Edition No. 61 · 25 Oct 2026
The bundler that is 106 times faster has stopped adding features
A bundler whose author has paused new features on purpose, an identity provider whose MIT badge covers only part of its own tree, and an encryption library that refuses to let you choose anything.
Sunday, 25 October 2026. Twelve open-source repositories, opened and checked today. One of them is a build tool that measures itself at 106 times the speed of the usual alternative, and whose author has written down that new feature work is paused on purpose. That is not a warning sign. It is the clearest statement of scope in this edition, and three other entries today would be easier to judge if they did the same.
We aim for twelve every day. Some candidates fall out while we check them — those are listed at the end, with the reason.
If you only do three things
- evanw/esbuild — two minutes. It turns many JavaScript or TypeScript files into one file a browser can load, and it does it in well under a second where the common alternatives take half a minute. One install command, one build command.
- iconoir-icons/iconoir — two minutes. 1,671 hand-drawn icons under a permissive licence, in nine different packagings, so the same set works in a web page, a React app or a Flutter app.
- Textualize/textual — twenty minutes. It lets a Python program draw a real interface inside a terminal window, with 35 ready-made parts, and the same program can be served to a browser with one command. ---
Every link in one place
| # | Repository | Project site | Stars | Licence |
|---|---|---|---|---|
| 1 | traefik/traefik | doc.traefik.io/traefik | 65,300 | MIT |
| 2 | rajnandan1/kener | kener.ing | 5,092 | MIT |
| 3 | goauthentik/authentik | goauthentik.io | 24,700 | MIT, with a paid directory |
| 4 | cossacklabs/themis | cossacklabs.com/themis | 1,979 💎 | Apache-2.0 |
| 5 | evanw/esbuild | esbuild.github.io | 40,107 | MIT |
| 6 | Textualize/textual | textual.textualize.io | 37,519 | MIT |
| 7 | python-attrs/cattrs | catt.rs | 1,059 💎 | MIT |
| 8 | spotify/pedalboard | spotify.github.io/pedalboard | 6,252 | GPL-3.0 |
| 9 | iver56/audiomentations | iver56.github.io/audiomentations | 2,324 💎 | MIT |
| 10 | antonmedv/walk | none in the sidebar | 3,648 | MIT |
| 11 | iconoir-icons/iconoir | iconoir.com | 4,600 | MIT |
| 12 | Kong/insomnia | insomnia.rest | 40,076 | Apache-2.0 |
The bundler that is 106 times faster has stopped adding features
Twelve repositories, checked and reviewed. Every version verified against the GitHub API and dated.
65.3k stars · MIT (named in the About sidebar) · v3.7.16 (2026-10-20), shown on /releases/latest as '20 Oct' with no year and settled from the Go module index, which also shows v3.7.15 of 15 October 2026, v3.7.14 of 5 October 2026 and v3.7.13 of 4 September 2026 · Track this in Scout · Share this tool
Decides which program answers each incoming request, and works out the rules by watching where the programs are.
▶Repo detailsthe review · specs · pros & cons · install
What it does
It reads your running systems rather than a static list, and the documentation covers sixteen places it can read from, including Docker, Kubernetes, Nomad, Consul, Redis, etcd and a plain file. From what it finds, it builds routes and sends each request to the right place. It requests and renews certificates from Let's Encrypt, so HTTPS works without anybody buying anything. It balances load across several copies of a program, retries failed requests, and stops sending traffic to something that keeps failing. It handles HTTP/1, HTTP/2, HTTP/3, WebSocket and gRPC, and it reconfigures while running, with no restart. There are 34 small add-ons for things like compression, rewriting and rate limiting, and ten of those 34 are only available in the company's paid product. It is not a web server and not a cache: it does not serve files from disk, and anything it cannot match is answered with 404 rather than held.
Why it matters
Who it suits. Anyone running several containers on one or more machines and tired of editing a proxy configuration by hand every time something moves. It suits a small team on Kubernetes especially well, because the rules come from the cluster itself. Skip it if there is exactly one program on one machine and the address never changes, because a plain web server will be simpler and will also serve files.
Verdict. Worth an afternoon above a certain size, and the live reconfiguration is the part that earns it. Two things to know before starting. The configuration has two halves — a file that is read once at start-up, and the rules discovered while running — and the project's own notes admit that the first half tells you nothing about how traffic will actually be routed. When a route is wrong, what you see is a bare 404, which is a thin clue. The second thing is where the free version stops: the add-ons for JSON web tokens, OpenID Connect, LDAP, web application firewalling and distributed rate limiting are in the paid product, which is exactly where a growing setup tends to need help. Version 3.7.16 was published on 20 October 2026, with three more releases in the preceding seven weeks, so the project is plainly active. The honest alternative is caddyserver/caddy, covered in Edition 48: it is a full web server with automatic HTTPS and a much gentler configuration file, and it is the better choice when the set of programs rarely changes.
- Builds its own rules from sixteen kinds of running system, so moving a program moves its route.
- Free HTTPS certificates, requested and renewed without anybody doing anything.
- Reconfigures while running, so a new route costs no downtime.
- Two-layer configuration that confuses almost everybody at first, and a wrong route shows up only as a 404.
- Ten of the 34 add-ons are paid-only, including the authentication and firewall ones.
- Certificates named by file path are not reloaded when the file changes, so a renewal needs a nudge.
caddyserver/caddyApache-2.0, 78.1k stars, covered in Edition 48; also a reverse proxy with automatic HTTPS, but a general web server first, configured by a short file rather than by watching containers.
