A web page built from nothing but queries

01

docmost/docmost

21400 stars · AGPL-3.0 for the core, with a separate enterprise licence on apps/server/src/ee, apps/client/src/ee and packages/ee, stated in the README · v0.97.0 (2026-10-25), read from /releases/latest as '25 Oct' and dated by the run · Track this in Scout · Share this tool

A self-hosted team wiki with live collaborative editing, page history and diagrams drawn inside the page.

▶Repo detailsthe review · specs · pros & cons · install

What it does

Pages are organised into spaces, and each space has its own members and permissions. Several people can edit one page at once and the text merges as they type. Every page keeps its history, so an old version can be read again. Diagrams are drawn inside a page using Draw.io, Excalidraw or Mermaid, so a flow chart lives with the text it explains. Comments attach to the page, files attach as attachments, and content from services such as Airtable, Loom and Miro can be embedded. The interface is translated into more than ten languages. It does not try to be a project tracker, a chat tool or a database — there are no task boards, no channels and no spreadsheet views.

Why it matters

Who it suits. A team of three to fifty people whose written knowledge is currently spread across chat messages and personal documents. It suits anyone who wants that writing on hardware they control, for privacy reasons or for cost reasons. Skip it if a single person is writing only for themselves, because a local notes app will be faster and needs no server.

Verdict. Worth an evaluation afternoon. Version 0.97.0 landed on 25 October 2026, one day before this edition, which is about as current as a project gets. The number is still below 1.0, so expect the occasional rough edge rather than a finished product. Two honest comparisons sit below: outline/outline is more polished but carries the Business Source License, which restricts commercial use for a period, and requarks/wiki is plain AGPL-3.0 but its version 3 has been in development for a long time. Docmost is the middle choice today.

Stars21400

LicenceAGPL-3.0 for the core, with a separate enterprise licence on apps/server/src/ee, apps/client/src/ee and packages/ee, stated in the README

Latestv0.97.0 (2026-10-25), read from /releases/latest as '25 Oct' and dated by the run

Good

• Live collaborative editing works without a paid tier.
• Diagrams, comments and page history are all built in.
• Releases arrive constantly, which is rare for a project this young.

Watch for

• Setting it up means running a database and a container, so it is not a one-click install for a non-programmer.
• The enterprise folders in the code carry a separate commercial licence, so not every file is AGPL.
• Still before version 1.0, and the repository has 95 open pull requests waiting.

Similar repositories

• 
  outline/outline

  40.9k stars; the same team knowledge base, more polished, but under the Business Source License rather than an open-source licence.

  Track this in Scout
• 
  requarks/wiki

  28.9k stars, AGPL-3.0; Wiki.js does the same job under a plain open licence, with a long-running version 3 rewrite still unfinished.

  Track this in Scout

Install

mkdir docmost && cd docmost
# save the docker-compose.yml from the self-hosting guide into this folder
# then open it and set APP_SECRET to a long random string
docker compose up -d

⧉

Screenshots

02

remarkjs/remark

8997 stars · MIT (named in the About sidebar, copyright Titus Wormer) · the npm package `remark` has stood at 15.0.1 since September 2023; the repository itself pushed code on 2026-09-01, a three-year gap caused by the ecosystem moving to the smaller packages around it · Track this in Scout · Share this tool

A Markdown processor that lets small plugins inspect and rewrite documents as a tree.

▶Repo detailsthe review · specs · pros & cons · install

What it does

It parses Markdown according to the CommonMark rules and produces a tree that describes the document. Plugins then walk that tree and change it, and the result can be written back out as Markdown or handed to another tool as HTML. The project is one repository holding four pieces: remark-parse for reading, remark-stringify for writing, remark for both together, and remark-cli for running it from a terminal. It runs on a server, in a browser, from the command line and in Deno. It is the engine inside a large part of the JavaScript writing ecosystem, which is why many people already have it without choosing it. It is not an editor, not a site builder and not a renderer — nothing it does puts a page on a screen by itself.

Why it matters

Who it suits. Anyone maintaining more than about fifty Markdown files who keeps finding the same mistake by hand. A rule written once as a plugin fixes every file and keeps fixing them. It also suits anyone who wants to add a new piece of syntax to their own documentation. Skip it if you have ten pages and a text editor, because a search and replace will be quicker than learning a tree shape.

