Syft : Un outil CLI et une bibliothèque Go pour générer inventaire des composants logiciels à partir d'images de conteneurs et de systèmes de fichiers.
👉 anchore/syft
Automated Artifact Promotion Pipeline from Dev to Prod
Manual promotions, rebuild-driven releases, and scattered binaries produce familiar symptoms: inconsistent test vs prod behavior, long release lead times, and audits that point to missing evidence. The worst cases show teams rebuilding the same commit multiple times and losing confidence in which binary actually shipped; the result is firefighting that costs time and customer trust.
Contents
- [Why promote artifacts instead of rebuilding for reliability and traceability]
- [Designing repository tiers and the promotion flow]
- [Automating promotion with CI/CD and quality gates]
- [Rollback, audit trails, and provenance for safe recovery and traceability]
- [Practical Application: checklists and step-by-step promotion protocol]
- [Sources]
Why promote artifacts instead of rebuilding for reliability and traceability
Promoting artifacts is not dogma — it solves concrete problems that rebuilding cannot reliably eliminate. A build that passed unit, integration, and security tests at 10:02 UTC must be the exact object that reaches production; rebuilding the same commit later often pulls in different transient inputs (base image tags, mirror responses, cached dependencies) and produces bitwise-different outputs. SLSA defines provenance as the verifiable metadata that ties a produced artifact to the builder, invocation, and materials used to produce it; keeping that artifact as the single source of truth preserves that chain.
A promoted artifact serves as a birth certificate: the SHA checksum, the SLSA/in-toto predicate or attestation, the SBOM, test results, and the CI build-id travel with the artifact from dev to prod. That makes audits precise and rollbacks trivial (deploy this exact digest). Vendors and repositories already provide first-class promotion workflows so that promotions attach metadata and preserve integrity rather than relying on fragile rebuild heuristics.
Practical corollary: use a strong digest algorithm (SHA-256 or better) when you record artifact identity, and store that digest as searchable metadata in your repository and deployment manifests. NIST guidance on secure software practices reinforces provenance and artifact-level controls as part of a defendable delivery process.
Designing repository tiers and the promotion flow
The repository layout is the scaffolding of your promotion pipeline. Keep the design simple, enforceable, and aligned with teams’ workflows.
Example minimal tiering pattern
| Tier | Purpose | Mutability | Retention / lifecycle | Typical consumers |
|---|---:|---|---|---|
| dev | Immediate CI output, fast uploads | Mutable, auto-clean | Short retention or capped per-project (e.g., keep last 30 builds) | Developers, CI jobs |
| staging | QA/Integration testing and security validation | Semi-immutable (copy-on-promote) | Medium retention, signed promotions | QA, release engineering |
| prod | Immutable production artifacts | Immutable; signed + retention policy | Long-term archival; legal/compliance retention | Runtime envs, ops |
Common implementation patterns and their trade-offs
| Promotion method | How it works | Pros | Cons |
|---|---|---|---|
| Copy-on-promote (recommended) | Copy artifact blobs from dev repo → staging/prod and attach promotion metadata | Preserves source object, keeps original dev builds intact, easy audit trail. | Requires storage for duplicate blobs unless deduping by repo manager. |
| Move-on-promote | Physically move artifact between repos | Saves storage, simpler final state | Loses quick access to original dev repository; more risk if promotion was accidental |
| Release bundles / signed collections | Group artifacts into a signed bundle that is promoted as a unit | Stronger release-level traceability and signing; supports multi-artifact releases | Additional operational complexity; requires repository features (e.g., RLM) |
Repository design specifics that make promotion reliable
- Use separate credentials and ACLs per tier: developers push to dev, QA and automated gates control staging, only CI/CD with approval can promote to prod.
- Enforce immutability for production-tier objects (object write-once, read-many), with signed attestation and no destructive deletes except via controlled retention policies.
- Provide virtual or aggregated read-repos for consumers so deployments can resolve a single logical repository (e.g., myorg-release) that maps to prod when promoted.
- Record and index metadata: build.name, build.number, commit_sha, sha256, sbom_path, attestation_id. The repository’s build-info object should be the canonical link between CI build and binary.
Automating promotion with CI/CD and quality gates
Automation is the enforcement plane for your promotion rules — tests and scans must run in CI, attestations must be generated, and only then must the pipeline perform a promotion action.
A compact promotion flow (pipeline stages)
1. Build: compile, run unit tests; record build-info (build.name, build.number, commit, artifact digests) and upload artifacts to dev repo.
2. Static verification: run SBOM generation and vulnerability scans (syft, grype/trivy), run license checks. Sign the SBOM/attestation.
3. Integration and regression: run integration suites, performance smoke checks, canary smoke runs (optional).
4. Quality gate evaluation: evaluate scan results and test pass/fail; quality gate enforces policy e.g., block promotion on critical CVEs or failed required tests.
5. Attest and sign: produce an in-toto / SLSA-compatible provenance attestation and sign with cosign (or equivalent) and store the attestation alongside the artifact.
6. Promote: call repository promotion APIs (jf rt bpr, Nexus staging/release, Harbor copy/replicate, or equivalent) to move/copy artifact to staging or prod.
7. Deploy: runtime systems pull by digest (image@sha256:...) or release bundle reference.
Concrete examples and commands
- Generate an SBOM and scan:
# Generate SBOM (Syft)
syft myorg/my-app:${GITHUB_SHA} -o spdx-json=sbom.spdx.json
# Scan (Grype) using SBOM for speed
grype sbom:sbom.spdx.json -o json > grype-report.json
- Sign an OCI image or a blob with cosign (keyless or key-backed):
# Keyless (recommended for CI with OIDC)
cosign sign myregistry/my-app@sha256:${IMAGE_DIGEST}
# With private key
cosign sign --key cosign.key myregistry/my-app@sha256:${IMAGE_DIGEST}
- Promote a build in Artifactory (example):
# Promote build number 125 to staging-local, keep the original build in dev
jf rt bpr my-app 125 staging-local --status="QA-Approved" --comment="Auto-promoted" --copy=true
Quality gates: enforce as code
- Gate evaluation must be scriptable. A simple gate (example) rejects promotion if any severity == "Critical" is present in the scanner JSON:
critical_count=$(jq '[.matches[].vulnerability.severity | select(.=="Critical")] | length' grype-report.json)
test $critical_count -eq 0 || (echo "Critical vulns found — aborting promotion" && exit 1)
Use ephemeral CI credentials and workload federation
- Tokenless or short-lived credentials (OIDC) reduce risk of long-lived secrets in CI. GitHub Actions, GitLab, and major clouds support OIDC flows that allow CI jobs to mint temporary credentials for artifact pushes or signing operations.
> Important: Automating promotion without attestations is only automation — not security. Attach SLSA/in-toto attestations and cryptographic signatures as part of the promotion workflow to make machine-verified checks possible downstream.
Rollback, audit trails, and provenance for safe recovery and traceability
Rollback mechanics should be a non-event because your pipeline promoted immutable artifacts with complete metadata.
Rollback patterns
- Redeploy by digest: store the deployed image or artifact digest in your release record and use that digest to roll back. Kubernetes deploy manifests should pin images by digest: image: myregistry/my-app@sha256:<digest>.
# Example Kubernetes quick rollback by setting deployment image to previous digest
kubectl set image deployment/myapp myapp=myregistry/my-app@sha256:<previous-digest> --record
- Re-promote prior Release Bundle: if you used a Release Bundle or signed collection to promote to prod, re-publish that bundle to a "rollback" or "canary" environment and redeploy from it.
- Blue/Green or Canary: use promoted artifacts to run a safe parallel rollout; if errors occur, switch traffic back to the previous promoted digest.
Audit trails and traceability
- The repository's build-info or release bundle records are the canonical audit records: build id, commit, artifact digests, test reports, scanner outputs, attestation IDs, promoting user or CI job, and timestamps. Record these in an immutable audit store or archive the repository’s promotion metadata.
- Store SBOM and attestations next to the artifact in the repository or in an attestation store (OCI registries support in-toto attestation blobs attached to images; Docker/OCI attestations are supported in registry specs).
- Map audit records to operational incidents: when a vulnerability is discovered, query artifact provenance to find all downstream consumers and determine impact quickly.
Provenance and verification
- Use SLSA/in-toto predicates for build provenance and verification summary attestations so downstream consumers (operators, auditors, supply-chain scanners) can automate trust checks and enforcement.
- Verification tools (cosign, in-toto verification tooling) should be part of promotion pipelines and pre-deployment admission controllers.
Practical Application: checklists and step-by-step promotion protocol
The following protocol assumes a build produces one canonical artifact (container image or archive), an SBOM, and an attestation; the repository supports signed promotions or copy-on-promote.
Checklist — repository and policy essentials
- [ ] Dev repo exists and allows CI uploads only.
- [ ] Staging repo is semi-immutable and accessible to QA.
- [ ] Prod repo is immutable, requires approval/CI token to promote.
- [ ] Retention policies configured: auto-prune old dev artifacts, retain prod artifacts per compliance.
- [ ] Repository collects build-info and indexes sha256, commit, sbom, attestation.
- [ ] Signing tooling available: cosign + key management or keyless OIDC flows.
- [ ] SBOM and scanner in CI: syft + grype/trivy.
- [ ] Quality gate policy codified (e.g., no Critical or high CVEs, integration tests pass).
- [ ] Promotion API automation tested end-to-end.
Step-by-step promotion protocol (executable)
1. Build and upload
# GitHub Actions excerpt (condensed)
permissions:
id-token: write # allow OIDC where needed
contents: read
jobs:
build:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- name: Build image
run: |
docker build -t $REGISTRY/my-app:${GITHUB_SHA} .
- name: Push image to dev repo
run: docker push $REGISTRY/my-app:${GITHUB_SHA}
- name: Publish build-info (example: jfrog)
run: |
jf rt upload "target/*.jar" "libs-dev-local/my-app/${GITHUB_RUN_NUMBER}/"
jf rt bp my-app ${GITHUB_RUN_NUMBER}
2. Generate SBOM and scan
syft $REGISTRY/my-app:${GITHUB_SHA} -o spdx-json=sbom.spdx.json
grype sbom:sbom.spdx.json -o json > grype-report.json
3. Evaluate quality gate (example policy)
critical_count=$(jq '[.matches[] | select(.vulnerability.severity=="Critical")] | length' grype-report.json)
if [ "$critical_count" -ne 0 ]; then
echo "Promotion blocked: critical vulnerabilities present"
exit 1
fi
4. Produce provenance and sign
# Produce a simple in-toto/SLSA-style attestation (tooling-specific)
cosign attest --predicate sbom.spdx.json --type sbom $REGISTRY/my-app:${GITHUB_SHA}
cosign sign $REGISTRY/my-app:${GITHUB_SHA}
5. Promote build
# Example: promote by build-info using JFrog CLI
jf rt bpr my-app ${GITHUB_RUN_NUMBER} libs-staging-local \
--status="QA-Approved" \
--comment="Passed tests & scans" \
--copy=true
6. Record the release record
- Persist a release record (DB or ticket) with keys: artifact_digest, build_number, commit_sha, attestation_id, sbom_path, promoted_by, timestamp.
Metrics to instrument (baseline formulas)
- Provenance coverage = artifacts_in_prod_with_slsa_provenance / total_artifacts_in_prod. Track weekly; target > 95%.
- Promotion lead time = median(time from build completion → promotion to staging). Monitor for regressions.
- Blocked promotions = count(promotions_failed_quality_gate) per release window.
- Storage growth rate = delta(storage_used) / month; enforce retention thresholds to control costs.
- Rollback frequency = count(rollback events) / month; high frequency indicates release quality issues.
Governance checklist (operationalizing promotion)
- Require signed attestations for production promotions.
- Define role-based approvals for promotions (who can trigger staging → prod).
- Automate evidence collection for audits: store promotion metadata and scanner output in an immutable store.
- Periodically test rollback playbooks and restore-from-artifact drills.
Sources
SLSA — Provenance - SLSA specification and the provenance model used to link build outputs to source, builder, and invocation data; used to justify preserving provenance during promotion.
Sigstore — Cosign Quickstart - Cosign quickstart and attestation signing/verification details; used for signing and attestation examples.
JFrog — How Does Build Promotion Work - Official Artifactory description of build promotion, metadata, and release bundle concepts; used for promotion command examples and design patterns.
Anchore Syft (SBOM generation) - Tool documentation for generating SBOMs; used for SBOM generation step examples.
Anchore Grype (vulnerability scanning) - Vulnerability scanner docs supporting SBOM-based scanning and automation examples.
NIST SP 800-218 — Secure Software Development Framework (SSDF) - NIST guidance on secure software development, provenance, and supply-chain artifacts; used to support governance and compliance guidance.
GitHub Actions — OpenID Connect reference - Documentation for OIDC integration in CI to obtain short-lived credentials; used to justify OIDC usage in CI.
The Ultimate Developer Stack: 23 Trending GitHub Repos | 28-10-2026 | Dev Repos Daily
cutt.ly
🔥 Nobody Told You About This New AI Repo (Summer2027-Internships)
Stay on top of the open source ecosystem with this handpicked selection of trending GitHub repositories. From innovative developer tools to groundbreaking frameworks, these are the projects making waves in the software community right now.