Track this in Scout- envoyproxy/envoy
Apache-2.0, 28.9k stars; the same routing and load-balancing job at a lower level, configured by a separate control program rather than configuring itself, which is more capable and much more work.
Track this in Scout - kubernetes/ingress-nginx
Apache-2.0, 19.4k stars; did the same job inside Kubernetes only. Its maintainers archived it on 24 March 2026, so it is read-only and gets no further fixes.
Track this in Scout
docker run -d \ -p 8080:8080 -p 80:80 \ -v "$(pwd)/traefik.toml:/etc/traefik/traefik.toml" \ traefik
5092 stars · MIT (named in the About sidebar) · 4.1.9, shown on /releases/latest as '24 Oct' with no year and NOT settled - it is a deployed application with no package registry entry (registry.npmjs.org/kener refused), so the year is unsettled · Track this in Scout · Share this tool
A status page you run yourself, which checks your services and shows their recent history.
▶Repo detailsthe review · specs · pros & cons · install
What it does
It checks eight kinds of thing: a web address, a ping, a plain network port, a DNS record, a certificate's expiry, a database query, a heartbeat that something else must send, and a game server. It stores each result and draws a history of good and bad days per service. It publishes one or more branded pages, in light and dark, with small badges and widgets other pages can embed. Incidents and planned maintenance windows can be written up and attached to a service, so the page explains itself. It sends notifications by email, webhook, Slack and Discord when something changes. It serves on port 3000, needs Node.js version 24.14 or newer, and keeps a Redis cache beside it. It is not a monitoring system: its own README says it is not there to replace the large observability products, so there are no traces, no metric queries and no alert routing rules.
Why it matters
Who it suits. Anyone running a service with real users who currently answer "is it down?" by hand. It suits a small team that wants a page on a separate address, with its own branding, rather than a row in somebody else's dashboard. Skip it if there is already a monitoring product in place with status pages built in, and skip it if the eight check types do not cover the thing that actually breaks.
Verdict. Worth twenty minutes, with one honest caveat about the shape of the install. The smallest real deployment is three moving parts — the application, its database and Redis — and the instructions for running it without containers still tell you to start Redis in one, so containers are the path of least resistance either way. Node.js 24.14 is recent enough that a version packaged by an operating system will usually be too old. The dates here are worth stating plainly rather than smoothing over: the newest release is 4.1.9, shown on GitHub as "24 Oct" with no year, there is no package registry for this project to settle it, and the code-date mirror answered with 3 August 2026 — which is older than that release, so the mirror's snapshot is behind. Either way the project is far inside the eighteen months we require. The big alternative is louislam/uptime-kuma, covered in Edition 7: it has 90.1k stars, does far more checking, and treats status pages as a feature rather than the point. Pick this one if the public page matters more than the monitoring.
- Eight check types, including a heartbeat for jobs that are supposed to report in.
- Several separate pages from one install, each with its own branding and language.
- Badges and embeddable widgets, so another page can show the same state.
- Three moving parts at a minimum, because Redis is required and not optional.
- Needs Node.js 24.14 or newer, which usually means installing Node by hand.
- Effectively one maintainer, and the recorded activity dates disagree with each other.
louislam/uptime-kumaMIT, 90.1k stars, covered in Edition 7; the same checking job at much greater depth, with status pages as one feature among many, and a far larger community.
Track this in Scout- cstate/cstate
MIT, 2.9k stars; a public status page built as a static site, which does no checking at all - every incident is written by hand, which makes it very cheap to host and useless for automatic detection.
Track this in Scout 
statping-ng/statping-ngGPL-3.0, 2.0k stars, covered in Edition 58; a status page with its own checking server and graphs, carried on by the community after the original project stopped.
Track this in Scout
mkdir -p database docker run -d --name kener \ -p 3000:3000 \ -v "$(pwd)/database:/app/database" \ -e "KENER_SECRET_KEY=replace_with_a_long_random_string" \ -e "ORIGIN=http://localhost:3000" \ -e "REDIS_URL=redis://host.docker.internal:6379" \ docker.io/rajnandan1/kener:latest
24.7k stars · MIT for most of the tree, with three exceptions read from the LICENSE file on 2026-10-25: Creative Commons BY-SA 4.0 for website/, MIT Expat for client-side JavaScript, and a separate commercial authentik Enterprise Edition licence on authentik/enterprise/ which forbids production use without a seat-counted subscription. The About sidebar names no licence at all. · version/2026.8.5, shown on /releases/latest as '21 Oct' with no year; the published @goauthentik/api client agrees on 2026.8.5, confirming the version but not the day · Track this in Scout · Share this tool
One place for people to sign in, which every other tool can ask instead of keeping its own passwords.
▶Repo detailsthe review · specs · pros & cons · install
What it does
It sits in front of applications and answers the question "who is this person, and may they in?". It speaks the four common languages for that: SAML, OAuth 2.0 with OpenID Connect, LDAP and RADIUS, so both modern web applications and older software can use it. Sign-in journeys are built as flows, so extra steps such as a second factor or a consent screen can be added without code. Small companion processes, which the project calls outposts, let it protect applications that cannot be changed at all. It ships an administration interface on port 9000 and needs at least two processor cores and 2 GB of memory. It is not a directory of its own making for everything: it federates with what already exists, and the parts in its authentik/enterprise/ folder may not be used in production without a paid subscription counted per person.