Verdict. Useful, and the learning curve is real. Half a day to understand the tree, then minutes per rule after that. The last code landed on 1 September 2026, so the project is alive, but the published remark package on npm has stood at version 15.0.1 since 2023 — the ecosystem moved to the smaller pieces around it instead. That is a publishing habit, not a sign of trouble, but it does mean the examples you find will not all match. If the job is simply turning Markdown into HTML once, markdown-it/markdown-it is simpler and will do.

Stars8997

LicenceMIT (named in the About sidebar, copyright Titus Wormer)

Latestthe npm package `remark` has stood at 15.0.1 since September 2023; the repository itself pushed code on 2026-09-01, a three-year gap caused by the ecosystem moving to the smaller packages around it

Good

• One rule, written once, applies to every file.
• A very large collection of existing plugins to start from.
• Works the same in a terminal, a server and a browser.

Watch for

• You must learn the document tree before anything useful happens.
• The main package has not had a new version since 2023, so some tutorials are out of date.
• Many small packages to keep track of instead of one.

Similar repositories

• markdown-it/markdown-it

  21.9k stars, MIT; turns Markdown into HTML quickly and takes plugins, but hands you no document tree to rewrite.

  Track this in Scout
• micromark/micromark

  2.2k stars, MIT; the small strict parser underneath remark, for when you want the parsing and none of the plugin machinery.

  Track this in Scout

Install

npm install remark remark-cli remark-preset-lint-recommended
npx remark . --use remark-preset-lint-recommended --frail

⧉

Screenshots

03

papermark/papermark

9.1k stars · AGPL-3.0 · v0.22.0 (2025-12-06) · Track this in Scout · Share this tool

Open-source DocSend — send a PDF as a tracked link and see who read which page.

▶Repo detailsthe review · specs · pros & cons · install

What it does

A document is uploaded and becomes a shareable link. The link can be put behind a custom domain, so the page the recipient sees carries your name rather than a stranger's. Several documents can be grouped into a data room, which is a single place a client or an investor is given access to. The project records that a link was opened, and its README lists page-by-page reading figures as still to come, so the detailed version of that tracking is not there yet. Underneath it uses Next.js, PostgreSQL and Prisma, with Tinybird for the counting, Resend for email and Stripe for payments on the hosted version. It is not a signing tool and not a file sync tool: nobody signs anything here, and there is no desktop folder that keeps itself up to date.

Why it matters

Who it suits. Anyone who sends the same few documents to many outside people and would like to know whether they were read. Consultants sending proposals, founders sending a deck, agencies sending a scope. It also suits anyone who would rather not send a commercial document through a third party's servers at all. Skip it if the documents are only ever shared inside one team, where a shared drive already does the job.

Verdict. Worth a weekend if the tracked link matters to how you work, and not otherwise. The code is current — the last commit landed on 28 August 2026 — but the newest tagged release, v0.22.0, is from December 2025, so the version you run will be whatever the main branch happens to be. Self-hosting needs five separate things working at once: Node.js 18.17 or newer, a PostgreSQL database, object storage on Amazon S3 or Vercel Blob, a Resend account for email, and a Tinybird setup for the analytics. That last one is the part people give up on. If the only thing you need is a short link with click counts, dubinc/dub is far less work.

Stars9.1k

LicenceAGPL-3.0

Latestv0.22.0 (2025-12-06)checked 7 Sep 2026

Written inTypeScript

Good

• Your own domain and your own logo on the page the recipient sees.
• Data rooms group several documents behind one access point.
• The whole product is AGPL-3.0, with no features held back.

Watch for

• Five external services to configure before the first document can be uploaded.
• Page-by-page reading figures are listed as a future feature, not a current one.
• 133 open pull requests, which suggests more contribution than review.

Similar repositories

• 
  dubinc/dub

  24.9k stars, AGPL-3.0 with a separate licence on its enterprise folder; short links with conversion tracking on your own domain. Links, not documents.

  Track this in Scout
• 
  docusealco/docuseal

  18.4k stars, AGPL-3.0 with extra terms; the neighbouring job, having the recipient fill in and sign the document rather than just read it.

  Track this in Scout

Install

git clone https://github.com/papermark/papermark.git
cd papermark
npm install
cp .env.example .env
# fill in the database, storage, Resend and Tinybird values in .env
npx prisma db push
npm run dev

⧉

Screenshots

04

LinkStackOrg/LinkStack

3.9k stars · AGPL-3.0 · v4.8.6 (2026-02-17) · Track this in Scout · Share this tool

Self-hosted Linktree — a personalised link page for the YouTube channel description and social profiles.