October 28, 2026
What is inside this video:
- Top 23 trending GitHub repositories ranked by stars gained today
- Developer insights and project overviews for every featured repo
- AI-narrated walkthrough of each open source project
- Direct links to all repositories below for easy access
⏱️ TIMESTAMPS (YouTube Chapters):
00:00 - Intro: Today's High-Impact Tools
00:09 - Trending Leaderboard Overview
00:25 - #1 Summer2027-Internships
00:54 - #2 n8n
01:24 - #3 datahub
01:45 - #4 upscayl
02:08 - #5 free-for-dev
02:33 - #6 awesome-remote-job
02:59 - #7 Data-Science-For-Beginners
03:27 - #8 PowerToys
03:50 - #9 neovim
04:10 - #10 jellyfin
04:33 - #11 llama_index
04:56 - #12 syft
05:18 - #13 playwright
05:46 - #14 plane
06:09 - #15 pgvector
06:28 - #16 awesome
06:59 - #17 runner-images
07:19 - #18 rustdesk
07:43 - #19 lazygit
08:05 - #20 transformers
08:31 - #21 directus
09:02 - #22 gitleaks
09:22 - #23 OpenCore-Legacy-Patcher
09:45 - Outro & Key Takeaways
━━━━━━━━━━━━━━━━━━━━━━━
TODAY'S TOP 23 TRENDING REPOSITORIES:
━━━━━━━━━━━━━━━━━━━━━━━
#1 SimplifyJobs/Summer2027-Internships (⭐ 48.2k • +21 today • Python)
Summer 2027 software engineering, data science, AI, quant, product management, and hardware internship postings. Updated daily by Simplify and Pitt CSC.
🔗 SimplifyJobs/Summer2027-Internships
#2 n8n-io/n8n (⭐ 208.9k • +161 today • TypeScript)
Fair-code workflow automation platform with native AI capabilities. Combine visual building with custom code, self-host or cloud, 400+ integrations.
🔗 n8n-io/n8n
#3 datahub-project/datahub (⭐ 12.9k • +10 today • Python)
The Context Platform for your Data and AI Stack
🔗 datahub-project/datahub
#4 upscayl/upscayl (⭐ 51.2k • +76 today • TypeScript)
🆙 Upscayl - #1 Free and Open Source AI Image Upscaler for Linux, MacOS and Windows.
🔗 upscayl/upscayl
#5 ripienaar/free-for-dev (⭐ 140.2k • +55 today • HTML)
A list of SaaS, PaaS and IaaS offerings that have free tiers of interest to devops and infradev
🔗 ripienaar/free-for-dev
#6 lukasz-madon/awesome-remote-job (⭐ 50k • +99 today • Unknown)
A curated list of awesome remote jobs and resources. Inspired by vinta/awesome-python
🔗 lukasz-madon/awesome-remote-job
#7 microsoft/Data-Science-For-Beginners (⭐ 37.8k • +47 today • Jupyter Notebook)
10 Weeks, 20 Lessons, Data Science for All!
🔗 microsoft/Data-Science-For-Beginners
#8 microsoft/PowerToys (⭐ 140.1k • +84 today • C)
Microsoft PowerToys is a collection of utilities that supercharge productivity and customization on Windows
🔗 microsoft/PowerToys
#9 neovim/neovim (⭐ 103.2k • +41 today • Vim Script)
Vim-fork focused on extensibility and usability
🔗 neovim/neovim
#10 jellyfin/jellyfin (⭐ 58.7k • +74 today • C#)
The Free Software Media System - Server Backend & API
🔗 jellyfin/jellyfin
#11 run-llama/llama_index (⭐ 52.7k • +23 today • Python)
LlamaIndex is the document processing platform for AI
🔗 run-llama/llama_index
#12 anchore/syft (⭐ 9.8k • +14 today • Go)
CLI tool and library for generating a Software Bill of Materials from container images and filesystems
🔗 anchore/syft
#13 microsoft/playwright (⭐ 98.7k • +90 today • TypeScript)
Playwright is a framework for Web Testing and Automation. It allows testing Chromium, Firefox and WebKit with a single API.
🔗 microsoft/playwright
#14 makeplane/plane (⭐ 61.6k • +64 today • TypeScript)
🔥🔥🔥 Open-source Jira, Linear, Monday, and ClickUp alternative. Plane is a modern project management platform to manage tasks, sprints, docs, and triage.
🔗 makeplane/plane
#15 pgvector/pgvector (⭐ 23.5k • +17 today • C)
Open-source vector similarity search for Postgres
🔗 pgvector/pgvector
━━━━━━━━━━━━━━━━━━━━━━━
Subscribe to @devrepos for daily GitHub trending repositories, open source roundups, and developer news.
New videos every day covering the best open source software and trending projects on GitHub.
[ar] أفضل حزمة أدوات للمطورين: 23 مستودعاً رائجاً على GitHub | 28-10-2026 | مستودعات المطورين اليومية
cutt.ly
🔥 لم يخبرك أحد عن هذا المستودع الجديد للذكاء الاصطناعي (تدريب صيفي 2027)
ابقَ على اطلاع دائم بأحدث التطورات في عالم البرمجيات مفتوحة المصدر مع هذه المجموعة المختارة بعناية من مستودعات GitHub الرائجة. من أدوات تطوير مبتكرة إلى أطر عمل رائدة، هذه هي المشاريع التي تُحدث ضجة في مجتمع البرمجيات حاليًا.
... ٢٨ أكتوبر ٢٠٢٦
محتوى هذا الفيديو:
- أفضل ٢٣ مستودعًا رائجًا على GitHub، مُرتبة حسب عدد النجوم المكتسبة اليوم
- رؤى المطورين ونظرة عامة على المشاريع لكل مستودع مميز
- شرح صوتي مُعزز بالذكاء الاصطناعي لكل مشروع مفتوح المصدر
- روابط مباشرة لجميع المستودعات أدناه لسهولة الوصول
⏱️ الفواصل الزمنية (فصول يوتيوب):
٠٠:٠٠ - مقدمة: أدوات اليوم الأكثر تأثيرًا
٠٠:٠٩ - نظرة عامة على قائمة المتصدرين الرائجة
٠٠:٢٥ - #١ تدريب صيفي ٢٠٢٧
٠٠:٥٤ - #٢ n8n
٠١:٢٤ - #٣ datahub
٠١:٤٥ - #٤ upscayl
٠٢:٠٨ - #٥ free-for-dev
٠٢:٣٣ - #٦ awesome-remote-job
٠٢:٥٩ - #٧ علوم البيانات للمبتدئين
٠٣:٢٧ - #٨ باور تويز
03:50 - #9 نيوفيم
04:10 - #10 جيلي فين
04:33 - #11 لاما إندكس
04:56 - #12 سيفت
05:18 - #13 بلاي رايت
05:46 - #14 بلين
06:09 - #15 بي جي فيكتور
06:28 - #16 أوسوم
06:59 - #17 رانر إيمجز
07:19 - #18 رست ديسك
07:43 - #19 ليزي جيت
08:05 - #20 ترانسفورمرز
08:31 - #21 دايركت توس
09:02 - #22 جيت ليكس
09:22 - #23 أوبن كور ليجاسي باتشر
09:45 - الخاتمة والمفتاح أهم النقاط
━━━━━━━━━━━━━━━━━━━━━━━━
أفضل 23 موقعًا رائجًا اليوم:
━━━━━━━━━━━━━━━━━━━━━━━
#1 SimplifyJobs/Summer2027-Internships (⭐ 48.2 ألف • +21 اليوم • بايثون)
فرص تدريب صيفية لعام 2027 في هندسة البرمجيات، وعلوم البيانات، والذكاء الاصطناعي، والتحليل الكمي، وإدارة المنتجات، والأجهزة. يتم تحديثها يوميًا بواسطة Simplify و Pitt CSC. 🔗 SimplifyJobs/Summer2027-Internships
#2 n8n-io/n8n (⭐ 208.9 ألف • +161 اليوم • TypeScript) منصة أتمتة سير العمل البرمجية العادلة مع إمكانيات ذكاء اصطناعي مدمجة. اجمع بين البناء المرئي والبرمجة المخصصة، مع إمكانية الاستضافة الذاتية أو السحابية، وأكثر من 400 تكامل.
منصة أتمتة سير العمل البرمجية العادلة مع إمكانيات الذكاء الاصطناعي المدمجة. 🔗 n8n-io/n8n
#3 datahub-project/datahub (⭐ 12.9 ألف • +10 اليوم • بايثون)
منصة السياق لبياناتك وتقنيات الذكاء الاصطناعي
🔗 datahub-project/datahub
#4 upscayl/upscayl (⭐ 51.2 ألف • +76 اليوم • تايب سكريبت)
🆙 Upscayl - برنامج مجاني ومفتوح المصدر لتحسين جودة الصور بتقنية الذكاء الاصطناعي، يعمل على أنظمة لينكس وماك أو إس وويندوز.
...
#3 🔗 upscayl/upscayl
#5 ripienaar/free-for-dev (⭐ 140.2 ألف • +55 اليوم • HTML)
قائمة بعروض SaaS وPaaS وIaaS التي تتضمن مستويات مجانية تهم مطوري DevOps وInfradev
🔗 ripienaar/free-for-dev
#6 lukasz-madon/awesome-remote-job (⭐ 50 ألف • +99 اليوم • غير معروف)
قائمة منتقاة من أفضل الوظائف والموارد عن بُعد. مستوحى من vinta/awesome-python
🔗 lukasz-madon/awesome-remote-job
#7 مايكروسوفت/علوم البيانات للمبتدئين (⭐ 37.8 ألف • +47 اليوم • Jupyter Notebook)
10 أسابيع، 20 درسًا، علوم البيانات للجميع!
#7 🔗 microsoft/Data-Science-For-Beginners
#8 microsoft/PowerToys (⭐ 140.1 ألف • +84 اليوم • C)
مجموعة أدوات Microsoft PowerToys تُعزز الإنتاجية وتُتيح تخصيص نظام Windows.
🔗 microsoft/PowerToys
#9 neovim/neovim (⭐ 103.2 ألف • +41 اليوم • سكربت Vim)
نسخة مُعدّلة من Vim تُركز على قابلية التوسع وسهولة الاستخدام.
🔗 neovim/neovim
#10 jellyfin/jellyfin (⭐ 58.7 ألف • +74 اليوم • C#)
نظام الوسائط البرمجية الحرة - خادم خلفي وواجهة برمجة تطبيقات (API)
🔗 jellyfin/jellyfin
#11 run-llama/llama_index (⭐ ٥٢٫٧ ألف • +٢٣ اليوم • بايثون)
LlamaIndex هي منصة معالجة المستندات للذكاء الاصطناعي
🔗 run-llama/llama_index
#١٢ anchore/syft (⭐ ٩٫٨ ألف • +١٤ اليوم • جو)
أداة سطر أوامر ومكتبة لإنشاء قائمة مكونات برمجية من صور الحاويات وأنظمة الملفات
🔗 anchore/syft
#١٣ microsoft/playwright (⭐ ٩٨٫٧ ألف • +٩٠ اليوم • تايب سكريبت)
Playwright هو إطار عمل لاختبار وأتمتة الويب. يتيح اختبار Chromium وFirefox وWebKit باستخدام واجهة برمجة تطبيقات واحدة.
#١٣ microsoft/playwright (⭐ ٩٨٫٧ ألف • +٩٠ اليوم • تايب سكريبت)
Playwright هو إطار عمل لاختبار وأتمتة الويب. يتيح اختبار Chromium وFirefox وWebKit باستخدام واجهة برمجة تطبيقات واحدة. 🔗 microsoft/playwright
#14 makeplane/plane (⭐ 61.6 ألف • +64 اليوم • TypeScript)
🔥🔥🔥 بديل مفتوح المصدر لـ Jira وLinear وMonday وClickUp. Plane منصة حديثة لإدارة المشاريع، تُتيح إدارة المهام، والسباقات، والوثائق، وفرز المهام.
Plane 🔗 makeplane/plane
#15 pgvector/pgvector (⭐ 23.5 ألف • +17 اليوم • C)
بحث مفتوح المصدر عن تشابه المتجهات لـ Postgres
🔗 pgvector/pgvector
━━━━━━━━━━━━━━━━━━━━━━━
اشترك في @devrepos للاطلاع على أحدث مستودعات GitHub الرائجة، وملخصات المشاريع مفتوحة المصدر، وأخبار المطورين.
فيديوهات جديدة يوميًا تغطي أفضل برامج المصادر المفتوحة والمشاريع الرائجة على GitHub.