Why it matters
Who it suits. Anyone running three or more separate tools who has started dreading the day somebody leaves. The flow builder is the reason people choose it over the older alternatives: a second factor or an approval step is a drag-and-drop change rather than a code change. Skip it unless single sign-on is genuinely needed, because this becomes the single thing that can lock everyone out of everything.
Verdict. Good software with a licence that needs reading first, and that is the finding of the day on this entry. The About panel on GitHub names no licence at all. The file behind it is not one licence but four: MIT for most of the code, Creative Commons BY-SA 4.0 for the website/ folder, MIT Expat for the browser code, and a separate commercial licence for authentik/enterprise/ whose terms forbid production use without a paid, seat-counted subscription. Anyone who reads "MIT" from a badge and ships the whole tree is wrong about part of it. Two more things that are easy to hit. A PostgreSQL password longer than 99 characters is not supported, and mounting the machine's timezone files into the containers quietly breaks both OAuth and SAML, because the internals work in UTC. The newest release is tagged 2026.8.5, and the matching published client library agrees on that version, so it is current. If a plain, fully permissive licence matters more than the flow builder, keycloak/keycloak is Apache-2.0 throughout.
- Four protocols in one place, so old and new software can both use it.
- Sign-in journeys are built by dragging steps, not by writing code.
- Companion processes can protect applications that cannot be modified at all.
- The licence is four licences, one of which forbids production use without paying.
- Four moving parts and a documented floor of two cores and 2 GB of memory.
- Undocumented traps: a long database password fails, and a mounted timezone file breaks sign-in.
keycloak/keycloakApache-2.0, 36.0k stars; the same single sign-on job with no paid-only directories anywhere in the tree, at the cost of being heavier and much less pleasant to configure.
Track this in Scout
zitadel/zitadelAGPL-3.0, 14.9k stars; the same job with passkeys and multi-tenancy built in from the start, under a stronger copyleft licence that matters if it is embedded in a product.
Track this in Scout
logto-io/logtoMPL-2.0, 14.5k stars; sign-in for applications being built now, with a friendlier developer experience and no LDAP or RADIUS support at all.
Track this in Scout
wget https://docs.goauthentik.io/compose.yml echo "PG_PASS=$(openssl rand -base64 36 | tr -d '\n')" >> .env echo "AUTHENTIK_SECRET_KEY=$(openssl rand -base64 60 | tr -d '\n')" >> .env docker compose pull docker compose up -d
1979 stars · Apache-2.0 (named in the About sidebar, with no added conditions) · 0.15.7 (2026-04-24), shown on /releases/latest as '24 Apr' with no year and settled by ungh's pushedAt of 2026-04-24T14:01:56Z matching the release timestamp to the minute · Track this in Scout · Share this tool
Four ready-made encryption jobs with the cipher, key length, curve and hash already chosen, in fifteen languages.
▶Repo detailsthe review · specs · pros & cons · install
What it does
It offers four cryptosystems rather than ciphers. Secure Cell encrypts something you are storing, using AES-256. Secure Message encrypts and signs something you are sending to a known recipient. Secure Session sets up a private two-way conversation with keys that change, so a stolen key cannot decrypt old traffic. Secure Comparator checks whether two parties hold the same secret without either revealing it. Underneath it uses OpenSSL, LibreSSL or BoringSSL, and above it there are wrappers for fifteen languages including Python, Go, Rust, Java, Kotlin, Swift, Ruby, PHP, Node and WebAssembly. The project claims this covers about 90% of ordinary data-protection needs. What it deliberately does not offer is any way to choose: there is no raw interface, and the cipher, the key length, the elliptic curve and the hash cannot be changed without building a custom version from source. It also has no post-quantum option and is not meant for very small hardware.
Why it matters
Who it suits. Anyone who has to encrypt something and does not want to become a cryptographer first. It fits a team writing the same feature in two languages, because the code reads almost the same in both. Skip it if a specific cipher or curve is required by a standard or a customer, because that is exactly what this library refuses to expose.
Verdict. Worth an hour, and the refusal to give you knobs is the feature rather than a limitation. The licence is plain Apache-2.0 with nothing bolted on, which is unusually clean for software in this field, and the code was last pushed on 24 April 2026 — six months ago, which is comfortable for a library whose whole point is not changing. Two practical warnings. The install is two steps, not one: a native library has to be added from the company's own package repository before the Python, Go or Node wrapper will work, which means adding a third-party signing key to the machine. And the documented platform list has fallen behind — it stops at macOS 11, iOS 15 and Android 12, and newer versions are simply outside what the documentation claims. For a library that does similar work with far more users and no vendor repository to add, jedisct1/libsodium is the usual answer, though it has no equivalent of the session or secret-comparison jobs.
- Four jobs with the choices already made, which removes the most common way to get this wrong.
- Fifteen languages with almost the same code, so two services can agree by construction.
- Plain Apache-2.0, with no added conditions and no paid tier held back.
- Nothing is adjustable: a required cipher or curve means building from source.
- Two-step install, including adding a third-party package repository to the machine.
- The documented platform list stops at older operating systems than most people now run.
- jedisct1/libsodium
ISC, 14.0k stars; the same idea of safe defaults instead of raw parts, as a C library with community bindings rather than one vendor's matched set, and with no session or secret-comparison equivalent.