▶Repo detailsthe review · specs · pros & cons · install

What it does

Each user gets one public page listing their links, and an admin area manages users, links and themes. Themes change the whole look and can be uploaded as a zip file through that admin area, so no code is needed to restyle it. A built-in updater fetches new versions and takes a backup first. It supports SQLite by default and MySQL as an alternative, and the published Docker image runs PHP 8.2 on Apache. The project also runs free hosted instances for people who do not want to install anything. It does not shorten links, does not count clicks in any depth, and gives no attribution reporting — this is a landing page, not a measurement tool.

Why it matters

Who it suits. Anyone who publishes on more than two platforms and needs one address that points at all of them. It suits people with no command line at all, because the non-Docker install really is copy the files and open the page. It also suits a small group — a band, a club, a team — because one installation serves many users. Skip it if what you actually want is to know which link gets clicked, because a link shortener answers that and this does not.

Verdict. Worth an hour, with one reservation about pace. The last code landed on 21 July 2026, so it is alive. The releases are erratic: v4.8.5 and v4.8.6 both arrived on 26 January 2026, after a gap of about fourteen months from the previous one. That pattern is fine for a page of links, where nothing much needs to change, and it would worry me in anything holding money or credentials. Two cautions from its own documentation are worth repeating: the updater keeps only two backups, and if you use MySQL the updater's backup does not include the database at all. Take your own copy before updating.

Stars3.9k

LicenceAGPL-3.0

Latestv4.8.6 (2026-02-17)checked 7 Sep 2026

Written inPHP

Good

• Installs with no command line: unpack the files, open the page, follow the installer.
• Many users and uploadable themes from one installation.
• Plain AGPL-3.0, with free hosted instances if you would rather not install it.

Watch for

• Release pace is erratic, with a fourteen-month gap in the recent history.
• The built-in updater does not back up a MySQL database, and keeps only two backups.
• No click counting or attribution, so it tells you nothing about what works.

Similar repositories

• sethcottle/littlelink

  3.1k stars, MIT; plain HTML and CSS with branded buttons, so there is nothing to maintain, and no admin area or multiple users either.

  Track this in Scout

How to get it

The simple route needs no terminal.

Screenshots

05

Litlyx/litlyx

💎 hidden gem

1748 stars · Apache-2.0 (named in the About sidebar) · no releases at all, anywhere; the project is proved current only by its code date of 2025-12-03, read from the mirror · Track this in Scout · Share this tool

A small, cookie-free visitor counter with its own dashboard, which can be run on a machine you control.

▶Repo detailsthe review · specs · pros & cons · install

What it does

One line of script in the page, or a small installed library, reports a visit. It records page views, visitors who have not been seen before, and how many people are on the site right now. Custom events can be sent with extra details attached, so a sign-up or a download can be counted as well as a page. The results appear on a single dashboard, which also offers written summaries generated from the numbers. It can be installed with a script tag or from a package manager, and it can be run with Docker or used as a hosted service. It is not a full product-analytics system: there is no funnel analysis, no session replay and no experiment framework, and the project does not claim any of those.

Why it matters

Who it suits. Anyone running a small site who wants to know roughly how many people arrive and from where, and who does not want to hand that record to an advertising company. The cookie-free design is the practical part, because a cookie banner is a real cost in both annoyance and compliance work. Skip it if the question is which of fourteen steps people abandon, because that needs a heavier tool.

Verdict. Worth an hour if small and simple is what you want, and read this paragraph before you commit. The licence is plain Apache-2.0. The code is current enough to qualify and no more: the last commit landed on 3 December 2025, about eleven months before this edition, and the repository has 405 commits and no tagged releases at all. That is a small project moving slowly, not an abandoned one, and the distinction matters — nothing here is broken. Still, eleven months is eleven months, and anyone choosing a counter they intend to keep for years should weigh that against the better-known alternatives, several of which this report has covered before. One more thing from the project's own pricing page: self-hosting is free, but scaling past a certain number of client seats is pointed at a paid plan.

Stars1748

LicenceApache-2.0 (named in the About sidebar)

Latestno releases at all, anywhere; the project is proved current only by its code date of 2025-12-03, read from the mirror

Good

• No cookies, so no banner and far less to explain to a visitor.
• One line of script is the whole installation on the site itself.
• Plain Apache-2.0, with the self-hosted version genuinely free.

Watch for

• The last code landed in December 2025, about eleven months ago.
• No tagged releases at all, so there is no version to pin to.
• No funnel analysis, no session replay and no experiments. Three open issues and five open pull requests, which is a small project by any measure.