[bn] ডেভেলপারদের জন্য সেরা কালেকশন: ২৩টি ট্রেন্ডিং গিটহাব রিপোজিটরি | ২৮-১০-২০২৬ | ডেভ রিপোস ডেইলি
cutt.ly
🔥 এই নতুন এআই রিপোটির কথা আপনাকে কেউ বলেনি (সামার ২০২৭-ইন্টার্নশিপ)
ট্রেন্ডিং গিটহাব রিপোজিটরিগুলোর এই বিশেষভাবে নির্বাচিত সংগ্রহের মাধ্যমে ওপেন সোর্স ইকোসিস্টেমের সাথে আপ-টু-ডেট থাকুন। উদ্ভাবনী ডেভেলপার টুলস থেকে শুরু করে যুগান্তকারী ফ্রেমওয়ার্ক পর্যন্ত, এই প্রজেক্টগুলোই এখন সফটওয়্যার কমিউনিটিতে আলোড়ন সৃষ্টি করছে।
২৮শে অক্টোবর, ২০২৬
এই ভিডিওতে যা আছে:
আজ অর্জিত স্টারের ভিত্তিতে র্যাঙ্ক করা শীর্ষ ২৩টি ট্রেন্ডিং গিটহাব রিপোজিটরি
- প্রতিটি ফিচার করা রিপোর জন্য ডেভেলপারদের মতামত এবং প্রজেক্টের সংক্ষিপ্ত বিবরণ
- প্রতিটি ওপেন সোর্স প্রজেক্টের AI-বর্ণিত ওয়াকথ্রু
- সহজে অ্যাক্সেসের জন্য নিচে সমস্ত রিপোজিটরির সরাসরি লিঙ্ক
⏱️ টাইমস্ট্যাম্প (ইউটিউব চ্যাপ্টার):
০০:০০ - ভূমিকা: আজকের হাই-ইমপ্যাক্ট টুলস
০০:০৯ - ট্রেন্ডিং লিডারবোর্ডের সংক্ষিপ্ত বিবরণ
০০:২৫ - #১ Summer2027-Internships
০০:৫৪ - #২ n8n
০১:২৪ - #৩ datahub
০১:৪৫ - #৪ upscayl
০২:০৮ - #৫ free-for-dev
০২:৩৩ - #৬ awesome-remote-job
০২:৫৯ - #৭ Data-Science-For-Beginners
০৩:২৭ - #৮ পাওয়ারটয়েজ
০৩:৫০ - #৯ নিওভিম
০৪:১০ - #১০ জেলিফিন
০৪:৩৩ - #১১ লামা_ইনডেক্স
০৪:৫৬ - #১২ সাইফট
০৫:১৮ - #১৩ প্লেরাইট
০৫:৪৬ - #১৪ প্লেন
০৬:০৯ - #১৫ পিজিভেক্টর
০৬:২৮ - #১৬ অসাম
০৬:৫৯ - #১৭ রানার-ইমেজেস
০৭:১৯ - #১৮ রাস্টডেস্ক
০৭:৪৩ - #১৯ লেজিগিট
০৮:০৫ - #২০ ট্রান্সফর্মার্স
০৮:৩১ - #২১ ডিরেক্টাস
০৯:০২ - #২২ গিটলিকস
০৯:২২ - #২৩ ওপেনকোর-লেগ্যাসি-প্যাচার
০৯:৪৫ - আউটরো ও কী মূল কথা
━━━━━━━━━━━━━━━━━━━━━━━
আজকের শীর্ষ ২৩টি ট্রেন্ডিং রিপোজিটরি:
━━━━━━━━━━━━━━━━━━━━━━
#১ SimplifyJobs/Summer2027-Internships (⭐ ৪৮.২ হাজার • আজ +২১ • পাইথন)
সামার ২০২৭ সফটওয়্যার ইঞ্জিনিয়ারিং, ডেটা সায়েন্স, এআই, কোয়ান্ট, প্রোডাক্ট ম্যানেজমেন্ট, এবং হার্ডওয়্যার ইন্টার্নশিপের পোস্ট। Simplify এবং Pitt CSC দ্বারা প্রতিদিন আপডেট করা হয়।
🔗 SimplifyJobs/Summer2027-Internships
#২ n8n-io/n8n (⭐ ২০৮.৯ হাজার • আজ +১৬১ • টাইপস্ক্রিপ্ট)
নেটিভ এআই সক্ষমতাসহ ফেয়ার-কোড ওয়ার্কফ্লো অটোমেশন প্ল্যাটফর্ম। ভিজ্যুয়াল বিল্ডিংয়ের সাথে কাস্টম কোড, সেলফ-হোস্ট বা ক্লাউড, ৪০০+ ইন্টিগ্রেশন একত্রিত করুন।
🔗 n8n-io/n8n
#৩ datahub-project/datahub (⭐ ১২.৯ হাজার • আজ +১০ • পাইথন)
আপনার ডেটা এবং এআই স্ট্যাকের জন্য কনটেক্সট প্ল্যাটফর্ম।
🔗 datahub-project/datahub
#৪ upscayl/upscayl (⭐ ৫১.২ হাজার • আজ +৭৬ • টাইপস্ক্রিপ্ট)
🆙 Upscayl - লিনাক্স, ম্যাকওএস এবং উইন্ডোজের জন্য #১ ফ্রি এবং ওপেন সোর্স এআই ইমেজ আপস্কেলার।
🔗 upscayl/upscayl
#5 ripienaar/free-for-dev (⭐ 140.2k • আজ +55 • HTML)
SaaS, PaaS এবং IaaS অফারগুলির একটি তালিকা, যেগুলির ফ্রি টিয়ার রয়েছে এবং যা ডেভঅপ্স ও ইনফ্রাডেভের জন্য আকর্ষণীয়।
🔗 ripienaar/free-for-dev
#6 lukasz-madon/awesome-remote-job (⭐ 50k • আজ +99 • অজানা)
চমৎকার রিমোট চাকরি এবং রিসোর্সের একটি সংকলিত তালিকা। vinta/awesome-python দ্বারা অনুপ্রাণিত
🔗 lukasz-madon/awesome-remote-job
#৭ microsoft/Data-Science-For-Beginners (⭐ ৩৭.৮ হাজার • আজ +৪৭ • জুপিটার নোটবুক)
১০ সপ্তাহ, ২০টি পাঠ, সকলের জন্য ডেটা সায়েন্স!
🔗 microsoft/Data-Science-For-Beginners
#৮ microsoft/PowerToys (⭐ ১৪০.১ হাজার • আজ +৮৪ • C)
মাইক্রোসফট পাওয়ারটয়েজ হলো ইউটিলিটিগুলোর একটি সংগ্রহ যা উইন্ডোজে উৎপাদনশীলতা এবং কাস্টমাইজেশনকে দারুণভাবে বাড়িয়ে তোলে।
🔗 microsoft/PowerToys
#৯ neovim/neovim (⭐ ১০৩.২ হাজার • আজ +৪১ • Vim Script)
এক্সটেনসিবিলিটি এবং ব্যবহারযোগ্যতার উপর দৃষ্টি নিবদ্ধ একটি ভিম-ফর্ক।
🔗 neovim/neovim
#১০ jellyfin/jellyfin (⭐ ৫৮.৭ হাজার • আজ +৭৪ • C#) ফ্রি সফটওয়্যার মিডিয়া সিস্টেম - সার্ভার ব্যাকএন্ড এবং এপিআই।
🔗 jellyfin/jellyfin
#১১ run-llama/llama_index (⭐ ৫২.৭ হাজার • আজ +২৩) • পাইথন)
লামা ইনডেক্স (LlamaIndex) হলো এআই (AI)-এর জন্য ডকুমেন্ট প্রসেসিং প্ল্যাটফর্ম
🔗 run-llama/llama_index
#১২ অ্যাঙ্কোর/সিফট (⭐ ৯.৮ হাজার • আজ +১৪ • গো)
কন্টেইনার ইমেজ এবং ফাইলসিস্টেম থেকে সফটওয়্যার বিল অফ মেটেরিয়ালস (Software Bill of Materials) তৈরি করার জন্য একটি সিএলআই (CLI) টুল এবং লাইব্রেরি
🔗 anchore/syft
#১৩ মাইক্রোসফট/প্লেরাইট (⭐ ৯৮.৭ হাজার • আজ +৯০ • টাইপস্ক্রিপ্ট)
প্লেরাইট (Playwright) হলো ওয়েব টেস্টিং এবং অটোমেশনের জন্য একটি ফ্রেমওয়ার্ক। এটি একটিমাত্র এপিআই (API) দিয়ে ক্রোমিয়াম (Chromium), ফায়ারফক্স (Firefox) এবং ওয়েবকিট (WebKit) পরীক্ষা করার সুযোগ দেয়।
🔗 microsoft/playwright
#১৪ মেকপ্লেন/প্লেন (⭐ ৬১.৬ হাজার • আজ +৬৪ • টাইপস্ক্রিপ্ট)
🔥🔥🔥 ওপেন-সোর্স জিরা (Jira), লিনিয়ার (Linear), মানডে (Monday), এবং ক্লিকআপ (ClickUp)-এর বিকল্প। প্লেন হলো টাস্ক, স্প্রিন্ট, ডক্স এবং ট্রায়েজ পরিচালনার জন্য একটি আধুনিক প্রজেক্ট ম্যানেজমেন্ট প্ল্যাটফর্ম।
🔗 makeplane/plane
#15 pgvector/pgvector (⭐ ২৩.৫ হাজার • আজ +১৭ • C)
পোস্টগ্রেসের জন্য ওপেন-সোর্স ভেক্টর সিমিলারিটি সার্চ
🔗 pgvector/pgvector
━━━━━━━━━━━━━━━━━━━━━━
প্রতিদিনের গিটহাব ট্রেন্ডিং রিপোজিটরি, ওপেন সোর্স রাউন্ডআপ এবং ডেভেলপার নিউজের জন্য @devrepos-এ সাবস্ক্রাইব করুন।
প্রতিদিন গিটহাবের সেরা ওপেন সোর্স সফটওয়্যার এবং ট্রেন্ডিং প্রজেক্টগুলো নিয়ে নতুন ভিডিও আসে।
[de-DE] Der ultimative Entwickler-Stack: 23 angesagte GitHub-Repos | 28.10.2026 | Dev Repos Daily
cutt.ly
🔥 Dieses neue KI-Repository ist noch ein Geheimtipp (Sommer 2027 – Praktika)
Bleiben Sie mit dieser handverlesenen Auswahl angesagter GitHub-Repositories immer auf dem Laufenden im Open-Source-Ökosystem. Von innovativen Entwicklertools bis hin zu bahnbrechenden Frameworks – diese Projekte begeistern die Software-Community geradezu.
28. Oktober 2026
Inhalt dieses Videos:
- Die 23 beliebtesten GitHub-Repositories, sortiert nach den heute erhaltenen Sternen
- Entwickler-Einblicke und Projektübersichten zu jedem vorgestellten Repository
- KI-gestützter Rundgang durch jedes Open-Source-Projekt
- Direkte Links zu allen Repositories für einfachen Zugriff
⏱️ ZEITSTEMPEL (YouTube-Kapitel):
00:00 - Intro: Die wichtigsten Tools von heute
00:09 - Übersicht der beliebtesten Repositories
00:25 - #1 Sommer 2027 – Praktika
00:54 - #2 n8n
01:24 - #3 datahub
01:45 - #4 upscayl
02:08 - #5 free-for-dev
02:33 - #6 awesome-remote-job
02:59 - #7 Data-Science-For-Beginners
03:27 - #8 PowerToys
03:50 – #9 neovim
04:10 – #10 jellyfin
04:33 – #11 llama_index
04:56 – #12 syft
05:18 – #13 playwright
05:46 – #14 plane
06:09 – #15 pgvector
06:28 – #16 awesome
06:59 – #17 runner-images
07:19 – #18 rustdesk
07:43 – #19 lazygit
08:05 – #20 transformers
08:31 – #21 directus
09:02 – #22 gitleaks
09:22 – #23 OpenCore-Legacy-Patcher
09:45 – Abspann & Legende Wichtigste Erkenntnisse
━━━━━━━━━━━━━━━━━━━━━━━
Die 23 beliebtesten Jobportale von heute:
━━━━━━━━━━━━━━━━━━━━━━━
#1 SimplifyJobs/Sommer 2027 – Praktika (⭐ 48,2k • +21 heute • Python)
Stellenangebote für Praktika im Bereich Softwareentwicklung, Data Science, KI, Quantitative Methoden, Produktmanagement und Hardware im Sommer 2027. Täglich aktualisiert von Simplify und Pitt CSC.
🔗 SimplifyJobs/Summer2027-Internships
#2 n8n-io/n8n (⭐ 208,9k • +161 heute • TypeScript)
Fair-Code-Workflow-Automatisierungsplattform mit nativen KI-Funktionen. Visuelles Erstellen mit benutzerdefiniertem Code kombinieren, selbst hosten oder in der Cloud, über 400 Integrationen.
🔗 n8n-io/n8n
#3 datahub-project/datahub (⭐ 12,9k • +10 heute • Python)
Die Kontextplattform für Ihren Daten- und KI-Stack.
🔗 datahub-project/datahub
#4 upscayl/upscayl (⭐ 51,2k • +76 heute • TypeScript)
🆙 Upscayl – Nr. 1 kostenloser Open-Source-KI-Bild-Upscaler für Linux, macOS und Windows.
🔗 upscayl/upscayl
#5 ripienaar/free-for-dev (⭐ 140.200 • +55 heute • HTML)
Eine Liste von SaaS-, PaaS- und IaaS-Angeboten mit kostenlosen Tarifen, die für DevOps- und Infrastrukturentwickler interessant sind.
🔗 ripienaar/free-for-dev
#6 lukasz-madon/awesome-remote-job (⭐ 50.000 • +99 heute • Unbekannt)
Eine kuratierte Liste mit tollen Remote-Jobs und Ressourcen. Inspiriert von vinta/awesome-python
🔗 lukasz-madon/awesome-remote-job
#7 microsoft/Data-Science-For-Beginners (⭐ 37,8k • +47 heute • Jupyter Notebook)
10 Wochen, 20 Lektionen: Data Science für alle!
🔗 microsoft/Data-Science-For-Beginners
#8 microsoft/PowerToys (⭐ 140,1k • +84 heute • C)
Microsoft PowerToys ist eine Sammlung von Hilfsprogrammen, die die Produktivität und Anpassungsmöglichkeiten unter Windows deutlich verbessern.
🔗 microsoft/PowerToys
#9 neovim/neovim (⭐ 103,2k • +41 heute • Vim Script)
Vim-Fork mit Fokus auf Erweiterbarkeit und Benutzerfreundlichkeit.
🔗 neovim/neovim
#10 jellyfin/jellyfin (⭐ 58,7k • +74 heute • C#)
Das Free Software Media System – Server-Backend & API
🔗 jellyfin/jellyfin
#11 run-llama/llama_index (⭐ 52,7k • +23 heute • Python)
LlamaIndex ist die Dokumentenverarbeitungsplattform für KI.
🔗 run-llama/llama_index
#12 anchore/syft (⭐ 9,8k • +14 heute • Go)
CLI-Tool und Bibliothek zur Generierung einer Software-Stückliste aus Container-Images und Dateisystemen.