Track this in Scout - tink-crypto/tink
Apache-2.0, 13.5k stars; a library built around the same principle of being hard to misuse. This repository was archived by its owners on 17 April 2024 and is read-only; the work continues in separate per-language repositories.
Track this in Scout
wget -qO - https://pkgs-ce.cossacklabs.com/gpg | sudo apt-key add - sudo apt install apt-transport-https echo "deb https://pkgs-ce.cossacklabs.com/stable/debian bookworm main" | sudo tee /etc/apt/sources.list.d/cossacklabs.list sudo apt update sudo apt install libthemis-dev
40107 stars · MIT (named in the About sidebar) · v0.28.2 (2026-08-08), shown on /releases/latest as '08 Aug' with no year and settled from the npm registry's own publish timestamp, corroborated by a code date of 2026-08-09 · Track this in Scout · Share this tool
Joins many JavaScript, TypeScript and CSS files into one, in well under a second.
▶Repo detailsthe review · specs · pros & cons · install
What it does
You point it at the file your application starts from. It reads JavaScript, TypeScript, JSX and CSS directly, follows every import, and writes out one bundled file, with unused code removed, the text shortened, and a map that lets a browser show the original source when something breaks. It also includes a small development server, a watch mode that rebuilds on save, and an interface for plugins. On its own published benchmark, joining a large library ten times over takes 0.39 seconds here against 14.91 seconds for the next tool, 34.10 seconds for another, and 41.21 seconds for the most common one — 106 times slower. The list of things it will not do is written down by its author: no type checking, no hot module replacement, no support for other frontend languages, and no interface for rewriting code trees. It is also not at version 1.0, and the author describes it as a late-stage beta where a minor version can break compatibility.
Why it matters
Who it suits. Anyone whose build step has become long enough to interrupt their thinking, which is most people on a project past a few hundred files. It also suits anyone who wants one small, predictable tool instead of a framework, because the published non-goals mean it will stay that size. Skip it if the project needs hot reloading or a framework's own file format, because those are explicitly out of scope and will stay out.
Verdict. Two minutes, and the best thing in this edition. The reason to read the author's own notes before adopting it is not that the project is in trou— version 0.28.2 was published on 8 August 2026 and code was pushed the next day — but that he has written down exactly where the tool stops, and said that active feature development is currently paused. That is a statement of scope, and it is worth more than a roadmap: it tells you what you are committing to. Three things to watch out for. Pin the exact version, because a minor release may break something; the official install command does this with --save-exact for that reason. Type checking is a separate step, so tsc still has to run. And the install delivers a compiled program through an optional per-platform package, which breaks if scripts are disabled, if a restrictive package registry is in the way, or if a folder of installed packages is copied between operating systems. If a richer plugin ecosystem matters more than speed, rollup/rollup is the long-established choice and the one most libraries are published with.
- Finishes in well under a second where the common alternative takes most of a minute.
- The author has published what it will never do, so its scope will not creep.
- One small program with no framework around it, usable from a command line, a script or Go.
- Still on a 0.x version line, where a minor release may break compatibility.
- No type checking and no hot reloading, so a second tool is always needed.
- The compiled program arrives through an optional package, which several ordinary install settings break.
- rollup/rollup
MIT, 26.3k stars; the same bundling job with a much larger plugin ecosystem and finer control over the output, which is why most libraries are published with it; it is 87 times slower on this project's own benchmark.
Track this in Scout - swc-project/swc
Apache-2.0, 34.2k stars; a very fast compiler for the same languages, written in Rust, used inside other tools rather than on its own, with bundling as a secondary concern.
Track this in Scout - parcel-bundler/parcel
MIT, 44.0k stars; aims to be the whole build tool with no configuration at all, which is exactly what this project has decided not to be; 38 times slower on the same benchmark.
Track this in Scout
npm install --save-exact --save-dev esbuild ./node_modules/.bin/esbuild --version
37519 stars · MIT (named in the About sidebar) · v8.2.8 (2026-06-30), shown on /releases/latest as '30 Jun' with no year and settled from the Python package index, which also lists 8.2.7 of 19 May 2026 and 8.2.6 of 13 May 2026 · Track this in Scout · Share this tool
Lets a Python program draw a real interface inside a terminal, and serve the same thing to a browser.
▶Repo detailsthe review · specs · pros & cons · install
What it does
You write a Python class, list the parts it contains, and style them in a stylesheet language that looks like the one used for web pages. It reads your code and that stylesheet, and watches the keyboard and the mouse. It produces a running interface, either in a terminal window or — with textual serve — the same interface in a browser. The widget gallery documents 35 parts, including buttons, data tables, trees, a text editor, a Markdown viewer and small inline charts. It ships themes, a built-in command palette on ctrl+P, a separate developer console, and a test framework so interfaces can be checked automatically. It needs Python 3.9 or newer. There are things it has decided not to do: it does not display images, and it will not use the sixteen colours a terminal's own theme controls, because its own effects depend on knowing the exact colour it painted.
Why it matters
Who it suits. Anyone writing a Python tool whose output has outgrown printed lines — a log viewer, a queue inspector, a small admin screen. The browser mode is the strongest reason to pick it: one program can be run over SSH by one person and opened in a browser by another. Skip it if the interface needs to show pictures, and skip it if the audience is on Windows and expects a window with a title bar, because this is a terminal first.
