open-source

SQLite 3.52.0, expected to release around March 11, 2026, will add ALTER TABLE support for NOT NULL and CHECK constraints, a new Query Result Formatter for the CLI, two new JSON array functions, and query planner improvements.

Linus Torvalds confirms the next kernel will be 7.0, citing confusion over large numbers, as the first RC ships with one of the largest merge windows on record.

Deno 2.7 ships stable Temporal date/time API, official Windows ARM builds, npm overrides, and over 40 Node.js compatibility fixes in its February 25 release.

Git 2.53 defaults Rust support in both build systems and unlocks geometric repacking for partial clones, setting the stage for a Git 3.0 release by late 2026.

Node.js published versions 25.6.0, 25.6.1, and 25.7.0 across February 2026, advancing built-in SQLite to release-candidate status, extending Single Executable Applications to ESM entry points, and adding SIMD-accelerated text encoding.

A RedMonk study of 32 organizations reveals a fragmented policy landscape as projects from cURL to the Linux kernel draw competing lines on AI code.

The community-maintained Ingress NGINX controller goes read-only in March 2026. With no future security patches and four new CVEs disclosed in February, organizations running roughly half of all Kubernetes ingress traffic must now choose between Gateway API and alternative controllers.

PostgreSQL 18.3, 17.9, 16.13, 15.17, and 14.22 fix regressions introduced when patching five CVEs, including a broken substring() function on non-ASCII text and standby servers halting mid-replication.

A community revolt over commit drought, staff cuts, and opaque development is forcing Oracle to rethink its stewardship of the world's most deployed open source database.

A new 501(c)(3) nonprofit modeled on university endowments aims to generate sustainable returns for critical open source projects, backed by the founders of HashiCorp, cURL, and Vue.js.

A security researcher's disclosure of a prompt injection flaw in Cline's AI-powered GitHub issue bot was weaponized eight days later to steal npm publish tokens and install unauthorized software on developer machines.

From cURL killing its bug bounty to Godot maintainers burning out, the flood of low-quality AI-generated pull requests and security reports is forcing open source communities to fundamentally rethink how contributions are accepted.