🔗 anchore/syft
#13 microsoft/playwright (⭐ 98,7k • +90 heute • TypeScript)
Playwright ist ein Framework für Webtests und -automatisierung. Es ermöglicht das Testen von Chromium, Firefox und WebKit mit einer einzigen API.
🔗 microsoft/playwright
#14 makeplane/plane (⭐ 61,6k • +64 heute • TypeScript)
🔥🔥🔥 Plane ist eine Open-Source-Alternative zu Jira, Linear, Monday und ClickUp. Es handelt sich um eine moderne Projektmanagement-Plattform zur Verwaltung von Aufgaben, Sprints, Dokumenten und Priorisierung.
🔗 makeplane/plane
#15 pgvector/pgvector (⭐ 23,5k • +17 heute • C)
Open-Source-Vektorähnlichkeitssuche für PostgreSQL
🔗 pgvector/pgvector
━━━━━━━━━━━━━━━━━━━━━━━━
Abonniere @devrepos für täglich aktuelle GitHub-Repositories, Open-Source-Übersichten und Entwickler-News. Täglich neue Videos zu den besten Open-Source-Softwareprojekten und Trendprojekten auf GitHub.
[es-US] El stack definitivo para desarrolladores: 23 repositorios de GitHub en tendencia | 28/10/2026 | D...
cutt.ly
🔥 Nadie te habló de este nuevo repositorio de IA (Prácticas de verano de 2027)
Mantente al día con el ecosistema de código abierto con esta selección de repositorios de GitHub que marcan tendencia. Desde herramientas innovadoras para desarrolladores hasta frameworks revolucionarios, estos son los proyectos que están causando sensación en la comunidad de software.
28 de octubre de 2026
Contenido de este video:
- Los 23 repositorios de GitHub más populares, clasificados según las estrellas obtenidas hoy.
- Información para desarrolladores y descripciones generales de cada repositorio destacado.
- Tutorial guiado por IA de cada proyecto de código abierto.
- Enlaces directos a todos los repositorios a continuación para un acceso fácil.
⏱️ MARCAS DE TIEMPO (Capítulos de YouTube):
00:00 - Introducción: Herramientas de alto impacto de hoy
00:09 - Resumen de la clasificación de tendencias
00:25 - N.° 1: Prácticas de verano de 2027
00:54 - N.° 2: n8n
01:24 - N.° 3: datahub
01:45 - N.° 4: upscayl
02:08 - N.° 5: free-for-dev
02:33 - N.° 6: awesome-remote-job
02:59 - N.° 7: Ciencia de datos para principiantes
03:27 - N.° 8 PowerToys
03:50 - #9 neovim
04:10 - #10 jellyfin
04:33 - #11 llama_index
04:56 - #12 syft
05:18 - #13 playwright
05:46 - #14 plane
06:09 - #15 pgvector
06:28 - #16 awesome
06:59 - #17 runner-images
07:19 - #18 rustdesk
07:43 - #19 lazygit
08:05 - #20 transformers
08:31 - #21 directus
09:02 - #22 gitleaks
09:22 - #23 OpenCore-Legacy-Patcher
09:45 - Outro y clave Conclusiones
━━━━━━━━━━━━━━━━━━━━━━━
LOS 23 REPOSITORIOS MÁS POPULARES DE HOY:
━━━━━━━━━━━━━━━━━━━━━━━━
#1 SimplifyJobs/Summer2027-Interships (⭐ 48.2k • +21 hoy • Python)
Ofertas de prácticas de verano de 2027 en ingeniería de software, ciencia de datos, IA, análisis cuantitativo, gestión de productos y hardware. Actualizado diariamente por Simplify y Pitt CSC.
🔗 SimplifyJobs/Summer2027-Internships
#2 n8n-io/n8n (⭐ 208.9k • +161 hoy • TypeScript)
Plataforma de automatización de flujos de trabajo con código justo y capacidades de IA nativas. Combina la creación visual con código personalizado, autoalojamiento o en la nube, más de 400 integraciones.
🔗 n8n-io/n8n
#3 datahub-project/datahub (⭐ 12.9k • +10 hoy • Python)
La plataforma de contexto para tu pila de datos e IA.
🔗 datahub-project/datahub
#4 upscayl/upscayl (⭐ 51.2k • +76 hoy • TypeScript)
🆙 Upscayl: el escalador de imágenes con IA gratuito y de código abierto n.° 1 para Linux, macOS y Windows.
🔗 upscayl/upscayl
#5 ripienaar/free-for-dev (⭐ 140.2k • +55 hoy • HTML)
Una lista de ofertas de SaaS, PaaS e IaaS con planes gratuitos de interés para devops e infradev.
🔗 ripienaar/free-for-dev
#6 lukasz-madon/awesome-remote-job (⭐ 50k • +99 hoy • Desconocido)
Una lista seleccionada de excelentes trabajos y recursos remotos. Inspirado en vinta/awesome-python
🔗 lukasz-madon/awesome-remote-job
#7 microsoft/Ciencia de Datos para Principiantes (⭐ 37.8k • +47 hoy • Jupyter Notebook)
10 semanas, 20 lecciones: ¡Ciencia de Datos para todos!
🔗 microsoft/Data-Science-For-Beginners
#8 microsoft/PowerToys (⭐ 140.1k • +84 hoy • C)
Microsoft PowerToys es una colección de utilidades que potencian la productividad y la personalización en Windows.
🔗 microsoft/PowerToys
#9 neovim/neovim (⭐ 103.2k • +41 hoy • Vim Script)
Bifurcación de Vim centrada en la extensibilidad y la usabilidad.
🔗 neovim/neovim
#10 jellyfin/jellyfin (⭐ 58.7k • +74 hoy • C#)
Sistema de medios de software libre: backend y API del servidor.
🔗 jellyfin/jellyfin
#11 run-llama/llama_index (⭐ 52.7k • +23 hoy • Python)
LlamaIndex es la plataforma de procesamiento de documentos para IA.
🔗 run-llama/llama_index
#12 anchore/syft (⭐ 9.8k • +14 hoy • Go)
Herramienta y biblioteca de línea de comandos para generar una lista de materiales de software a partir de imágenes de contenedores y sistemas de archivos.
🔗 anchore/syft
#13 microsoft/playwright (⭐ 98.7k • +90 hoy • TypeScript)
Playwright es un framework para pruebas y automatización web. Permite probar Chromium, Firefox y WebKit con una única API.
🔗 microsoft/playwright
#14 makeplane/plane (⭐ 61.6k • +64 hoy • TypeScript)
🔥🔥🔥 Alternativa de código abierto a Jira, Linear, Monday y ClickUp. Plane es una plataforma moderna de gestión de proyectos para administrar tareas, sprints, documentación y priorización de tareas.
🔗 makeplane/plane
#15 pgvector/pgvector (⭐ 23.5k • +17 hoy • C)
Búsqueda de similitud vectorial de código abierto para PostgreSQL
🔗 pgvector/pgvector
━━━━━━━━━━━━━━━━━━━━━━━━
Suscríbete a @devrepos para ver diariamente los repositorios más populares de GitHub, resúmenes de código abierto y noticias para desarrolladores.
Nuevos videos cada d...
[fr-FR] Le stack ultime du développeur : 23 dépôts GitHub en vogue | 28/10/2026 | Dev Repos Daily
cutt.ly
🔥 Personne ne vous a parlé de ce nouveau dépôt d'IA (Stages été 2027)
Restez à la pointe de l'écosystème open source grâce à cette sélection exclusive de dépôts GitHub incontournables. Des outils de développement innovants aux frameworks révolutionnaires, découvrez les projets qui font sensation dans la communauté du logiciel en ce moment.
28 octobre 2026
Contenu de cette vidéo :
- Les 23 dépôts GitHub les plus populaires, classés par nombre d'étoiles gagnées aujourd'hui
- Présentations et analyses de chaque dépôt mis en avant
- Visite guidée commentée par une IA de chaque projet open source
- Liens directs vers tous les dépôts ci-dessous pour un accès facile
⏱️ HORODATAGE (Chapitres YouTube) :
00:00 - Introduction : Les outils à fort impact du jour
00:09 - Aperçu du classement des tendances
00:25 - N° 1 Summer2027-Internships
00:54 - N° 2 n8n
01:24 - N° 3 datahub
01:45 - N° 4 upscayl
02:08 - N° 5 free-for-dev
02:33 - N° 6 awesome-remote-job
02:59 - N° 7 Data-Science-For-Beginners
03:27 - N° 8 PowerToys
03:50 - #9 neovim
04:10 - #10 jellyfin
04:33 - #11 llama_index
04:56 - #12 syft
05:18 - #13 playwright
05:46 - #14 plane
06:09 - #15 pgvector
06:28 - #16 awesome
06:59 - #17 runner-images
07:19 - #18 rustdesk
07:43 - #19 lazygit
08:05 - #20 transformers
08:31 - #21 directus
09:02 - #22 gitleaks
09:22 - #23 OpenCore-Legacy-Patcher
09:45 - Conclusion et légende Points clés
━━━━━━━━━━━━━━━━━━━━━━
TOP 23 DES DÉPÔTS LES PLUS CONSULTÉS AUJOURD'HUI :
━━━━━━━━━━━━━━━━━━━━━━━
N° 1 SimplifyJobs/Stages Été 2027 (⭐ 48,2 k • +21 aujourd'hui • Python)
Offres de stage Été 2027 en génie logiciel, science des données, IA, analyse quantitative, gestion de produits et matériel informatique. Mise à jour quotidienne par Simplify et Pitt CSC.
🔗 SimplifyJobs/Summer2027-Internships
#2 n8n-io/n8n (⭐ 208,9 k • +161 aujourd'hui • TypeScript)
Plateforme d'automatisation des flux de travail FairCode avec des fonctionnalités d'IA natives. Combinez la création visuelle avec du code personnalisé, auto-hébergé ou cloud, plus de 400 intégrations.
🔗 n8n-io/n8n
#3 datahub-project/datahub (⭐ 12,9 k • +10 aujourd'hui • Python)
La plateforme Context pour votre stack de données et d'IA
🔗 datahub-project/datahub
#4 upscayl/upscayl (⭐ 51,2 k • +76 aujourd'hui • TypeScript)
🆙 Upscayl - Upscaler d'images IA gratuit et open source n° 1 pour Linux, macOS et Windows.
🔗 upscayl/upscayl
#5 ripienaar/free-for-dev (⭐ 140,2 k • +55 aujourd'hui • HTML)
Liste d'offres SaaS, PaaS et IaaS proposant des versions gratuites intéressantes pour les développeurs DevOps et Infrastructure.
🔗 ripienaar/free-for-dev
#6 lukasz-madon/awesome-remote-job (⭐ 50 k • +99 aujourd'hui • Inconnu)
Sélection d'offres d'emploi et de ressources intéressantes pour le télétravail. Inspiré par vinta/awesome-python
🔗 lukasz-madon/awesome-remote-job
#7 microsoft/Data-Science-For-Beginners (⭐ 37,8 k • +47 aujourd'hui • Jupyter Notebook)
10 semaines, 20 leçons : la science des données pour tous !
🔗 microsoft/Data-Science-For-Beginners
#8 microsoft/PowerToys (⭐ 140,1 k • +84 aujourd'hui • C)
Microsoft PowerToys est une collection d'utilitaires qui optimisent la productivité et la personnalisation sous Windows.
🔗 microsoft/PowerToys
#9 neovim/neovim (⭐ 103,2 k • +41 aujourd'hui • Script Vim)
Une version dérivée de Vim axée sur l'extensibilité et la facilité d'utilisation.
🔗 neovim/neovim
#10 jellyfin/jellyfin (⭐ 58,7 k • +74 aujourd'hui • C#)
Le système de gestion de médias de logiciels libres : serveur et API.
🔗 jellyfin/jellyfin
#11 run-llama/llama_index (⭐ 52,7 k • +23 aujourd'hui • Python)
LlamaIndex est une plateforme de traitement de documents pour l'IA.
🔗 run-llama/llama_index
#12 anchore/syft (⭐ 9,8 k • +14 aujourd'hui • Go)
Outil et bibliothèque en ligne de commande pour générer une nomenclature logicielle à partir d'images de conteneurs et de systèmes de fichiers.
🔗 anchore/syft
#13 microsoft/playwright (⭐ 98,7 k • +90 aujourd'hui • TypeScript)
Playwright est un framework pour les tests et l'automatisation web. Il permet de tester Chromium, Firefox et WebKit avec une API unique.
🔗 microsoft/playwright
#14 makeplane/plane (⭐ 61,6 k • +64 aujourd'hui • TypeScript)
🔥🔥🔥 Alternative open source à Jira, Linear, Monday et ClickUp. Plane est une plateforme moderne de gestion de projet permettant de gérer les tâches, les sprints, la documentation et le triage.
🔗 makeplane/plane
#15 pgvector/pgvector (⭐ 23,5 k • +17 aujourd'hui • C)
Outil open source de recherche de similarité vectorielle pour Postgres
🔗 pgvector/pgvector
━━━━━━━━━━━━━━━━━━━━━━
Abonnez-vous à @devrepos pour découvrir chaque jour les dépôts GitHub les plus ...