Similar repositories

• 
  matomo-org/matomo

  21.9k stars, GPL-3.0, covered in Edition 36; the long-established self-hosted option, far larger and far heavier.

  Track this in Scout
• 
  Swetrix/swetrix

  1.2k stars, AGPL-3.0, covered in Edition 53; a cookie-free counter with error tracking too, and more features held back for its hosted service.

  Track this in Scout

Install

npm install litlyx-js

⧉

Screenshots

06

frappe/erpnext

38600 stars · GPL-3.0 (named in the About sidebar) · v15.124.1 (2026-10-22), read from /releases/latest as '22 Oct' and dated by the run · Track this in Scout · Share this tool

A complete free business management system covering accounting, stock, orders, manufacturing, assets and projects.

▶Repo detailsthe review · specs · pros & cons · install

What it does

Accounting covers the path from recording a transaction to producing a financial report. Order management covers inventory, sales orders, customers, suppliers, shipments and fulfilment. Manufacturing covers production runs, material consumption, capacity planning and subcontracting. Asset management follows equipment from purchase to disposal, and the projects module tracks tasks, timesheets and issues. Separate modules exist for point of sale, retail, human resources and customer records. It is built on the Frappe framework, in Python and JavaScript, with MariaDB underneath. It is not a lightweight invoicing tool, and the project says so by implication: the Docker quick start is labelled as an evaluation that you should expect to throw away, and custom extensions cannot be installed into it.

Why it matters

Who it suits. A company of roughly ten to two hundred people that has outgrown spreadsheets and is being quoted a per-user monthly price by a commercial vendor. It suits a business with one person willing to own the system and learn it properly. Skip it entirely if you are one person sending ten invoices a month, because entry 5 above will take a tenth of the time.

Verdict. This is the most valuable thing in today's twelve for the right reader, and the wrong reader should not touch it. Release v15.124.1 landed on 22 October 2026 — the patch number tells you how much work goes into it, and how fast it moves. Budget weeks, not days: the realistic path is the Docker evaluation first, then a proper installation using the project's own bench tool, then configuration with someone who understands accounting. The licence is plain GPL-3.0 with no paid tier held back, which among business systems of this size is unusual. The honest warning is not about the code. It is that an unfinished ERP installation is worse than the spreadsheets it replaced, so do not start one without deciding who finishes it.

Stars38600

LicenceGPL-3.0 (named in the About sidebar)

Latestv15.124.1 (2026-10-22), read from /releases/latest as '22 Oct' and dated by the run

Good

• Accounting, stock, manufacturing, assets and projects in one system, under GPL-3.0.
• No licence fee and no per-user charge, at any size.
• Very actively developed, with release v15.124.1 on 22 October 2026.

Watch for

• Weeks of learning, not hours. Setting it up properly is a project in itself.
• The Docker quick start is a demo that cannot take custom extensions, so it is not a path to production.
• Needs a database, a job queue and a web server, so it is the heaviest thing on this list to keep running.

Similar repositories

• 
  odoo/odoo

  55.3k stars; the same kind of suite with a larger application library, split between a free community edition and a paid enterprise one.

  Track this in Scout
• 
  Dolibarr/dolibarr

  7.8k stars, GPL-3.0; a lighter PHP business system that is quicker to install and covers less ground.

  Track this in Scout

Install

git clone https://github.com/frappe/frappe_docker
cd frappe_docker
docker compose -f pwd.yml up -d

⧉

Screenshots

07

pdfminer/pdfminer.six

7000 stars · MIT (named in the About sidebar and on the package index) · 20260107 (2026-01-07), settled from the package index; the repository sidebar lists no releases, and the recorded code date is 2026-03-13 · Track this in Scout · Share this tool

Reads text, layout, position, font and colour out of a PDF, in pure Python, and writes nothing back.

▶Repo detailsthe review · specs · pros & cons · install

What it does

It parses the PDF directly rather than guessing from a picture of the page, so the text it returns is the text the author typed. For each element it can report the position, the font and the colour, and it performs automatic layout analysis to group characters into lines and blocks. It can write out plain text, HTML or hOCR. It handles Type1, TrueType, Type3 and CID fonts, Chinese, Japanese and Korean text, and vertical writing. It reads the table of contents, tagged content and form fields, and it handles RC4 and AES encrypted files. Embedded JPG, PNG, TIFF, JBIG2 and bitmap images can be extracted with an optional extra. It explicitly does not write, merge, split or encrypt PDFs — every feature it lists is about reading one.