Verdict. Twenty minutes very well spent, and the limits are all in one place, which is unusual and helpful. Version 8.2.8 was published on 30 June 2026 and code was pushed on 9 October, so it is active. The honest warnings are about the terminal rather than the library. What works depends on which terminal is open: the stock macOS Terminal shows only 256 colours and is slow, the Command and Option keys are often not passed through at all, and click-and-drag text selection works in most parts but not yet all of them. The project names iTerm2, Ghostty, Kitty and WezTerm as the ones it is happy in, and that recommendation should be taken literally. The other cost is a second language: layout is done in a stylesheet dialect that resembles web CSS without being it. For the same job in Go rather than Python, charmbracelet/bubbletea is the equivalent, built on a different idea — a single update loop instead of widgets and styles.
- 35 ready-made parts, so most screens are assembled rather than drawn.
textual serveputs the same program in a browser with no second version to maintain.- A test framework and a developer console, which almost nothing else in this niche ships.
- What works depends on the reader's terminal, and no code change can fix that.
- No image support yet, and the terminal's own sixteen theme colours are deliberately ignored.
- Layout is a second language to learn, close enough to web CSS to mislead.
- charmbracelet/bubbletea
MIT, 44.3k stars; the same job in Go, built on one update loop rather than widgets and stylesheets, which is less to learn and more to write.
Track this in Scout - prompt-toolkit/python-prompt-toolkit
BSD-3-Clause, 10.6k stars; also builds interactive terminal programs in Python, but aimed at prompts and line editing with completion rather than whole screens, and with no browser mode.
Track this in Scout - urwid/urwid
LGPL-2.1, 3.0k stars; a much older Python library for the same purpose, plainer in appearance, with no stylesheet layer and a weaker-copyleft licence rather than a permissive one.
Track this in Scout
python3 -m venv venv source venv/bin/activate pip install textual textual-dev
1059 stars · MIT (named in the About sidebar) · v26.2.1 (2026-09-26), shown on /releases/latest as '26 Sep' with no year and settled from the Python package index · Track this in Scout · Share this tool
Turns loose data such as a parsed JSON document into declared Python objects, and back again.
▶Repo detailsthe review · specs · pros & cons · install
What it does
You give it a pile of plain Python values — the kind a parsed JSON document produces — and the class you expect them to be. It builds that class, following the type annotations you already wrote, and complains where the data does not fit. It handles the awkward cases: optional values, lists, tuples, sets, dictionaries, typed dictionaries and unions. Going the other way, it flattens an object back into plain values ready to be written out. It ships nine ready-made converters tuned for particular output libraries, including the standard JSON module, orjson, msgpack, CBOR, BSON, YAML and TOML, so the quirks of each are already handled. It needs Python 3.10 or newer. It does not define your classes — those come from attrs or from the standard dataclasses — and it does no reading or writing itself: the actual serialising is handed to whichever library you chose.
Why it matters
Who it suits. Anyone whose Python code receives JSON and then checks fields by hand, and anyone who has written the same "turn this dictionary into an object" function three times. It fits a project that already uses dataclasses and does not want to rewrite every model class to adopt a framework. Skip it if validation itself is the main need, because this converts rather than enforces rules.
Verdict. Half an hour, and the thing to understand is where it sits. It is deliberately not a model framework: you keep your own classes and it converts them, which is precisely why it suits a codebase that already has classes it likes. Code was pushed on the morning of this edition and version 26.2.1 was published on 26 September 2026, so a 1,059-star project is being actively maintained. Two warnings, both real. Unions of unrelated types are not resolved automatically — anything beyond a set of classes with distinct fields needs a small function you write and register, and that is the usual first wall. More importantly, a type it does not know how to convert is passed through unchanged rather than rejected, so a wrong setup can produce quietly wrong data instead of an error. Test the round trip rather than trusting it. The better-known alternative is pydantic/pydantic, which does validation and conversion together but owns the class definitions, and that difference is the whole choice.
- Keeps your own classes, so adopting it does not mean rewriting every model.
- Nine ready-made converters, so the quirks of each output library are already handled.
- Very small and dependency-light, which makes it easy to remove again.
- Unknown types pass through unchanged, so a mistake yields wrong data rather than an error.
- Unions of unrelated types need a disambiguation function written by hand.
- Python 3.10 or newer only, so it is unavailable on older pinned interpreters.
- pydantic/pydantic
MIT, 29.1k stars; does validation and conversion together, but your classes have to be its classes, which is more capable and a much larger commitment.
Track this in Scout - jcrist/msgspec
BSD-3-Clause, 4.2k stars; the same structuring job with the encoders written in C for speed, where this project hands the encoding to other libraries.
Track this in Scout - marshmallow-code/marshmallow
MIT, 7.2k stars; the same converting job driven by hand-written schema classes instead of by the type annotations already in the code.
Track this in Scout
python3 -m venv venv source venv/bin/activate pip install cattrs
6252 stars · GPL-3.0 (named in the About sidebar), and the bundled components keep it there: JUCE 6 (commercial or GPLv3), the VST3 SDK (GPLv3), Rubber Band and FFTW behind PitchShift and time_stretch (commercial or GPLv2+), and LAME behind Mp3Compression (LGPLv2, upgraded to GPLv3 for this project) · v0.9.26 (2026-10-07), shown on /releases/latest as '07 Oct' with no year and settled from the Python package index · Track this in Scout · Share this tool
Applies audio effects to recordings from Python, including studio plug-ins, without calling another program.