[hi] बेहतरीन डेवलपर स्टैक: 23 ट्रेंडिंग GitHub रिपोज़ | 28-10-2026 | डेव रिपोज़ डेली
cutt.ly
🔥 इस नए AI रिपॉजिटरी के बारे में आपको किसी ने नहीं बताया (ग्रीष्म 2027 - इंटर्नशिप)
ओपन सोर्स इकोसिस्टम की नवीनतम जानकारी के लिए GitHub के इन चुनिंदा रिपॉजिटरी का इस्तेमाल करें। इनोवेटिव डेवलपर टूल्स से लेकर क्रांतिकारी फ्रेमवर्क तक, ये वो प्रोजेक्ट हैं जो सॉफ्टवेयर जगत में धूम मचा रहे हैं।
28 अक्टूबर, 2026
इस वीडियो में क्या है:
- आज प्राप्त स्टार रेटिंग के आधार पर शीर्ष 23 ट्रेंडिंग GitHub रिपॉजिटरी
- प्रत्येक प्रदर्शित रिपॉजिटरी के लिए डेवलपर अंतर्दृष्टि और प्रोजेक्ट अवलोकन
- प्रत्येक ओपन सोर्स प्रोजेक्ट का AI-नैरेटेड वॉकथ्रू
- आसान पहुँच के लिए नीचे सभी रिपॉजिटरी के सीधे लिंक
⏱️ टाइमस्टैम्प (YouTube अध्याय):
00:00 - परिचय: आज के उच्च-प्रभाव वाले उपकरण
00:09 - ट्रेंडिंग लीडरबोर्ड अवलोकन
00:25 - #1 समर 2027 इंटर्नशिप
00:54 - #2 n8n
01:24 - #3 datahub
01:45 - #4 upscayl
02:08 - #5 फ्री-फॉर-डेव
02:33 - #6 शानदार रिमोट जॉब
02:59 - #7 डेटा साइंस फॉर बिगिनर्स
03:27 - #8 पॉवर टॉयज़
03:50 - #9 नेओविम
04:10 - #10 जेलीफिन
04:33 - #11 लामा_इंडेक्स
04:56 - #12 सिफ्ट
05:18 - #13 प्लेराइट
05:46 - #14 प्लेन
06:09 - #15 पीजीवेक्टर
06:28 - #16 ऑसम
06:59 - #17 रनर-इमेजेज
07:19 - #18 रस्टडेस्क
07:43 - #19 लेज़ीगिट
08:05 - #20 ट्रांसफॉर्मर्स
08:31 - #21 डायरेक्टस
09:02 - #22 गिटलीक्स
09:22 - #23 ओपनकोर-लेगेसी-पैचर
09:45 - आउट्रो और कुंजी मुख्य बिंदु
━━━━━━━━━━━━━━━━━━━━━━━━
आज के शीर्ष 23 ट्रेंडिंग रिपॉजिटरी:
━━━━━━━━━━━━━━━━━━━━━━━━
#1 SimplifyJobs/Summer2027-इंटर्नशिप (⭐ 48.2k • आज +21 • पायथन)
ग्रीष्मकालीन 2027 के लिए सॉफ्टवेयर इंजीनियरिंग, डेटा साइंस, एआई, क्वांट, प्रोडक्ट मैनेजमेंट और हार्डवेयर इंटर्नशिप के अवसर। Simplify और Pitt CSC द्वारा प्रतिदिन अपडेट किया जाता है।
🔗 SimplifyJobs/Summer2027-Internships
#2 n8n-io/n8n (⭐ 208.9k • आज +161 • TypeScript)
नेटिव AI क्षमताओं वाला फेयर-कोड वर्कफ़्लो ऑटोमेशन प्लेटफ़ॉर्म। विज़ुअल बिल्डिंग को कस्टम कोड के साथ मिलाएं, सेल्फ-होस्ट या क्लाउड का उपयोग करें, 400+ इंटीग्रेशन उपलब्ध हैं।
🔗 n8n-io/n8n
#3 datahub-project/datahub (⭐ 12.9k • आज +10 • Python)
आपके डेटा और AI स्टैक के लिए कॉन्टेक्स्ट प्लेटफ़ॉर्म
🔗 datahub-project/datahub
#4 upscayl/upscayl (⭐ 51.2k • आज +76 • TypeScript)
🆙 Upscayl - Linux, MacOS और Windows के लिए नंबर 1 मुफ़्त और ओपन सोर्स AI इमेज अपस्केलर।
🔗 upscayl/upscayl
#5 ripienaar/free-for-dev (⭐ 140.2k • आज +55 • HTML)
SaaS, PaaS और IaaS सेवाओं की एक सूची जिनमें DevOps और InfraDevelop के लिए उपयोगी निःशुल्क विकल्प उपलब्ध हैं।
🔗 ripienaar/free-for-dev
#6 lukasz-madon/awesome-remote-job (⭐ 50k • आज +99 • अज्ञात)
शानदार रिमोट जॉब्स और संसाधनों की एक चुनिंदा सूची। vinta/awesome-python से प्रेरित
🔗 lukasz-madon/awesome-remote-job
#7 microsoft/Data-Science-For-Beginners (⭐ 37.8k • आज +47 • Jupyter Notebook)
10 सप्ताह, 20 पाठ, सभी के लिए डेटा साइंस!
🔗 microsoft/Data-Science-For-Beginners
#8 microsoft/PowerToys (⭐ 140.1k • आज +84 • C)
Microsoft PowerToys यूटिलिटीज़ का एक संग्रह है जो Windows पर उत्पादकता और अनुकूलन को बढ़ाता है।
🔗 microsoft/PowerToys
#9 neovim/neovim (⭐ 103.2k • आज +41 • Vim Script)
विस्तारशीलता और उपयोगिता पर केंद्रित Vim-फोर्क
🔗 neovim/neovim
#10 jellyfin/jellyfin (⭐ 58.7k • आज +74 • C#)
फ्री सॉफ्टवेयर मीडिया सिस्टम - सर्वर बैकएंड और API
🔗 jellyfin/jellyfin
#11 run-llama/llama_index (⭐ 52.7k • आज +23 • Python)
LlamaIndex एक AI-आधारित दस्तावेज़ प्रसंस्करण प्लेटफ़ॉर्म है।
🔗 run-llama/llama_index
#12 anchore/syft (⭐ 9.8k • आज +14 • Go)
कंटेनर इमेज और फ़ाइल सिस्टम से सॉफ़्टवेयर बिल ऑफ़ मैटेरियल्स जनरेट करने के लिए एक CLI टूल और लाइब्रेरी।
🔗 anchore/syft
#13 microsoft/playwright (⭐ 98.7k • आज +90 • TypeScript)
Playwright वेब टेस्टिंग और ऑटोमेशन के लिए एक फ़्रेमवर्क है। यह एक ही API के साथ Chromium, Firefox और WebKit की टेस्टिंग की सुविधा देता है।
🔗 microsoft/playwright
#14 makeplane/plane (⭐ 61.6k • आज +64 • TypeScript)
🔥🔥🔥 ओपन-सोर्स Jira, Linear, Monday और ClickUp का विकल्प। Plane एक आधुनिक प्रोजेक्ट मैनेजमेंट प्लेटफॉर्म है जिसका उपयोग टास्क, स्प्रिंट, डॉक्स और ट्राइएज को मैनेज करने के लिए किया जाता है।
🔗 makeplane/plane
#15 pgvector/pgvector (⭐ 23.5k • आज +17 • C)
पोस्टग्रेस के लिए ओपन-सोर्स वेक्टर समानता खोज
🔗 pgvector/pgvector
━━━━━━━━━━━━━━━━━━━━━━━━
दैनिक GitHub ट्रेंडिंग रिपॉजिटरी, ओपन सोर्स राउंडअप और डेवलपर समाचारों के लिए @devrepos को सब्सक्राइब करें।
GitHub पर सर्वश्रेष्ठ ओपन सोर्स सॉफ़्टवेयर और ट्रेंडिंग प्रोजेक्ट्स को कवर करने वाले नए वीडियो हर दिन देखें।
[id] Tumpukan Perangkat Lunak Pengembang Terbaik: 23 Repositori GitHub Terpopuler | 28-10-2026 | Dev R...
cutt.ly
🔥 Belum Ada yang Memberitahu Anda Tentang Repositori AI Baru Ini (Magang Musim Panas 2027)
Tetap terhubung dengan ekosistem open source dengan pilihan repositori GitHub yang sedang tren ini. Dari alat pengembang yang inovatif hingga kerangka kerja yang inovatif, ini adalah proyek-proyek yang sedang membuat gebrakan di komunitas perangkat lunak saat ini.
28 Oktober 2026
Isi video ini:
- 23 repositori GitHub terpopuler yang diurutkan berdasarkan bintang yang diperoleh hari ini
- Wawasan pengembang dan ikhtisar proyek untuk setiap repositori unggulan
- Panduan yang dinarasikan AI untuk setiap proyek sumber terbuka
- Tautan langsung ke semua repositori di bawah ini untuk akses mudah
⏱️ CAP WAKTU (Bab YouTube):
00:00 - Pendahuluan: Alat-alat Berdampak Tinggi Hari Ini
00:09 - Ikhtisar Papan Peringkat Terpopuler
00:25 - #1 Magang Musim Panas 2027
00:54 - #2 n8n
01:24 - #3 datahub
01:45 - #4 upscayl
02:08 - #5 free-for-dev
02:33 - #6 awesome-remote-job
02:59 - #7 Ilmu Data untuk Pemula
03:27 - #8 PowerToys
03:50 - #9 neovim
04:10 - #10 jellyfin
04:33 - #11 llama_index
04:56 - #12 syft
05:18 - #13 playwright
05:46 - #14 plane
06:09 - #15 pgvector
06:28 - #16 awesome
06:59 - #17 runner-images
07:19 - #18 rustdesk
07:43 - #19 lazygit
08:05 - #20 transformers
08:31 - #21 directus
09:02 - #22 gitleaks
09:22 - #23 OpenCore-Legacy-Patcher
09:45 - Outro & Key Poin Penting
━━━━━━━━━━━━━━━━━━━━━━━
23 REPOSITORI YANG SEDANG TREN HARI INI:
━━━━━━━━━━━━━━━━━━━━━━━
#1 SimplifyJobs/Summer2027-Internships (⭐ 48,2 ribu • +21 hari ini • Python)
Lowongan magang musim panas 2027 di bidang rekayasa perangkat lunak, ilmu data, AI, kuantitatif, manajemen produk, dan perangkat keras. Diperbarui setiap hari oleh Simplify dan Pitt CSC.
🔗 SimplifyJobs/Summer2027-Internships
#2 n8n-io/n8n (⭐ 208,9 ribu • +161 hari ini • TypeScript)
Platform otomatisasi alur kerja fair-code dengan kemampuan AI asli. Gabungkan pembuatan visual dengan kode kustom, hosting sendiri atau cloud, 400+ integrasi.
🔗 n8n-io/n8n
#3 datahub-project/datahub (⭐ 12.9k • +10 hari ini • Python)
Platform Konteks untuk Tumpukan Data dan AI Anda
🔗 datahub-project/datahub
#4 upscayl/upscayl (⭐ 51.2k • +76 hari ini • TypeScript)
🆙 Upscayl - Pengoptimal Gambar AI Gratis dan Sumber Terbuka #1 untuk Linux, MacOS, dan Windows.
🔗 upscayl/upscayl
#5 ripienaar/free-for-dev (⭐ 140.2k • +55 hari ini • HTML)
Daftar penawaran SaaS, PaaS, dan IaaS yang memiliki tingkatan gratis yang menarik bagi devops dan infradev
🔗 ripienaar/free-for-dev
#6 lukasz-madon/awesome-remote-job (⭐ 50k • +99 hari ini • Tidak diketahui)
Daftar pilihan pekerjaan dan sumber daya jarak jauh yang luar biasa. Terinspirasi oleh vinta/awesome-python
🔗 lukasz-madon/awesome-remote-job
#7 microsoft/Data-Science-For-Beginners (⭐ 37.8k • +47 hari ini • Jupyter Notebook)
10 Minggu, 20 Pelajaran, Ilmu Data untuk Semua!
🔗 microsoft/Data-Science-For-Beginners
#8 microsoft/PowerToys (⭐ 140.1k • +84 hari ini • C)
Microsoft PowerToys adalah kumpulan utilitas yang meningkatkan produktivitas dan kustomisasi di Windows
🔗 microsoft/PowerToys
#9 neovim/neovim (⭐ 103.2k • +41 hari ini • Skrip Vim)
Vim-fork yang berfokus pada ekstensibilitas dan kegunaan
🔗 neovim/neovim
#10 jellyfin/jellyfin (⭐ 58.7k • +74 hari ini • C#)
Sistem Media Perangkat Lunak Gratis - Backend Server & API
🔗 jellyfin/jellyfin
#11 run-llama/llama_index (⭐ 52.7k • +23 hari ini • Python)
LlamaIndex adalah platform pemrosesan dokumen untuk AI
🔗 run-llama/llama_index
#12 anchore/syft (⭐ 9.8k • +14 hari ini • Go)
Alat dan pustaka CLI untuk menghasilkan Daftar Material Perangkat Lunak dari citra kontainer dan sistem file
🔗 anchore/syft
#13 microsoft/playwright (⭐ 98.7k • +90 hari ini • TypeScript)
Playwright adalah kerangka kerja untuk Pengujian dan Otomatisasi Web. Ini memungkinkan pengujian Chromium, Firefox, dan WebKit dengan satu API.
🔗 microsoft/playwright
#14 makeplane/plane (⭐ 61.6k • +64 hari ini • TypeScript)
🔥🔥🔥 Alternatif Jira, Linear, Monday, dan ClickUp sumber terbuka. Plane adalah platform manajemen proyek modern untuk mengelola tugas, sprint, dokumen, dan triase.
🔗 makeplane/plane
#15 pgvector/pgvector (⭐ 23.5k • +17 hari ini • C)
Pencarian kesamaan vektor sumber terbuka untuk Postgres
🔗 pgvector/pgvector
━━━━━━━━━━━━━━━━━━━━━━━
Berlangganan @devrepos untuk repositori GitHub yang sedang tren setiap hari, rangkuman sumber terbuka, dan berita pengembang.