Why it matters

Who it suits. Anyone who receives documents as PDFs and needs the numbers out of them: invoices, statements, reports, scientific papers. It suits a Python project that must not call out to a paid service, because everything happens on the machine running it. Skip it if the PDF is a scan, a photograph of paper with no text inside, because there is nothing for it to read and you need optical character recognition instead.

Verdict. The right default for reading, and it should be paired rather than used alone. Version 20260107 was published on 7 January 2026 and the last code landed on 13 March 2026, so it is maintained but not fast-moving — fair for a library whose job barely changes. The clean division of labour is worth remembering: use this to read, and py-pdf/pypdf to write, merge or split. For tables specifically, jsvine/pdfplumber is built on top of this one and will save you a day. Needs Python 3.10 or newer, and 221 open issues sit on the tracker.

Stars7000

LicenceMIT (named in the About sidebar and on the package index)

Latest20260107 (2026-01-07), settled from the package index; the repository sidebar lists no releases, and the recorded code date is 2026-03-13

Good

• Reads the real text, not a guess from an image, so the output is exact.
• Reports position, font and colour, which makes finding structure possible.
• No service to call and no model to download. MIT licence.

Watch for

• Read-only. It cannot write, merge, split or encrypt a PDF.
• Useless on scanned pages, which contain a picture and no text.
• Maintained slowly, with 221 open issues and a release roughly twice a year.

Similar repositories

• 
  py-pdf/pypdf

  10.3k stars; the other half of the job, splitting, merging, rotating and reshaping pages, and reading text less precisely.

  Track this in Scout
• 
  jsvine/pdfplumber

  10.7k stars, MIT; built on pdfminer.six and adds table extraction, which is usually the thing people actually want.

  Track this in Scout

Install

python3 -m venv venv
source venv/bin/activate
pip install "pdfminer.six[image]"
pdf2txt.py statement.pdf > statement.txt

⧉

Screenshots

08

mkdocstrings/griffe

💎 hidden gem

696 stars · ISC (named in the About sidebar and on the package index) · 2.4.1 (2026-10-22), settled from the package index rather than from GitHub, which shows no releases · Track this in Scout · Share this tool

Compares two versions of a Python package and lists the changes that would break code calling it.

▶Repo detailsthe review · specs · pros & cons · install

What it does

It reads a Python project and builds a description of everything it offers publicly: modules, classes, functions, and the exact shape of each signature. griffe dump writes that description out as JSON so other tools can use it. griffe check compares two versions and reports the differences that matter — for example, an argument that used to be accepted by position and is now accepted only by name, which silently breaks every caller that passed it positionally. It can compare the current code against a git reference, or compare a published package against another version fetched from the package index. In library form it offers griffe.load(), griffe.load_git() and griffe.find_breaking_changes(). It is not a type checker and not a test runner: it says what changed in the shape of the interface, and nothing about whether the code inside is correct.

Why it matters

Who it suits. Anyone who publishes a Python package that other people install. Also anyone maintaining a large internal package that several teams import, where a quiet rename causes a support ticket a week later. It suits a release process that already runs checks automatically, because this is one more command. Skip it if the code is an application nobody imports, because then nothing outside it depends on the shape of the interface.

Verdict. The best ten minutes in today's edition, and the reason it is a gem at 696 stars is that most people have never heard of it. Version 2.4.1 was published on 22 October 2026, four days before this edition, under the ISC licence. One command in a release script answers a question that is otherwise answered by a stranger's bug report. The limit to understand: it compares interfaces, so a function that keeps its signature and changes its behaviour passes the check. Pair it with tests, not instead of them. The same author's documentation generator, mkdocstrings/mkdocstrings, uses this underneath, so installing one often brings the other.

Stars696

LicenceISC (named in the About sidebar and on the package index)

Latest2.4.1 (2026-10-22), settled from the package index rather than from GitHub, which shows no releases

Good

• One command reports the breaking changes before anyone else finds them.
• Can compare against a git reference or against a version on the package index.
• Small, fast and released constantly. ISC licence.

Watch for

• Only sees the shape of the interface, so a changed behaviour with an unchanged signature passes.
• Python only.
• At 696 stars the community around it is small, so answers come from the documentation rather than from other people.

Similar repositories

• 
  mkdocstrings/mkdocstrings

  2.1k stars, ISC; the documentation generator built on Griffe, covered in Edition 44. It publishes the interface rather than checking it.

