a folder or a web address and it plays it. It covers a very wide range of formats, because it is built on the FFmpeg libraries, which are the collection of decoders most media software uses. Subtitles are handled by a dedicated library and are unusually good. Everything it does can be driven from the command line, from a configuration file, or from a script written in Lua, and there is a client interface so other programs can control it. Playback settings can be grouped into named profiles and switched with one option. Releases are deliberately infrequent: the project says it cuts one of the form 0.X.0 once or twice a year, and version 0.41.0 came out on 21 December 2025. Code, meanwhile, was pushed on the morning this edition was written, and the repository holds more than fifty-five thousand commits. That gap between the release and the code is the thing to understand about this project rather than a warning about it. Now the limits, all stated by the project. It is not built for low-power playback on small or built-in graphics chips, and hardware decoding is off unless you ask for it with --hwdec. Only the newest releases of a Linux distribution are supported, along with Windows 10 build 1607 or newer and macOS 10.15 or newer. Older fallback display methods are neither recommended nor supported. Only the latest release gets fixes, apart from security ones. And there is no complete list of changes between versions.
Why it matters
Who it suits. Anyone who plays media as part of a job rather than for an evening: checking a recording, stepping through a video frame by frame, comparing two cuts, reading subtitles that other players mangle, or playing a file from a script. It suits scripting especially, because every setting is an option and every option can go in a file. It also suits anyone frustrated by a player that re-encodes, buffers or refuses a format. Skip it if you want a library of films with cover pictures and a remote control, which is a different kind of program entirely.
Verdict. The reference player for people who would rather type than click, and it has earned that over fourteen years. The one thing worth saying plainly is about dates. The newest release is from December 2025 and the newest code is from this morning, which is exactly the trap that makes healthy projects look dead: a release date is not a code date, and here the two are ten months apart by design. Two practical notes. Turn on hardware decoding yourself with --hwdec if the machine needs it, because the default is off. And on a weak graphics chip try --profile=fast before concluding the player is at fault, which is the project's own advice. If you want a window with buttons, iina/iina is this player wrapped in a macOS application, and videolan/vlc is the familiar alternative.
- Plays almost anything, with subtitle handling that is better than most players manage.
- Every behaviour is an option, so it can be scripted and configured precisely.
- Code pushed the morning of this edition, after more than fifty-five thousand commits.
- Hardware decoding is off by default, so a weak machine will struggle until you switch it on.
- Only the newest releases of a Linux distribution are supported, plus Windows 10 1607 or newer and macOS 10.15 or newer.
- Only the latest release receives fixes, and there is no complete list of changes between versions.
- videolan/vlc
GPL-2.0 and LGPL-2.1, the best-known free player, with a full interface and a much gentler start; less suited to being driven from a script.
Track this in Scout - iina/iina
This same player wrapped in a native macOS application with a proper window and controls; its About sidebar links a licence file without naming the licence.
Track this in Scout
# Debian or Ubuntu sudo apt-get install mpv # macOS, with Homebrew brew install mpv # from source, which needs meson and the FFmpeg libraries meson setup build meson compile -C build meson install -C build
614 stars · PostgreSQL Licence · v3.1.11 (2026-06-10) · Track this in Scout · Share this tool
A PostgreSQL extension that brings libsodium's encryption functions into SQL, with a root key the database cannot read back.
▶Repo detailsthe review · specs · pros & cons · install
What it does
It makes the functions of libsodium, a well-regarded encryption library, callable from SQL, which is the language used to query a database. That covers hashing, public-key encryption, digital signatures, deriving keys from other keys, and password hashing. Its key management is the part worth the attention: a root key is loaded into the server at startup and is not readable from SQL, and every other key is derived from it by number, so the database stores key numbers rather than keys. On top of that sits a feature called transparent column encryption, which uses database triggers and views so a column is encrypted on the way in and decrypted on the way out without the application knowing. There is also a section for encrypting network addresses in a way that keeps their structure. Version 3.0.0 needs PostgreSQL 14 or newer, earlier database versions need the 2.0 line, and some of the column-encryption features rely on a PostgreSQL 15 feature. Code was pushed on 10 June 2026. Now the limits, and this project is remarkably honest about them. The managed keys are optional, and without them you have to handle keys yourself. The project says storing secrets in a database is generally a bad idea even though it can be done carefully. It states that a sufficiently capable attacker with full database powers might still reach the root key through other programs, memory dumps or swap files, and that this is outside what the extension can prevent. One of its encryption modes reveals when two stored values are identical. One of its hash functions produces only 64 bits and is not safe against deliberate collisions. And values passed through the standard database client's variables can end up in the database logs.
Why it matters
Who it suits. Anyone who has to encrypt specific fields inside PostgreSQL — a token, a document reference, a national identifier — and wants the key kept out of the database that holds the data. It suits a situation where an auditor is asking where the keys live, because the answer here is concrete. It also suits anyone who cannot change the application, since transparent column encryption works through views and triggers rather than through code changes. Skip it if what you need is encryption of the whole disk or the whole database, which is a different and simpler problem, and skip it if there is nobody on hand who can reason about key rotation.
Verdict. A genuine find at 612 stars, and the reason to read it is the documentation as much as the code: a security project that spends paragraphs on what it cannot protect against has earned the claims it does make. The superuser point is the one to act on, exactly as with the audit extension covered in Edition 57: if one account can reach the running server's memory, no extension inside that server can stop it, so that access is the thing to restrict. Two practical notes. Code was pushed on 10 June 2026, four months before this edition, and the repository publishes no releases, so the version numbers come from the documentation rather than from a tag. And test it on a copy first, because an encryption mistake is discovered later than other mistakes and costs more. For storing a handful of secrets rather than encrypting columns, supabase/vault is the smaller answer; for a layer in front of the database rather than inside it, cossacklabs/acra was covered in Edition 55.
- The root key is loaded at startup and cannot be read back through SQL, so the database stores key numbers rather than keys.
- Transparent column encryption works through views and triggers, so the application does not have to change.
- It documents its own weaknesses in detail, including the ones that are awkward to admit.
- It publishes no releases, so versions have to be read from the documentation rather than a tag.
- Several modes carry sharp edges: one reveals duplicate values, and one hash is only 64 bits.
- Building it needs libsodium 1.0.18 or newer and the PostgreSQL development headers, which is a real install.
- supabase/vault
A PostgreSQL extension for storing encrypted secrets and reading them back through a view; a much smaller job than encrypting columns, and its About sidebar links a licence file without naming the licence.
Track this in Scout 
cossacklabs/acraApache-2.0, a suite that sits in front of the database instead of inside it: it encrypts fields, blocks risky queries and watches for intrusion. Edition 55 covered it.
Track this in Scout
# build it, with libsodium 1.0.18+ and the PostgreSQL headers present git clone https://github.com/michelp/pgsodium.git cd pgsodium sudo make install # or from the PostgreSQL extension network pgxn install pgsodium
Checked, and left out
Nothing to show for this edition. Recording the repositories that were checked and rejected began with Edition No. 4, and every edition from there on has the list.
Know a repository we should check?
Coming tomorrow