Video baru setiap hari yang membahas perangkat lunak sumber terbuka terbaik dan proyek-proyek yang sedang tren di GitHub.
[it] Lo stack definitivo per sviluppatori: 23 repository GitHub di tendenza | 28/10/2026 | Dev Repos D...
Italiano: cutt.ly
🔥 Nessuno ti ha parlato di questo nuovo repository di IA (Tirocini estivi 2027)
Rimani aggiornato sull'ecosistema open source con questa selezione accurata di repository GitHub di tendenza. Da strumenti di sviluppo innovativi a framework rivoluzionari, questi sono i progetti che stanno facendo scalpore nella comunità del software in questo momento.
28 ottobre 2026
Contenuto del video:
- I 23 repository GitHub più popolari, classificati in base alle stelle guadagnate oggi
- Approfondimenti per sviluppatori e panoramiche dei progetti per ogni repository presentato
- Guida interattiva con narrazione AI per ogni progetto open source
- Link diretti a tutti i repository qui sotto per un facile accesso
⏱️ INDICE DEI CONTENUTI (Capitoli di YouTube):
00:00 - Introduzione: Strumenti di grande impatto di oggi
00:09 - Panoramica della classifica dei più popolari
00:25 - #1 Summer2027-Internships
00:54 - #2 n8n
01:24 - #3 datahub
01:45 - #4 upscayl
02:08 - #5 free-for-dev
02:33 - #6 awesome-remote-job
02:59 - #7 Data-Science-For-Beginners
03:27 - #8 PowerToys
03:50 - #9 neovim
04:10 - #10 jellyfin
04:33 - #11 llama_index
04:56 - #12 syft
05:18 - #13 playwright
05:46 - #14 plane
06:09 - #15 pgvector
06:28 - #16 awesome
06:59 - #17 runner-images
07:19 - #18 rustdesk
07:43 - #19 lazygit
08:05 - #20 transformers
08:31 - #21 directus
09:02 - #22 gitleaks
09:22 - #23 OpenCore-Legacy-Patcher
09:45 - Outro e Key Punti chiave
━━━━━━━━━━━━━━━━━━━━━━━━
I 23 REPOSITORY PIÙ DI TENDENZA DI OGGI:
━━━━━━━━━━━━━━━━━━━━━━
#1 SimplifyJobs/Summer2027-Internships (⭐ 48.2k • +21 oggi • Python)
Offerte di stage per l'estate 2027 in ingegneria del software, data science, IA, analisi quantitativa, gestione del prodotto e hardware. Aggiornato quotidianamente da Simplify e Pitt CSC.
#1 SimplifyJobs/Summer2027-Internships (⭐ 48.2k • +21 oggi • Python)
Offerte di stage per l'estate 2027 in ingegneria del software, data science, IA, analisi quantitativa, gestione del prodotto e hardware. 🔗 SimplifyJobs/Summer2027-Internships
#2 n8n-io/n8n (⭐ 208.9k • +161 oggi • TypeScript)
Piattaforma di automazione del flusso di lavoro con codice equo e funzionalità native di IA. Combina la creazione visuale con codice personalizzato, self-hosting o cloud, oltre 400 integrazioni.
🔗 n8n-io/n8n
#3 datahub-project/datahub (⭐ 12.9k • +10 oggi • Python)
La piattaforma di contesto per il tuo stack di dati e IA
🔗 datahub-project/datahub
#4 upscayl/upscayl (⭐ 51.2k • +76 oggi • TypeScript)
🆙 Upscayl - Il miglior strumento gratuito e open source per l'upscaling di immagini basato sull'IA per Linux, MacOS e Windows.
🔗 upscayl/upscayl
#5 ripienaar/free-for-dev (⭐ 140.2k • +55 oggi • HTML)
Un elenco di offerte SaaS, PaaS e IaaS con piani gratuiti di interesse per DevOps e InfraDev
🔗 ripienaar/free-for-dev
#6 lukasz-madon/awesome-remote-job (⭐ 50k • +99 oggi • Sconosciuto)
Un elenco curato di fantastiche offerte di lavoro da remoto e risorse. Ispirato da vinta/awesome-python
🔗 lukasz-madon/awesome-remote-job
#7 microsoft/Data-Science-For-Beginners (⭐ 37.8k • +47 oggi • Jupyter Notebook)
10 settimane, 20 lezioni, Data Science per tutti!
🔗 microsoft/Data-Science-For-Beginners
#8 microsoft/PowerToys (⭐ 140.1k • +84 oggi • C)
Microsoft PowerToys è una raccolta di utilità che potenziano la produttività e la personalizzazione su Windows
🔗 microsoft/PowerToys
#9 neovim/neovim (⭐ 103.2k • +41 oggi • Vim Script)
Fork di Vim focalizzato su estensibilità e usabilità
🔗 neovim/neovim
#10 jellyfin/jellyfin (⭐ 58.7k • +74 oggi • C#)
Il sistema multimediale software libero - Backend server e API
🔗 jellyfin/jellyfin
#11 run-llama/llama_index (⭐ 52.7k • +23 oggi • Python)
LlamaIndex è la piattaforma di elaborazione documenti per l'IA
🔗 run-llama/llama_index
#12 anchore/syft (⭐ 9.8k • +14 oggi • Go)
Strumento e libreria CLI per la generazione di una distinta base software da immagini container e filesystem
🔗 anchore/syft
#13 microsoft/playwright (⭐ 98.7k • +90 oggi • TypeScript)
Playwright è un framework per il test e l'automazione web. Consente di testare Chromium, Firefox e WebKit con un'unica API.
🔗 microsoft/playwright
#14 makeplane/plane (⭐ 61.6k • +64 oggi • TypeScript)
🔥🔥🔥 Alternativa open source a Jira, Linear, Monday e ClickUp. Plane è una moderna piattaforma di gestione progetti per gestire attività, sprint, documentazione e priorità.
#14 makeplane/plane (⭐ 61.6k • +64 oggi • TypeScript)
🔥🔥🔥 Un'alternativa open source a Jira, Linear, Monday e ClickUp. Plane è una moderna piattaforma di gestione progetti per gestire attività, sprint, documentazione e priorità.
#14 makeplane/plane (⭐ 61.6k • +64 oggi • TypeScript)
🔥🔥🔥 Un'alternativa open source a Jira, Linear, M...
[iw] הסטאק האולטימטיבי למפתחים: 23 פרויקטי GitHub חמים | 28/10/2026 | Dev Repos Daily
cutt.ly
🔥 אף אחד לא סיפר לכם על מאגר הבינה המלאכותית החדש הזה (קיץ 2027 - התמחויות)
הישארו מעודכנים במערכת האקולוגית של קוד פתוח עם מבחר נבחר זה של מאגרי GitHub טרנדיים. מכלי פיתוח חדשניים ועד מסגרות פורצות דרך, אלו הפרויקטים שעושים גלים בקהילת התוכנה כרגע.
28 באוקטובר, 2026
מה יש בסרטון הזה:
- 23 מאגרי GitHub הטרנדיים ביותר מדורגים לפי כוכבים שנצברו היום
- תובנות מפתחים וסקירות פרויקטים עבור כל מאגר מומלץ
- סיור מקיף על כל פרויקט קוד פתוח באמצעות בינה מלאכותית
- קישורים ישירים לכל המאגרים למטה לגישה נוחה
⏱️ חותמות זמן (פרקי YouTube):
00:00 - מבוא: הכלים בעלי ההשפעה הגבוהה של היום
00:09 - סקירת טבלת המובילים הטרנדיים
00:25 - #1 קיץ 2027 - התמחויות
00:54 - #2 n8n
01:24 - #3 datahub
01:45 - #4 upscayl
02:08 - #5 free-for-dev
02:33 - #6 awesome-remote-job
02:59 - #7 Data-Science-For-Beginners
03:27 - #8 PowerToys
03:50 - #9 neovim
04:10 - #10 jellyfin
04:33 - #11 llama_index
04:56 - #12 syft
05:18 - #13 playwright
05:46 - #14 plane
06:09 - #15 pgvector
06:28 - #16 awesome
06:59 - #17 runner-images
07:19 - #18 rustdesk
07:43 - #19 lazygit
08:05 - #20 transformers
08:31 - #21 directus
09:02 - #22 gitleaks
09:22 - #23 OpenCore-Legacy-Patcher
09:45 - סיום וסולם נקודות חשובות
━━━━━━━━━━━━━━━━━━━━━━━
23 המאגרים הטרנדיים ביותר של היום:
━━━━━━━━━━━━━━━━━━━━━━━
#1 SimplifyJobs/Kitchen2027-Internships (⭐ 48.2k • +21 היום • Python)
פרסומי התמחויות בהנדסת תוכנה, מדעי נתונים, בינה מלאכותית, כימות, ניהול מוצר וחומרה בקיץ 2027. מתעדכנים מדי יום על ידי Simplify ו-Pitt CSC.
🔗 SimplifyJobs/Summer2027-Internships
#2 n8n-io/n8n (⭐ 208.9k • +161 היום • TypeScript)
פלטפורמת אוטומציה של זרימת עבודה בקוד הוגן עם יכולות בינה מלאכותית מקוריות. שלב בנייה ויזואלית עם קוד מותאם אישית, אירוח עצמי או ענן, 400+ אינטגרציות.
🔗 n8n-io/n8n
#3 datahub-project/datahub (⭐ 12.9k • +10 היום • Python)
פלטפורמת ההקשר עבור מחסנית הנתונים והבינה המלאכותית שלך
🔗 datahub-project/datahub
#4 upscayl/upscayl (⭐ 51.2k • +76 היום • TypeScript)
🆙 Upscayl - #1 משדרג תמונות בינה מלאכותית חינמי וקוד פתוח עבור לינוקס, MacOS ו-Windows.
🔗 upscayl/upscayl
#5 ripienaar/free-for-dev (⭐ 140.2k • +55 היום • HTML)
רשימה של הצעות SaaS, PaaS ו-IaaS שיש להן שכבות חינמיות שמעניינות מפתחי פיתוח ופיתוח אינפרא-אדום
🔗 ripienaar/free-for-dev
#6 lukasz-madon/awesome-remote-job (⭐ 50k • +99 היום • לא ידוע)
רשימה אוצרת של עבודות ומשאבים מדהימים מרחוק. בהשראת vinta/awesome-python
🔗 lukasz-madon/awesome-remote-job
#7 microsoft/Data-Science-For-Beginners (⭐ 37.8k • +47 היום • Jupyter Notebook)
10 שבועות, 20 שיעורים, מדעי נתונים לכולם!
🔗 microsoft/Data-Science-For-Beginners
#8 microsoft/PowerToys (⭐ 140.1k • +84 היום • C)
Microsoft PowerToys הוא אוסף של כלי עזר שמשפרים את הפרודוקטיביות וההתאמה האישית ב-Windows
🔗 microsoft/PowerToys
#9 neovim/neovim (⭐ 103.2k • +41 היום • סקריפט Vim)
Vim-fork המתמקד בהרחבה ושימושיות
🔗 neovim/neovim
#10 jellyfin/jellyfin (⭐ 58.7k • +74 היום • C#)
מערכת המדיה של תוכנה חופשית - שרת Backend ו-API
🔗 jellyfin/jellyfin
#11 run-llama/llama_index (⭐ 52.7k • +23 היום • Python)
LlamaIndex היא פלטפורמת עיבוד מסמכים עבור בינה מלאכותית
🔗 run-llama/llama_index
#12 anchore/syft (⭐ 9.8k • +14 היום • Go)
כלי וספרייה של ממשק שורת פקודה (CLI) ליצירת רשימת חומרים של תוכנה מתמונות של מכולות ומערכות קבצים
🔗 anchore/syft
#13 microsoft/playwright (⭐ 98.7k • +90 היום • TypeScript)
Playwright היא מסגרת לבדיקות אינטרנט ואוטומציה. היא מאפשרת בדיקת Chromium, Firefox ו-WebKit עם API יחיד.
🔗 microsoft/playwright
#14 makeplane/plane (⭐ 61.6k • +64 היום • TypeScript)
🔥🔥🔥 אלטרנטיבה בקוד פתוח ל-Jira, Linear, Monday ו-ClickUp. Plane היא פלטפורמת ניהול פרויקטים מודרנית לניהול משימות, ספרינטים, מסמכים וטראז'.
🔗 makeplane/plane
#15 pgvector/pgvector (⭐ 23.5k • +17 היום • C)
חיפוש דמיון וקטורי בקוד פתוח עבור Postgres
🔗 pgvector/pgvector
━━━━━━━━━━━━━━━━━━━━━━━━
הירשמו ל-@devrepos לקבלת מאגרי GitHub יומיים פופולריים, סיכומים בקוד פתוח וחדשות מפתחים.
סרטונים חדשים מדי יום המכסים את תוכנות הקוד הפתוח הטובות ביותר ופרויקטים פופולריים ב-GitHub.
[ja] 究極の開発者スタック：GitHubでトレンドのレポジトリ23選 | 2026年10月28日 | 開発者レポジトリ・デイリー
cutt.ly
🔥 誰も教えてくれなかった、注目のAIリポジトリ（2027年夏期インターンシップ）
厳選された話題のGitHubリポジトリで、オープンソースエコシステムの最新情報を常に把握しましょう。革新的な開発ツールから画期的なフレームワークまで、ソフトウェアコミュニティで今まさに注目を集めているプロジェクトをご紹介します。
2026年10月28日
この動画の内容：
- 本日獲得したスター数でランキングされた、GitHubで話題のリポジトリ上位23件
- 各リポジトリの開発者向け解説とプロジェクト概要
- AIによるナレーション付き、各オープンソースプロジェクトの解説
- すべてのリポジトリへの直接リンク（下記参照）
⏱️ タイムスタンプ（YouTubeチャプター）：
00:00 - はじめに：今日の注目ツール
00:09 - トレンドランキング概要
00:25 - #1 Summer2027-Internships
00:54 - #2 n8n
01:24 - #3 datahub
01:45 - #4 upscayl
02:08 - #5 free-for-dev
02:33 - #6 awesome-remote-job
02:59 - #7 Data-Science-For-Beginners
03:27 - #8 PowerToys
03:50 - #9 neovim
04:10 - #10 jellyfin
04:33 - #11 llama_index
04:56 - #12 syft
05:18 - #13 playwright
05:46 - #14 plane
06:09 - #15 pgvector
06:28 - #16 awe
9 views
your app's lockfile doesn't inventory the OS packages in its container.