  Track this in Scout
• 
  mitmproxy/pdoc

  2.5k stars; generates Python documentation in one step with no configuration, and does no breaking-change analysis.

  Track this in Scout

Install

python3 -m venv venv
source venv/bin/activate
pip install "griffe[pypi]"
griffe dump mypackage --search src
griffe check mypackage --search src -b main -a HEAD --verbose

⧉

Screenshots

09

twisted/towncrier

💎 hidden gem

912 stars · MIT (named in the About sidebar and on the package index) · 26.9.0 (2026-09-04), settled from the package index; GitHub shows no releases · Track this in Scout · Share this tool

Builds a changelog out of one small file per change, so two people never edit the same line.

▶Repo detailsthe review · specs · pros & cons · install

What it does

Each change gets its own file in a folder, named after the issue number and the kind of change — 123.added.md, 456.fixed.md. The content is one or two sentences written for the person using the software, not for the person who wrote it. At release time towncrier build groups the fragments by kind, writes them into the changelog under the new version heading, and removes the fragments. towncrier create makes a new fragment, and the whole thing is configured from a few lines in pyproject.toml. The project states two things about its own scope: it works best when each merge closes an issue, and although it runs on any project in any language, the convenience of reading the version number automatically only works for Python projects. It does not read your commit history, and that is the design — a commit message is written for other programmers, and a changelog entry is not.

Why it matters

Who it suits. Any project with more than one person merging work and a changelog that somebody actually reads. It suits maintainers who are tired of resolving the same conflict in the same file every week. Skip it if one person writes all the code, because then there is nobody to conflict with and the extra file is overhead.

Verdict. Worth twenty minutes, and the payoff starts on the next merge. Version 26.9.0 was published on 4 September 2026 under the MIT licence, and the project is maintained by the Twisted team, who have used it on their own code for years. The habit it enforces is the real value: writing a sentence for the user at the moment the change is made, rather than inventing twelve of them under pressure on release day. Two honest alternatives are below. nedbat/scriv does the same job with less configuration and fewer users, and python-semantic-release takes the opposite view, deriving the version and the notes from commit messages — which is less work and produces notes written for programmers.

Stars912

LicenceMIT (named in the About sidebar and on the package index)

Latest26.9.0 (2026-09-04), settled from the package index; GitHub shows no releases

Good

• Ends changelog merge conflicts completely, because nobody shares a file.
• Entries get written at the moment the change is made, while the detail is fresh.
• Works on any language, with only the version-reading convenience being Python-specific.

Watch for

• One extra file per change is a habit the whole team has to keep.
• Assumes each change maps to an issue number, which not every project does.
• 912 stars, so the ecosystem of examples is thin compared with commit-based tools.

Similar repositories

• nedbat/scriv

  304 stars, Apache-2.0; the same fragment approach with less configuration, from a single well-known maintainer.

  Track this in Scout
• python-semantic-release/python-semantic-release

  1.0k stars, MIT; derives both the version number and the notes from commit messages, so there is nothing to write by hand and less control over the wording.

  Track this in Scout

Install

python3 -m venv venv
source venv/bin/activate
pip install towncrier
# add a [tool.towncrier] section to pyproject.toml first, then:
towncrier create 123.added.md --content "Pages can now be exported as PDF."
towncrier build --version 1.4.0

⧉

Screenshots

10

sqitchers/sqitch

3200 stars · MIT (named in the About sidebar and on the Perl archive) · v1.6.1 (2026-01-06), settled from metacpan.org; GitHub shows no releases and the page header reads v1.6.2-dev · Track this in Scout · Share this tool

Applies database changes in dependency order, written as plain scripts in each engine's own dialect.

▶Repo detailsthe review · specs · pros & cons · install

What it does

Each change is a script written in the native language of the target database, so a PostgreSQL change is PostgreSQL and an Oracle change is Oracle. A plan file records the changes and what each one depends on, and Sqitch works out the order from those dependencies rather than from numbered file names. The dependency tracking works across separate projects, so one project's change can require another's. Until a project is tagged and released, its deploy scripts can still be edited freely, which is unusual and useful during development. Twelve engines are supported, with stated minimum versions: PostgreSQL 8.4, YugabyteDB 2.6, CockroachDB 21, SQLite 3.8.6, MySQL 5.1, MariaDB 10.0, Oracle 10g, Firebird 2.0, Vertica 7.2, Exasol 6.0, ClickHouse 25.8 and Snowflake. It writes no SQL on anyone's behalf and reads no model definitions: there is no code that turns a class into a table, and that absence is deliberate.