▶Repo detailsthe review · specs · pros & cons · install
What it does
It reads a sound file or an array of numbers, resamples on the way in without loading everything at once, and handles AIFF, FLAC, MP3, OGG and WAV everywhere plus more formats depending on the system. You then build a chain of effects and run the audio through it. Eighteen effects are built in, including reverb, compression, pitch shifting, distortion, a limiter and deliberate degradation such as MP3 compression and bit-crushing. It can also host third-party plug-ins: VST3 on macOS, Windows and Linux, and Audio Units on macOS only. Its own figures put it up to 300 times faster than one common Python wrapper around a command-line tool, and reading audio up to four times faster than the usual analysis library. It releases Python's internal lock, so several processor cores are used without extra work. Two things it does not do: effect plug-ins cannot be sent MIDI, and there is no built-in way to change a plug-in's setting over time — that has to be done by processing the audio in pieces.
Why it matters
Who it suits. Anyone writing Python that has to process a lot of audio — building training data, batch-normalising a library of recordings, or applying a studio plug-in to ten thousand files. It suits anyone who currently shells out to a command-line tool per file and is paying for it in time. Skip it if the work is analysis rather than processing, because a library built for measurement will answer those questions more directly.
Verdict. Worth an hour, and the licence is the first thing to settle. It is GPL-3.0, and the components inside it make that firmer rather than softer: the audio framework it is built on, the plug-in interface, the pitch-shifting library and the MP3 encoder all arrive under strong copyleft terms. Using it in a private batch job is unproblematic. Putting it inside a product that is not itself open source is a legal decision, not an installation. The software is current: version 0.9.26 was published on 7 October 2026. Two practical warnings. Plug-in hosting is where it breaks, and the failure depends on the machine — no Audio Units outside macOS, most Linux plug-ins need a recent system library, and the project says macOS plug-in paths are only tested by hand. And because it works on whole arrays in memory, a long recording is held in memory in full. For the neighbouring job of deliberately degrading audio to train a model, entry 9 below is the permissively licensed answer and the better fit.
- Eighteen effects built in, and the ability to load real studio plug-ins as well.
- Very fast, and it uses several processor cores without any extra code.
- Reads and writes the common formats with nothing else installed.
- GPL-3.0, deepened by its own components, which rules it out of closed products.
- Plug-in support varies by operating system, and macOS paths are only tested by hand.
- Whole recordings are held in memory, so long files need a lot of it.
librosa/librosaISC, 8.6k stars; loads and analyses audio in Python for measurement and music analysis rather than applying effects, and hosts no plug-ins; its permissive licence makes it usable where this one is not.
Track this in Scout- pytorch/audio
The About panel names no licence, 2.9k stars; audio reading and transforms as an extension of a machine-learning framework, working on its tensors and able to use a graphics card, with no plug-in hosting at all.
Track this in Scout
python3 -m venv venv source venv/bin/activate pip install --upgrade pip pip install pedalboard
2324 stars · MIT (named in the About sidebar, confirmed by the Python package index) · v0.43.1 (2025-09-13), shown on /releases/latest as '13 Sep' with no year and settled from the Python package index - thirteen months old, with five commits unreleased on main · Track this in Scout · Share this tool
Spoils sound recordings on purpose, thirty-nine ways, so a model trained on them copes with real rooms.
▶Repo detailsthe review · specs · pros & cons · install
What it does
It takes an array of numbers representing a recording, as 32-bit values between minus one and one, and returns an array of the same shape with the damage applied. There are 39 transforms, covering added noise, filters, pitch shifting, time stretching, loudness normalisation, MP3 compression, room simulation and limiting. They are composed in groups: run all of them, pick one at random, or pick some, each with its own probability. The design deliberately mirrors the well-known image equivalent, so anyone who has done this with pictures will recognise the shape immediately. It plugs into either of the two main training frameworks. It runs on the processor only, and the documentation sends anyone wanting a graphics card to a sibling project. Two of the transforms, the ones that mix in background noise, still refuse multi-channel audio.
Why it matters
Who it suits. Anyone training a model on sound who is getting good test numbers and bad real-world ones. It fits someone who has already done this with images, because the shape of the code is intentionally the same. Skip it if the training set is already recorded in the conditions it will be used in, and skip it if the pipeline is on a graphics card, because this one is not.
Verdict. Twenty minutes, and the honest headline is the gap between its two clocks. Code was last pushed on 13 April 2026, six months ago, but the newest published version is 0.43.1 from 13 September 2025 — thirteen months old. So an ordinary install is well behind the code, with five changes sitting unreleased. Nothing is wrong with the project; it is simply not cutting releases often. Two things to plan for. The plain install quietly leaves out several of the more interesting transforms: the limiter, the loudness normaliser, the MP3 compressor and the room simulator each need an extra piece, and some of them need the ffmpeg media tool installed on the machine as well. And because everything happens on the processor, heavy augmentation competes with the training loop itself, which is the usual reason people move to the graphics-card sibling, asteroid-team/torch-audiomentations — a move that means rewriting the pipeline. The licence is plain MIT, which is the clearest advantage it has over entry 8 above.
- 39 transforms with probabilities, so every training copy is different.
- Plain MIT, so it can sit inside a closed product without a legal question.
- The shape of the code is borrowed from the image equivalent, so it is familiar immediately.
- The published version is thirteen months old while the code moved six months ago.
- The basic install leaves out four of the better transforms, and some need a media tool installed.