Syft inventories supported OS and language packages in the built image and exports an SBOM. useful when the question is "what did we actually ship?"
anchore/syft
2 likes · 59 views
grype ⭐ 13k
Grype scans container images and filesystems to find known vulnerabilities, for developers and security teams.
🔗 anchore/grype
#opensource t.co
1 view
Dependabot's now a month late on Python and Go CVEs
---
title: "Dependabot's now a month late on Python and Go CVEs"
published: true
description: "Since May, Dependabot's taken a median of 36 days to pick up new Python and Go CVEs from NVD, and criticals are no quicker."
tags: "python, security, github, go"
canonical_url: "blog.peng.ly"
cover_image: "blog.peng.ly"
ai_assisted: true
---
Django put out a security release on 4 August. One of the fixes, CVE-2026-15307, stops staff users writing files to disk through GeoDjango lookups, which Django says could be "in some cases enabling remote code execution". Here's what GitHub's advisory API says about it:
$ gh api /advisories/GHSA-wvqv-fj8w-qmhm \
--jq '{nvd_published_at, published_at, github_reviewed_at}'
{
"github_reviewed_at": "2026-09-30T23:25:46Z",
"nvd_published_at": "2026-08-04T17:16:46Z",
"published_at": "2026-08-04T18:31:27Z"
}
It was public and on GitHub within an hour and a half. Then it waited 57 days for someone at GitHub to review it, and until then Dependabot doesn't tell anyone. Trivy and Grype didn't spot the ones still waiting either, which I'll get to.
GitHub did warn about this. Its June post on the advisory backlog told Dependabot users:
> New advisories may take longer to trigger, with critical issues prioritized.
I wanted to know how much longer, and whether criticals really do go first.
How a CVE gets to Dependabot
There are two usual ways into GitHub's Advisory Database. A maintainer can publish an advisory on their own repo, and GitHub reviews that. Or someone else publishes the CVE (Apache, the Django team, the Go team, VulnCheck, a bug bounty platform), NVD lists it, and GitHub imports it automatically as "unreviewed". An unreviewed advisory doesn't say which package or versions it's about, and Dependabot only alerts on reviewed ones, so nothing happens until a curator fills that in.
Django's went the second way, and that's the route most of this post is about.
May fell off a cliff
Here's the share of PyPI and Go CVEs on that route that GitHub reviewed within 30 days of NVD listing them:
!NVD-route CVEs reviewed within 30 days, PyPI and Go
NVD-route CVEs reviewed within 30 days, PyPI and Go (the data)
_By the month NVD listed them. September's left out, as by 15 October PyPA and the Go team had only
added 3 from its first fortnight_
Every month from May 2025 to April 2026 was somewhere between 73 and 100%. Then May dropped to 57%, and June and July didn't make it to one in ten. Across May to mid-September it's 31%, against 88% for the same months last year. August's a bit better at 24%, but that's only 37 CVEs and nearly all of them Python, so I wouldn't call it a recovery yet.
It's both ecosytems at once, too. PyPI went from 81% to 34%, and Go from 96% to 27%. The typical wait went from same-day to 36 days.
You can't see GitHub's queue from its API, as unreviewed advisories don't name a package, so I came at it from the other end. PyPA and the Go team keep their own vulnerability databases on OSV. I took every CVE from 2024 onwards in those, kept the ones that came in through NVD and not a repo advisory, and looked up when GitHub reviewed each. That's about 2,000 CVEs, 450 of them from this May to mid-September. I left out Go's standard library, since GitHub doesn't review those in any year, and openssl-encrypt, a small Python package that got 50 CVEs in two batches in August and would have dragged that month down on its own. npm and Maven don't have a database of their own outside GitHub's, so I can't do this for them. They might be fine, I've no idea.
Criticals wait just as long
So, "critical issues prioritized":
!Reviewed within 30 days, by severity
Reviewed within 30 days, by severity (the data)
_15 of 20 critical, 35 of 40 high and 126 of 140 medium or low CVEs last year,
then 22 of 70, 44 of 130 and 77 of 254 this year_
Criticals were the slowest group last year too, so I doubt it's new. Seven critical golang.org/x/crypto CVEs NVD listed on 22 May (one is the SSH agent not enforcing a key's confirm-before-use constraint) were all reviewed on 25 June, 34 days later. Maybe criticals do jump the queue for other kinds of advisory, but for these I cant see it.
Big projects too
I half expected a long tail of obscure stuff nobody installs. Here's the share of each project's NVD-route CVEs reviewed within 30 days:
| Package | 2024-25 | 2026 |
| ------------------- | ------- | ----- |
| Mattermost | 154/155 | 18/42 |
| Apache Airflow | 27/27 | 5/48 |
| Gitea | 10/10 | 0/15 |
| golang.org/x/crypto | 3/5 | 0/14 |
| Django | 26/26 | 3/13 |
The 2026 column is May to mid-September again. Airflow there includes its provider packages, and Mattermost all its modules and plugins. Airflow core on its own went from 21 of 21 to none of 34.
They do get there in the end. 99% of June's CVEs have been reviewed by now, 83% of July's and 73% of August's. 36 from May to mid-September still haven't, and when I checked them all again on 16 October, none had moved.
Repo advisories wait too
The other route isn't any quicker. Once a maintainer publishes an advisory, GitHub's docs say reviewing it and sending Dependabot alerts "can take up to 72 hours". In September someone from GitHub's community team replied to a thread about slow CVE requests:
> we're currently processing records in the order they're received, with a turnaround of approximately five weeks.
And personally, since mid-August maintainers have published 58 of the advisories I've reported, 51 of them for packages Dependabot covers. GitHubs reviewed 9 so far, which took anywhere from 6 to 38 days, and the oldest one still missing from its database went public on 14 August.
NIST changed something the same fortnight
Why now? Tbh I don't know. GitHub says that "since mid-April" it hasn't consistently met its own goals for publishing. On 15 April, NIST changed how NVD works: it now only adds its own details, like severity scores and product lists, to CVEs that meet certain criteria (actively exploited, used by the US government and so on), and the rest wait.
So maybe GitHub's curators leaned on NVD's details and lost them when NIST stopped. Or maybe they're just burried under everything else coming in - GitHub's June post says its CNA got almost 4,000 CVE requests in May alone, nearly ten times the year before. My repo advisories come with the package and versions already filled in by the maintainer, so they don't need anything from NVD, and they're slow too. That makes me lean towards the queue, but I can't prove it from out here.
Quite honestly, this isn't good enough. GitHub - you need to do better. Millions of downstream apps trust you with their security, and you're taking weeks or months to send out Dependabot alerts for known critical bugs.
Trivy and Grype don't see them either
On 15 October I took 16 of the still-unreviewed PyPI CVEs, pinned each one's affected version in a requirements.txt, and ran Trivy 0.76 and Grype 0.120 on default settings. Neither found a single one. Grype with CPE matching turned on found 5. osv-scanner checks OSV, which has PyPA's database in it, and found all 16, which is a bit of a given since that's where I got them from, but thats also the point. If PyPA has it, osv-scanner will tell you, and it's one line to try:
osv-scanner scan source -r .
Go's less clear cut. Go's own database had 83% of these CVEs within a month last year and 19% this year, so govulncheck isn't any quicker than GitHub for these right now.
I'll run it all again in November and see whether the wait's back under a month.
Live SBOM & Security Fixes: Anchore Devs Improve Syft & Grype (October 22nd)
Join our weekly *Open Source Security* live stream! Watch Anchore's Developer Relations and Engineering teams collaborate in real-time on crucial *Software Supply Chain Security* tools. This session focuses on improving *Syft* (for *SBOM* generation) and *Grype* (for *vulnerability scanning*), addressing community-raised issues and pull requests.
Every Thursday, "Open Source Gardening" offers a transparent look into maintaining popular *open source security* projects. We'll dive into items marked 'needs discussion' and, time permitting, tackle other interesting contributions. Learn development best practices, understand the challenges of *SBOM* accuracy, and see how *vulnerability scanning* tools evolve. Whether you're a contributor, user, or just curious about *open source security*, tune in to learn and engage with the minds behind Anchore's OSS tools.
*Agenda:*
- Discuss and resolve issues/PRs tagged 'needs discussion'.
- Tackle other high-priority or interesting community contributions for Syft, Grype, and related projects.
*Resources & Learn More:*
- Learn about SBOMs: [Link to Anchore's SBOM pillar page/guide if available]
- Dive into Software Supply Chain Security: [Link to relevant Anchore pillar page/blog if available]
- Syft on GitHub: anchore/syft
- Grype on GitHub: anchore/grype
- Join the Community Discussion: anchore.com
- All Anchore Open Source Projects: github.com/anchore
- Sign-up for the OSS Newsletter: get.anchore.com
#OpenSourceSecurity #SBOM #SoftwareSupplyChainSecurity
[ar] بث مباشر حول SBOM وإصلاحات الأمان: مطورو Anchore يعملون على تحسين Syft وGrype (22 أكتوبر)
انضموا إلى بثنا المباشر الأسبوعي حول *أمن البرمجيات مفتوحة المصدر*! شاهدوا فرق علاقات المطورين والهندسة في Anchore وهم يتعاونون مباشرةً على أدوات *أمن سلسلة توريد البرمجيات* الأساسية. تركز هذه الجلسة على تحسين *Syft* (لإنشاء *SBOM*) و*Grype* (لفحص الثغرات الأمنية)، ومعالجة المشكلات التي يطرحها المجتمع وطلبات السحب.
في كل خميس، تقدم لكم "صيانة البرمجيات مفتوحة المصدر" نظرةً شاملةً على صيانة مشاريع *أمن البرمجيات مفتوحة المصدر* الشائعة. سنتعمق في المواضيع التي تحمل علامة "بحاجة إلى نقاش"، وإذا سمح الوقت، سنتناول مساهمات أخرى مثيرة للاهتمام. تعرّفوا على أفضل ممارسات التطوير، وافهموا تحديات دقة *SBOM*، وشاهدوا كيف تتطور أدوات *فحص الثغرات الأمنية*. سواء كنتم مساهمين أو مستخدمين أو مجرد مهتمين بأمن البرمجيات مفتوحة المصدر، تابعونا لتتعلموا وتتفاعلوا مع العقول التي تقف وراء أدوات Anchore مفتوحة المصدر.
*جدول الأعمال:*
- مناقشة وحل المشكلات/طلبات السحب التي تحمل علامة "بحاجة إلى نقاش".
- مناقشة وحل المشكلات/طلبات السحب التي تحمل علامة "بحاجة إلى نقاش".
- - المساهمة في مشاريع مجتمعية أخرى ذات أولوية عالية أو مثيرة للاهتمام لمشاريع Syft وGrype والمشاريع ذات الصلة.