Why it matters

Who it suits. Teams that write SQL by hand and want the ordering problem solved without a framework deciding how the schema is described. It suits anyone running more than one engine, or anyone who has had a numbered migration applied twice. Skip it if your framework already owns the schema, because Django, Rails and Laravel each bring their own system and two systems managing one database is worse than either.

Verdict. Mature, careful software, and the installation is the part to think about. Version 1.6.1 was released on 6 January 2026 and the repository header already shows 1.6.2 in development, so it is maintained. The project is written in Perl, which is why the install differs from everything else in today's list: use the packaged version from your operating system rather than building it. The twelve-engine support is not padding — the same approach works unchanged across them, which is rare. If you want one small binary and a simpler model, amacneil/dbmate and pressly/goose are both excellent and both use numbered migrations instead of dependencies.

Stars3200

LicenceMIT (named in the About sidebar and on the Perl archive)

Latestv1.6.1 (2026-01-06), settled from metacpan.org; GitHub shows no releases and the page header reads v1.6.2-dev

Good

• Changes are plain SQL in the engine's own dialect, with nothing in between.
• Ordering comes from stated dependencies, so files do not need numbering.
• Twelve database engines, with stated minimum versions for each.

Watch for

• Written in Perl, so building it from source pulls in a toolchain most people would rather avoid.
• Conflicts with a framework that already manages migrations.
• 3,200 stars, and the GitHub releases page is empty — the versions are published to the Perl archive instead, which makes the project look quieter than it is.

Similar repositories

• amacneil/dbmate

  7.3k stars, MIT; one small binary and plain SQL migrations, numbered rather than dependency-ordered. Simpler, and less able to express an order.

  Track this in Scout
• pressly/goose

  11.3k stars, MIT; a command-line tool and a Go library, with migrations written either as SQL or as Go functions.

  Track this in Scout

Install

# Debian or Ubuntu
sudo apt-get install sqitch libdbd-pg-perl
# macOS
brew install sqitch
sqitch init myproject --engine pg
sqitch add users -n "Add the users table"
# write the SQL in deploy/users.sql, revert/users.sql and verify/users.sql
sqitch deploy db:pg://localhost/mydb

⧉

Screenshots

11

sqlpage/SQLPage

💎 hidden gem

2600 stars · MIT (named in the About sidebar) · v0.47.0 (2026-10-16), read from /releases/latest as '16 Oct' and dated by the run · Track this in Scout · Share this tool

A single-executable web server that turns SQL query results into real web pages, forms and charts.

▶Repo detailsthe review · specs · pros & cons · install

What it does

You create files ending in .sql. Each file holds queries, and each query names a component — text, list, grid, chart, form, table — in its first column. SQLPage runs the file against the database when someone asks for that address and renders the components in order. Forms post back to another .sql file, which can run an INSERT or an UPDATE, so the pages write as well as read. It ships as one executable with HTTPS and HTTP/2 built in, and it connects to SQLite, PostgreSQL, MySQL, Microsoft SQL Server, and anything reachable through an ODBC driver, which covers ClickHouse, DuckDB, Snowflake and BigQuery. It is a web server and not a database, and not a desktop application either: it connects to a database that already exists somewhere else.

Why it matters

Who it suits. Anyone who knows SQL well and web development barely at all, and needs a page that other people can use. Internal dashboards, data entry screens for a small team, a report a manager can open without asking anyone. It also suits a developer who simply does not want to build a frontend for a tool five people will use. Skip it if the thing being built is a public product with its own design, because the components are deliberately fixed and you will spend longer fighting them than writing the page.

Verdict. The most interesting thing in today's edition, and the one most likely to save a reader a week. Version 0.47.0 was released on 16 October 2026 under the MIT licence, and it is at 2,600 stars, which is far less attention than it deserves. The honest limits are worth stating. Release binaries cover Linux and Windows on Intel and AMD processors and macOS on Apple silicon; an Intel Mac means Homebrew or building from source. ODBC connections need the database's own driver installed separately, so the long list of supported engines is not all equally easy. And the fixed component set is a real ceiling, not a temporary one. Against that, the comparison is instructive: simonw/datasette publishes and explores data, where SQLPage builds an application that writes back.

Stars2600

LicenceMIT (named in the About sidebar)

Latestv0.47.0 (2026-10-16), read from /releases/latest as '16 Oct' and dated by the run

Good

• A working web page from SQL alone. No JavaScript, no build step, no second language.
• One executable, with HTTPS and HTTP/2 included.
• Forms write back to the database, so these are real tools and not just reports.

