News

Open Source Daily Briefing

GitHub's Octoverse 2026 says agents now start 40% of pull requests, Home Assistant absorbs HACS as its official Marketplace, an r/opensource moderator rule change splits the community, Charm sunsets Soft Serve, and more.

GitHub’s annual Octoverse puts hard numbers on how much agents are reshaping open source. Meanwhile the human side is in flux: a fight over moderation on one of open source’s biggest forums, a beloved community project moving under its platform’s own roof, and a company quietly archiving a popular tool. Here’s what matters.

Octoverse 2026: agents now start more than 40% of pull requests on GitHub

GitHub released its annual Octoverse report on October 28 at GitHub Universe in San Francisco. The headline: agents started more than 40% of pull requests in September 2026, up from 17% in March. That’s about 110 million agent-initiated PRs in a single month. Pushes hit 17.9 billion over the year, which is more than 2024 and 2025 combined. Public contributions reached 2.5 billion, more than double last year’s 1.12 billion. GitHub now counts 225 million+ developers. India (32.0M) is closing on the US (38.3M), and Rust doubled its contributor base, the fastest growth among top languages. As Simon Willison notes, merged PRs and commits roughly tripled in under a year. The report says nothing about the review burden that volume puts on maintainers, though. Read “2.5 billion public contributions” as more work landing on human reviewers, not just as a sign of a healthy ecosystem. If you maintain a project, now is the time to write down your policy on agent-generated contributions, if you haven’t already.

HACS becomes the official Home Assistant Marketplace

Home Assistant lead Franck Nijhof (Frenck) announced that HACS, the Home Assistant Community Store, will ship built into Home Assistant 2026.11 next month, renamed “Marketplace.” Joakim Sørensen (ludeeus) founded HACS as a side project and donated it to the Open Home Foundation about 18 months ago. He’s expected to stay involved. Existing HACS installs migrate automatically. After the upgrade, Home Assistant blocks standalone HACS installs, and the old project gets no new releases. Integration authors don’t need to change anything for now. Users get a mandatory first-run warning that community code runs with full system access and isn’t tested or supported by the core project. It’s a good example of a single-maintainer community project finding a durable home. But the announcement describes no review or vetting process for Marketplace content, so official placement may make that content look more trustworthy than it is. Home Assistant is also running a “What the Heck?!” feedback month in November, if you want to weigh in.

r/opensource moderator’s AI crackdown splits the community, and a co-moderator steps down

The lead moderator of Reddit’s r/opensource rolled out sweeping new rules without discussing them with the other mods. Projects must now be at least a year old, have three or more contributors, and use an OSI license. Posts that obviously use AI are banned, with permanent bans for violations. Non-English speakers were told to find another community, because AI translation can’t be told apart from AI-written text. Dan Brown (ssddanbrown), the BookStack developer and the sub’s second moderator, has written up what happened. He removed himself as a moderator, citing the stress, the brigading, and an “AI-versus-anti-AI culture war.” He also declined Reddit’s offer to make him top mod. The frustration with vibe-coded spam is real, and it’s the same pressure pushing projects to restrict drive-by AI PRs. But a rule that effectively shuts out people who don’t speak English shows how easily anti-slop measures can turn exclusionary. Alternative subreddits have already appeared, and Dan Brown is considering Lemmy.

Charm sunsets Soft Serve, its self-hosted Git server

Charm archived Soft Serve, its popular SSH-first, terminal-native Git server, on October 26. The README now reads “we’ve sunset Soft Serve” and warns that “no further security updates will be applied.” No successor is named, and anyone who wants to maintain a fork is invited to. The timing caught the self-hosting crowd’s attention: it came days after the PocketBase developer launched BugStage, a web-based Git server for solo maintainers. This is the usual risk when a company backs a project, even under a permissive license: the code stays open, but maintenance stops when priorities change. If you run Soft Serve, plan a migration (Forgejo, Gitea, or plain git-over-SSH), or join the effort to set up a credible community fork. Don’t keep running an internet-facing Git server that no longer gets security fixes.

Debian asks a hard question about an LLM-assisted browser: can you license what you didn’t author?

Andreas Røsdal has been pushing his Nordstjernen/Northstar web browser (a from-scratch browser, not based on Firefox or Chrome) into Linux distributions. An Arch PKGBUILD was merged on October 25, and a Debian package was uploaded to mentors.debian.net. On debian-devel, Andrei Ionuţ Ştefan raised a question that every distribution will soon have to answer. If a large share of the code is LLM-generated, does a GPL COPYING file mean anything? Has anyone scanned the code for verbatim reproduction of training data with tools like ScanCode or FOSSology? The matter has been referred to Debian Legal. LWN’s coverage also points to concerns about the project’s development and security practices. To be fair to the project, its wiki now says development is AI-free from October 2026 onward. Whatever Debian decides here will likely set an early precedent for how distributions vet the provenance of AI-assisted code.

Stalwart hits 1.0, and claims it beats Postfix and Dovecot

The Rust-based all-in-one mail server Stalwart shipped its first stable release on October 26. With 1.0, the database schema is final, so future releases are meant to upgrade in place. Upgrading from v0.16 still requires a migration, and clusters now need a Redis-based in-memory store. New in this release: a rewritten full-text search engine that also indexes PDF and Office attachments, JMAP and IMAP metadata, OIDC improvements, SSRF protection, and post-quantum DKIM2 signatures using composite ML-DSA-44 plus Ed25519. The team’s benchmarks claim Stalwart beat Postfix 3.11 and Dovecot 2.4 in 35 of 38 tests, for example 5,445 incoming messages per second versus Postfix’s 723. The team ran those tests itself, though it did publish the scripts and raw data. Note the open-core split: the AI spam classifier is Enterprise-only. Self-hosted email is still a hard sell, but a stable, single-binary JMAP server is a real alternative to the decades-old Postfix and Dovecot stack.

Tor Browser 16.0 adds Linux ARM64 and drops 32-bit x86 Linux

The Tor Project released Tor Browser 16.0 on October 29. It’s rebased on Firefox ESR 153 and now officially supports 64-bit ARM Linux in the stable channel, which covers Raspberry Pi boards and Apple Silicon Macs running Linux. Following Mozilla, it drops 32-bit x86 Linux. Settings have been reorganized, with risky options hidden or flagged with warnings. A new opt-in setting hides page titles from window headers so other local apps can’t read what you’re browsing. Tails 7.16 followed today with the new browser. If you deploy Tor Browser on ARM hardware, you can stop relying on unofficial builds.

Quick hits