- Processor only, so heavy use competes with training and a graphics card means switching libraries.
spotify/pedalboardGPL-3.0, 6,252 stars, entry 8 of the same edition; applies audio effects from Python and can host studio plug-ins, which this one cannot, at the cost of a licence that rules out closed products.
Track this in Scout- asteroid-team/torch-audiomentations
MIT, 1.2k stars; the same idea on a graphics card, with each transform written as a layer that can sit inside the model itself.
Track this in Scout - facebookresearch/WavAugment
MIT, 687 stars; the same spoiling job aimed narrowly at self-supervised speech research, with a much shorter list of transforms.
Track this in Scout
python3 -m venv venv source venv/bin/activate pip install audiomentations pip install "audiomentations[extras]"
3648 stars · MIT (named in the About sidebar) · v1.13.0 (2025-02-19), shown on /releases/latest as '19 Feb' with no year and settled from the Go module index - twenty months old, with eleven commits unreleased on master · Track this in Scout · Share this tool
Walk through folders with arrow keys, and leave the terminal in the folder you stopped at.
▶Repo detailsthe review · specs · pros & cons · install
What it does
It lists the current folder and reads your key presses: arrows or hjkl to move, enter to go in, backspace to go up. Space previews the highlighted file, including images, with nothing extra installed. A slash starts a fuzzy search that narrows the list as you type, dd deletes with u to undo, and . shows hidden files. There are 13 key bindings and 6 command-line flags in total. When you quit, it prints the folder you ended on, and a small shell function feeds that to cd — which is how the terminal ends up there. Settings are environment variables only: the editor to open files with, a per-extension list of commands, the delete command, and two appearance options. There is no configuration file, no copying, no moving, no renaming, no selecting several files, and no plugins. The whole program is one small Go binary.
Why it matters
Who it suits. Anyone who spends time in a terminal and keeps mistyping folder names. It fits someone who wants exactly this one behaviour and nothing else, which is the honest appeal of a tool with 13 bindings. Skip it if files need to be copied, moved or renamed, because none of that exists here, and skip it if a fuller file manager is already in use.
Verdict. Five minutes, with one piece of friction worth knowing in advance: it does not work as installed. The package gives a program called walk that prints a path, and the behaviour the documentation advertises needs a shell function called lk added to a shell startup file by hand. Anyone who installs it, runs walk, and sees nothing happen has hit exactly that. The dates are the other thing to say plainly. The newest release, 1.13.0, is from 19 February 2025 — twenty months ago — with eleven changes sitting unreleased since, while the code itself was last pushed on 6 January 2026, nine and a half months ago. So it is slow, not dead, and a packaged copy is behind the code. The licence is plain MIT. If the missing operations matter, gokcehan/lf is the closest fuller relative and also written in Go, and sxyazi/yazi from Edition 28 is the much larger modern option.
- One small binary, in most package lists, with nothing to configure.
- File preview including images works immediately, with nothing extra installed.
- Delete has an undo, and the delete command itself can be swapped for one that uses a wastebasket.
- Does nothing useful until a shell function is added by hand, and the function has a different name from the program.
- No copying, moving, renaming or multiple selection, and no configuration file at all.
- The newest release is twenty months old with eleven unreleased changes behind it.
- gokcehan/lf
MIT, 9.5k stars; the same terminal browsing job, also in Go, also shipping a shell wrapper, with a configuration file, custom commands and multiple panes.
Track this in Scout 
sxyazi/yaziMIT, 42.3k stars, covered in Edition 28; a much larger file manager in Rust with full file operations, plugins and configuration, which is more to learn and far more capable.
Track this in Scout- jarun/nnn
BSD-2-Clause, 21.9k stars; the same navigation job in C, with a plugin system and extras such as disk-usage analysis and batch renaming.
Track this in Scout
brew install walk
4600 stars · MIT (named in the About sidebar and by the npm registry) · v7.12.1 (2026-08-12), shown on /releases/latest as '12 Aug' with no year and settled from the npm registry's own publish timestamp for both iconoir and iconoir-react · Track this in Scout · Share this tool
1,671 hand-drawn icons, free for any use including commercial work, packaged nine different ways.
▶Repo detailsthe review · specs · pros & cons · install
What it does
It ships one set of outline icons drawn on a 24 by 24 grid with a consistent 1.5 line weight, which is what makes a mixed set of them look deliberate rather than collected. The website publishes 1,671 of them, grouped by subject, with search. The same set is distributed nine ways: plain SVG files, an icon font, a stylesheet, and ready-made components for React, React Native, Vue, Flutter, Framer and Figma. The stylesheet route needs nothing installed at all beyond a link in the page. It is icons and only icons: there is no component library, no interface kit and no illustrations. There is no official package for Angular or Svelte, and the Swift version lives in a separate repository rather than this one.
Why it matters
Who it suits. Anyone building an interface who needs a consistent set and does not want to pay per seat or attribute anyone. It suits a project spanning a web page and a mobile application especially well, because the same drawings are available on both sides. Skip it if the project needs six thousand icons rather than sixteen hundred, and skip it if Angular or Svelte components are required, because neither exists.