Watch for

• Fixed components. The look is what it is, and that is a hard limit for anything public-facing.
• No release binary for Intel Macs, so those need Homebrew or a build from source.
• ODBC databases need their own driver installed, which is more work than the supported list suggests.

Similar repositories

• 
  simonw/datasette

  11.4k stars, Apache-2.0; publishes an existing database as a browsable site with an interface for other programs. Read-only, where SQLPage writes.

  Track this in Scout
• 
  evidence-dev/evidence

  7.0k stars, MIT; reports written as SQL inside Markdown, built into a static site. Better-looking output, no forms and no live writes.

  Track this in Scout

Install

mkdir mysite && cd mysite
mkdir sqlpage
echo '{ "database_url": "sqlite://./data.db?mode=rwc" }' > sqlpage/sqlpage.json
printf "select 'text' as component, 'It works.' as contents;\n" > index.sql
./sqlpage

⧉

Screenshots

12

ossf/scorecard

5800 stars · Apache-2.0 (named in the About sidebar) · v5.6.0 (2026-10-12), read from /releases/latest as '12 Oct' and dated by the run · Track this in Scout · Share this tool

Scores a repository out of ten on nineteen measurable security habits, and names the ones it fails.

▶Repo detailsthe review · specs · pros & cons · install

What it does

The default run performs nineteen checks, each scored from zero to ten and each carrying a risk level of critical, high, medium or low. The checks include Branch-Protection, Code-Review, Dangerous-Workflow, Pinned-Dependencies, Signed-Releases, Security-Policy, Token-Permissions, Fuzzing, SAST, Maintained and Vulnerabilities. The overall score is a weighted average, where a critical check counts ten, a high counts 7.5, a medium counts five and a low counts 2.5. It runs as a standalone binary, as a Docker image, as a GitHub Action that posts findings into the repository's security tab, and as a public interface at scorecard.dev with pre-computed scores for many well-known projects. Output is text or JSON. The project says plainly what it is not: the checks are heuristics with both false positives and false negatives, and the total is not a pass mark. A check can also return a question mark when it cannot decide.

Why it matters

Who it suits. Anyone choosing between two libraries that do the same job, and anyone maintaining a project who wants a list of concrete improvements rather than general advice. It suits a team that must answer a supplier questionnaire about the software it depends on. Skip it if you are treating the number as an answer rather than as a prompt, because the project itself says the score is not a requirement.

Verdict. Five minutes well spent, with one habit of mind attached. Version 5.6.0 was released on 12 October 2026 under the Apache-2.0 licence, from the Open Source Security Foundation. Run it on a dependency and read the individual checks rather than the total: "no security policy" and "dependencies not pinned" are specific and actionable, while the average of nineteen numbers is not. Two practical notes. GitHub limits unauthenticated requests, so a token is required — a personal access token with the public_repo scope is enough. The command-line tool officially supports macOS and Linux, and the project says Windows may have problems. For related work from the same foundation, ossf/allstar enforces these habits continuously instead of reporting them once.

Stars5800

LicenceApache-2.0 (named in the About sidebar)

Latestv5.6.0 (2026-10-12), read from /releases/latest as '12 Oct' and dated by the run

Good

• Nineteen specific, checkable habits rather than vague security advice.
• Runs as a binary, a container, a repository action or a lookup on the web.
• Pre-computed scores already exist for many well-known projects, so the first answer takes no setup.

Watch for

• Needs a GitHub token, and some checks need a maintainer's token to see branch settings.
• Heuristics, with false positives and false negatives, which the project states openly.
• Windows support is described as possibly problematic, and the command-line build needs Go.

Similar repositories

• ossf/allstar

  1.5k stars, Apache-2.0; watches an organisation continuously and opens an issue, or corrects the setting, when a policy is broken.

  Track this in Scout
• ossf/cve-bin-tool

  1.8k stars, GPL-3.0; a different question, scanning binaries and component lists for known vulnerabilities rather than judging development habits. The address intel/cve-bin-tool now redirects here.

  Track this in Scout

Install

# create a token with the public_repo scope at github.com/settings/tokens
export GITHUB_AUTH_TOKEN=your_token_here
docker run -e GITHUB_AUTH_TOKEN \
  ghcr.io/ossf/scorecard:stable \
  --repo=github.com/pdfminer/pdfminer.six

⧉

Screenshots