Verdict. Two minutes, and plain MIT — which in an icon set is the whole point, because this is the category where licences most often require attribution or forbid commercial use. Version 7.12.1 was published on 12 August 2026 and code was pushed on 18 October, so it is maintained. Two things to be aware of. The per-framework packages are released together but installed separately, so a project using three of them has three dependencies to keep in step, and the quick stylesheet route shown in the documentation points at the project's main branch rather than a fixed version, which means it can change without warning — pin a version for anything that matters. The other is that this is volunteer work funded by donations, which is worth knowing when planning to depend on it for years. If the set is too small, tabler/tabler-icons is also MIT and ships 6,184 icons; if the drawing style here is appealing, lucide-icons/lucide from Edition 12 is the closely related alternative with a larger community.
- Plain MIT, so no attribution and no commercial restriction, which is rare in this category.
- Nine packagings of one set, so a web page and a mobile application can share the drawings.
- Drawn to one grid and one line weight, so a mixed selection still looks consistent.
- No Angular or Svelte package, and the Swift version is a different repository.
- Framework packages install separately, so several have to be kept in step by hand.
- Donation-funded volunteer maintenance, and the stylesheet route in the documentation pins no version.
tabler/tabler-iconsMIT, 21.6k stars; the same job with a far larger set, 6,184 icons in outline and filled versions, and sprite and webfont builds as well as framework components.
Track this in Scout
lucide-icons/lucideISC, 24.4k stars, covered in Edition 12; a very close relative in style and scope with a larger community, descended from Feather.
Track this in Scout- feathericons/feather
MIT, 26.0k stars; the original 24 by 24 outline set that this design language comes from, much narrower in scope and visibly slower-moving, with 410 open issues.
Track this in Scout
<link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/iconoir@7.12.1/css/iconoir.css" /> <i class="iconoir-download"></i>
40076 stars · Apache-2.0. The About text names no licence but the Resources list links it, and the LICENSE file on the master branch was read in full on 2026-10-25: stock Apache License 2.0, sections 1-9 plus the standard appendix, copyright 2016-2023 Kong Inc., with NO added clauses, no extra trademark condition and no carve-out. · core@13.3.1, shown on /releases/latest as '09 Oct' with no year and NOT settled - a desktop application with no package registry entry, so the year is unsettled; the code date of 2026-10-25 proves currency instead · Track this in Scout · Share this tool
A desktop application for sending requests to an interface and reading what comes back, with collections that can be run as tests.
▶Repo detailsthe review · specs · pros & cons · install
What it does
It sends and inspects requests over six families of protocol: plain HTTP, REST, GraphQL, WebSockets, server-sent events and gRPC. Requests are saved into collections, which can be run as a batch, and responses can be checked automatically so a collection doubles as a test suite. It has an editor for OpenAPI documents, so an interface can be designed in the same place it is tried, and it can stand in for a service that does not exist yet by returning fixed answers. A separate command-line companion runs the same collections inside an automated build. Storage is the real choice, and there are three options: entirely on the machine, synchronised through any Git repository with no cloud involved, or synchronised through the company's own service with optional end-to-end encryption. It is not account-free software: only the local scratch area works without signing in, and Git synchronisation, organisations, unlimited collaboration and corporate single sign-on are paid features.
Why it matters
Who it suits. Anyone who tests interfaces by hand often enough to want them saved, and who values the OpenAPI editor and the mocking in the same window. It suits a team already paying for a similar commercial product and looking at the bill. Skip it if signing in to use a local tool is unacceptable, and skip it if collections need to live in a Git repository without paying, because that is exactly the feature behind the paywall.
Verdict. A capable tool whose licence and whose product are two different things, and that distinction is the point of this entry. The code is plain Apache-2.0 — the file was read in full today, and there are no added clauses, no extra trademark conditions and no carve-outs. But an open licence on the source does not make the shipped application open in use: past the scratch area it wants an account, and the Git synchronisation that would keep collections in a repository is a paid feature. Code was pushed on the morning of this edition, so it is very much alive, and the newest release is core@13.3.1, shown as "09 Oct" with no year and with no package registry to settle it. The queue is long — 745 open issues and 160 open pull requests — and the roadmap follows a commercial product, so community fixes can wait. If the account requirement is the problem, usebruno/bruno from Edition 17 stores every collection as plain text files in an ordinary folder, with no account and no cloud at all, and that is the straight answer to this one's main weakness.
- Six protocol families in one window, including GraphQL, gRPC and server-sent events.
- Designing an interface, trying it, and standing in for it all happen in the same place.
- The source licence is plain Apache-2.0, read in full, with no added conditions.
- Only the scratch area works without an account, and the account is not optional elsewhere.
- Keeping collections in a Git repository is a paid feature, despite the open source licence.
- 745 open issues and 160 open pull requests, against a roadmap set by a commercial product.
usebruno/brunoMIT, 46.3k stars, covered in Edition 17; the same request-building job with collections stored as plain text files in a folder, no account and no cloud component at all.
Track this in Scout
hoppscotch/hoppscotchMIT, 80.6k stars; the same job built for a browser first, with offline, self-hosted and cloud deployments and a command-line runner.
Track this in Scout- httpie/desktop
The About panel names no licence, 4.0k stars; a much smaller desktop client for trying REST, GraphQL and HTTP interfaces, with no design editor, no mocking and no test runner.
Track this in Scout
sudo apt-get install libfontconfig-dev git clone https://github.com/Kong/insomnia cd insomnia npm install npm run dev
Checked, and left out
Nothing to show for this edition. Recording the repositories that were checked and rejected began with Edition No. 4, and every edition from there on has the list.
Know a repository we should check?
Coming tomorrow