*الموارد والمزيد من المعلومات:*
- تعرّف على مكونات SBOM: [رابط لصفحة/دليل Anchore الخاص بمكونات SBOM إن وُجد]
- تعمّق في أمن سلسلة توريد البرمجيات: [رابط لصفحة/مدونة Anchore ذات الصلة إن وُجدت]
- Syft على GitHub: anchore/syft
- Grype على GitHub: anchore/grype
- انضم إلى نقاش المجتمع: anchore.com
- جميع مشاريع Anchore مفتوحة المصدر: github.com/anchore
- اشترك في النشرة الإخبارية للمشاريع مفتوحة المصدر: get.anchore.com
#أمن_البرمجيات_مفتوحة_المصدر #SBOM #أمن_سلسلة_توريد_البرمجيات
[bn] লাইভ SBOM ও সিকিউরিটি ফিক্স: Anchore ডেভেলপাররা Syft ও Grype-এর উন্নতি ঘটিয়েছেন (২২শে অক্টোবর)
আমাদের সাপ্তাহিক *ওপেন সোর্স সিকিউরিটি* লাইভ স্ট্রিমে যোগ দিন! Anchore-এর ডেভেলপার রিলেশনস এবং ইঞ্জিনিয়ারিং টিমকে গুরুত্বপূর্ণ *সফটওয়্যার সাপ্লাই চেইন সিকিউরিটি* টুলস নিয়ে রিয়েল-টাইমে একসাথে কাজ করতে দেখুন। এই সেশনটি *Syft* (*SBOM* তৈরির জন্য) এবং *Grype* (*ভালনারেবিলিটি স্ক্যানিং*-এর জন্য)-এর উন্নতি সাধন, এবং কমিউনিটি-উত্থিত ইস্যু ও পুল রিকোয়েস্টগুলো সমাধান করার উপর আলোকপাত করবে।
প্রতি বৃহস্পতিবার, "ওপেন সোর্স গার্ডেনিং" জনপ্রিয় *ওপেন সোর্স সিকিউরিটি* প্রজেক্টগুলো রক্ষণাবেক্ষণের একটি স্বচ্ছ চিত্র তুলে ধরে। আমরা 'আলোচনা প্রয়োজন' হিসেবে চিহ্নিত বিষয়গুলো নিয়ে গভীরভাবে আলোচনা করব এবং সময় পেলে অন্যান্য আকর্ষণীয় কন্ট্রিবিউশনগুলোও সমাধান করব। ডেভেলপমেন্টের সেরা অনুশীলনগুলো শিখুন, *SBOM*-এর নির্ভুলতার চ্যালেঞ্জগুলো বুঝুন, এবং দেখুন কীভাবে *ভালনারেবিলিটি স্ক্যানিং* টুলগুলো বিকশিত হচ্ছে। আপনি একজন কন্ট্রিবিউটর, ব্যবহারকারী, বা *ওপেন সোর্স সিকিউরিটি* সম্পর্কে শুধু কৌতূহলীই হোন না কেন, Anchore-এর OSS টুলগুলোর পেছনের কারিগরদের সাথে শিখতে ও যুক্ত হতে আমাদের সাথে যোগ দিন।
*এজেন্ডা:*
- 'আলোচনা প্রয়োজন' হিসেবে ট্যাগ করা ইস্যু/PR নিয়ে আলোচনা এবং সমাধান করা।
- Syft, Grype, এবং সম্পর্কিত প্রোজেক্টগুলোর জন্য অন্যান্য উচ্চ-অগ্রাধিকার সম্পন্ন বা আকর্ষণীয় কমিউনিটি কন্ট্রিবিউশনে অংশ নিন।
*রিসোর্স ও আরও জানুন:*
- SBOM সম্পর্কে জানুন: [উপলব্ধ থাকলে Anchore-এর SBOM পিলার পেজ/গাইডের লিঙ্ক]
- সফটওয়্যার সাপ্লাই চেইন সিকিউরিটি সম্পর্কে বিস্তারিত জানুন: [উপলব্ধ থাকলে প্রাসঙ্গিক Anchore পিলার পেজ/ব্লগের লিঙ্ক]
- GitHub-এ Syft: anchore/syft
- GitHub-এ Grype: anchore/grype
- কমিউনিটি আলোচনায় যোগ দিন: anchore.com
- Anchore-এর সকল ওপেন সোর্স প্রোজেক্ট: github.com/anchore
- OSS নিউজলেটারের জন্য সাইন-আপ করুন: get.anchore.com
#OpenSourceSecurity #SBOM #SoftwareSupplyChainSecurity
[iw] שידור חי של SBOM ותיקוני אבטחה: מפתחי Anchore משפרים את Syft ו-Grype (22 באוקטובר)
הצטרפו לשידור החי השבועי שלנו של *אבטחת קוד פתוח*! צפו בצוותי יחסי המפתחים וההנדסה של Anchore משתפים פעולה בזמן אמת בכלים חיוניים של *אבטחת שרשרת אספקה של תוכנה*. מפגש זה מתמקד בשיפור *Syft* (לייצור *SBOM*) ו-*Grype* (לסריקת פגיעויות*), תוך התייחסות לבעיות שהועלו על ידי הקהילה ובקשות משיכה.
בכל יום חמישי, "גינון קוד פתוח" מציע מבט שקוף על תחזוקת פרויקטים פופולריים של *אבטחת קוד פתוח*. נצלול לפריטים המסומנים 'צריך דיון', ובמידת הזמן, נטפל בתרומות מעניינות אחרות. למדו שיטות עבודה מומלצות לפיתוח, הבינו את האתגרים של דיוק *SBOM*, ונראו כיצד כלי *סריקת פגיעויות* מתפתחים. בין אם אתם תורמים, משתמשים או סתם סקרנים לגבי *אבטחת קוד פתוח*, הצטרפו כדי ללמוד וליצור קשר עם המוחות שמאחורי כלי ה-OSS של Anchore.
*סדר יום:*
- דנו ופתרו בעיות/יחסי ציבור המסומנים 'צריך דיון'.
*סדר יום:* - התמודד עם תרומות קהילתיות אחרות בעלות עדיפות גבוהה או מעניינות עבור Syft, Grype ופרויקטים קשורים.
*משאבים ומידע נוסף:*
- למד על SBOMs: [קישור לדף/מדריך עמודי התווך של SBOM של Anchore אם זמין]
- התעמק באבטחת שרשרת אספקה של תוכנה: [קישור לדף/בלוג רלוונטי של Anchore אם זמין]
- Syft ב-GitHub: anchore/syft
- Grype ב-GitHub: anchore/grype
- הצטרף לדיון הקהילתי: anchore.com
- כל פרויקטי הקוד הפתוח של Anchore: github.com/anchore
- הירשם לניוזלטר של OSS: get.anchore.com
#אבטחתקודפתוח #SBOM #אבטחתשרשרתאספקהשלתוכנה
[ko] 실시간 SBOM 및 보안 패치: Anchore 개발자들의 Syft와 Grype 개선 (10월 22일)
매주 목요일 진행되는 *오픈 소스 보안* 라이브 스트림에 참여하세요! Anchore의 개발자 관계 및 엔지니어링 팀이 중요한 *소프트웨어 공급망 보안* 도구를 위해 실시간으로 협업하는 모습을 지켜보세요. 이번 세션에서는 *SBOM* 생성 도구인 *Syft*와 *취약점 스캔 도구*인 *Grype* 개선에 초점을 맞추고, 커뮤니티에서 제기된 문제와 풀 리퀘스트를 해결합니다.
매주 목요일, "오픈 소스 가드닝"에서는 인기 있는 *오픈 소스 보안* 프로젝트를 유지 관리하는 과정을 투명하게 공개합니다. '토론 필요'로 표시된 항목을 심층적으로 다루고, 시간이 허락한다면 다른 흥미로운 기여 사항들도 해결합니다. 개발 모범 사례를 배우고, *SBOM* 정확도의 어려움을 이해하고, *취약점 스캔* 도구의 발전 과정을 살펴보세요. 기여자, 사용자, 또는 *오픈 소스 보안*에 관심 있는 분이라면 누구나 참여하여 Anchore의 오픈 소스 도구를 만든 사람들과 소통하고 배울 수 있는 기회를 놓치지 마세요.
*아젠다:*
- '토론 필요' 태그가 있는 문제/풀 리퀘스트 논의 및 해결
*토론 필요' 태그가 있는 문제/풀 리퀘스트 논의 및 해결* - Syft, Grype 및 관련 프로젝트에 대한 우선순위가 높거나 흥미로운 커뮤니티 기여 활동을 진행합니다.
*자료 및 자세히 알아보기:*
- SBOM에 대해 알아보기: [Anchore의 SBOM 핵심 페이지/가이드 링크(있는 경우)]
- 소프트웨어 공급망 보안 심층 분석: [관련 Anchore 핵심 페이지/블로그 링크(있는 경우)]
- Syft GitHub: anchore/syft
- Grype GitHub: anchore/grype
- 커뮤니티 토론 참여: anchore.com
- 모든 Anchore 오픈 소스 프로젝트: github.com/anchore
- OSS 뉴스레터 신청: get.anchore.com
#오픈소스보안 #SBOM #소프트웨어공급망보안
[ml] തത്സമയ SBOM & സുരക്ഷാ പരിഹാരങ്ങൾ: Syft & Grype മെച്ചപ്പെടുത്തി Anchore ഡെവലപ്പർമാർ (ഒക്ടോബർ 22)
ഞങ്ങളുടെ പ്രതിവാര *ഓപ്പൺ സോഴ്സ് സെക്യൂരിറ്റി* ലൈവ് സ്ട്രീമിൽ ചേരൂ! നിർണായകമായ *സോഫ്റ്റ്വെയർ സപ്ലൈ ചെയിൻ സെക്യൂരിറ്റി* ടൂളുകളിൽ ആങ്കറിന്റെ ഡെവലപ്പർ റിലേഷൻസ് ആൻഡ് എഞ്ചിനീയറിംഗ് ടീമുകൾ തത്സമയം സഹകരിക്കുന്നത് കാണുക. ഈ സെഷൻ *Syft* (*SBOM* ജനറേഷനായി) *Grype* (*vulnerability scanning*-നായി) മെച്ചപ്പെടുത്തുന്നതിലും, കമ്മ്യൂണിറ്റി ഉന്നയിക്കുന്ന പ്രശ്നങ്ങൾ പരിഹരിക്കുന്നതിലും, പുൾ അഭ്യർത്ഥനകൾ പരിഹരിക്കുന്നതിലും ശ്രദ്ധ കേന്ദ്രീകരിക്കുന്നു.
എല്ലാ വ്യാഴാഴ്ചയും, "ഓപ്പൺ സോഴ്സ് ഗാർഡനിംഗ്" ജനപ്രിയ *ഓപ്പൺ സോഴ്സ് സുരക്ഷാ* പ്രോജക്റ്റുകൾ പരിപാലിക്കുന്നതിനെക്കുറിച്ചുള്ള സുതാര്യമായ ഒരു വീക്ഷണം വാഗ്ദാനം ചെയ്യുന്നു. 'ചർച്ച ആവശ്യമാണ്' എന്ന് അടയാളപ്പെടുത്തിയ ഇനങ്ങളിൽ ഞങ്ങൾ മുഴുകുകയും സമയം അനുവദിക്കുന്നതുപോലെ മറ്റ് രസകരമായ സംഭാവനകൾ കൈകാര്യം ചെയ്യുകയും ചെയ്യും. വികസനത്തിലെ മികച്ച രീതികൾ പഠിക്കുക, *SBOM* കൃത്യതയുടെ വെല്ലുവിളികൾ മനസ്സിലാക്കുക, *vulnerability scanning* ടൂളുകൾ എങ്ങനെ വികസിക്കുന്നുവെന്ന് കാണുക. നിങ്ങൾ ഒരു സംഭാവകനോ ഉപയോക്താവോ ആകട്ടെ, അല്ലെങ്കിൽ *ഓപ്പൺ സോഴ്സ് സുരക്ഷ*യെക്കുറിച്ച് ജിജ്ഞാസയുള്ളവനോ ആകട്ടെ, ആങ്കറിന്റെ OSS ടൂളുകളുടെ പിന്നിലെ മനസ്സുകളെ പഠിക്കാനും അവരുമായി ഇടപഴകാനും ട്യൂൺ ചെയ്യുക.
*അജണ്ട:*
- 'ചർച്ച ആവശ്യമാണ്' എന്ന് ടാഗ് ചെയ്തിരിക്കുന്ന പ്രശ്നങ്ങൾ/PR-കൾ ചർച്ച ചെയ്ത് പരിഹരിക്കുക.
- Syft, Grype, അനുബന്ധ പ്രോജക്റ്റുകൾ എന്നിവയ്ക്കായി ഉയർന്ന മുൻഗണനയുള്ളതോ താൽപ്പര്യമുണർത്തുന്നതോ ആയ മറ്റ് കമ്മ്യൂണിറ്റി സംഭാവനകൾ കൈകാര്യം ചെയ്യുക.
*വിഭവങ്ങളും കൂടുതലറിയുക:*
- SBOM-കളെക്കുറിച്ച് അറിയുക: [ലഭ്യമെങ്കിൽ Anchore-ന്റെ SBOM പില്ലർ പേജിലേക്കുള്ള/ഗൈഡിലേക്കുള്ള ലിങ്ക്]
- സോഫ്റ്റ്വെയർ സപ്ലൈ ചെയിൻ സുരക്ഷയിലേക്ക് കടക്കുക: [ലഭ്യമെങ്കിൽ പ്രസക്തമായ Anchore പില്ലർ പേജിലേക്കുള്ള/ബ്ലോഗിലേക്കുള്ള ലിങ്ക്]
- Syft on GitHub: anchore/syft
- GitHub-ലെ Grype: anchore/grype
- കമ്മ്യൂണിറ്റി ചർച്ചയിൽ ചേരുക: anchore.com
- എല്ലാ Anchore ഓപ്പൺ സോഴ്സ് പ്രോജക്റ്റുകളും: github.com/anchore
- OSS വാർത്താക്കുറിപ്പിനായി സൈൻ അപ്പ് ചെയ്യുക: get.anchore.com
#OpenSourceSecurity #SBOM #SoftwareSupplyChainSecurity
[nl-NL] Live SBOM & beveiligingsoplossingen: Anchore-ontwikkelaars verbeteren Syft & Grype (22 oktober)
Neem deel aan onze wekelijkse livestream over *Open Source Security*! Kijk hoe de teams Developer Relations en Engineering van Anchore in realtime samenwerken aan cruciale tools voor *Software Supply Chain Security*. Deze sessie richt zich op het verbeteren van *Syft* (voor het genereren van *SBOM*-bestanden) en *Grype* (voor *kwetsbaarheidsscans*), het aanpakken van door de community aangekaarte problemen en pull requests.
Elke donderdag biedt "Open Source Gardening" een transparante blik op het onderhoud van populaire *open source security*-projecten. We duiken in items die gemarkeerd zijn als 'moet besproken worden' en, indien de tijd het toelaat, behandelen we andere interessante bijdragen. Leer over best practices voor ontwikkeling, begrijp de uitdagingen van *SBOM*-nauwkeurigheid en zie hoe tools voor *kwetsbaarheidsscans* evolueren. Of je nu een bijdrager, gebruiker bent of gewoon nieuwsgierig naar *open source security*, kijk mee om te leren en in gesprek te gaan met de mensen achter de OSS-tools van Anchore.
*Agenda:*
- Bespreken en oplossen van problemen/pull requests met de tag 'moet besproken worden'.
- Pak andere prioritaire of interessante communitybijdragen aan voor Syft, Grype en gerelateerde projecten.
*Bronnen & Meer informatie:*
- Leer meer over SBOM's: [Link naar de pagina/handleiding van Anchore over SBOM's indien beschikbaar]
- Duik in Software Supply Chain Security: [Link naar de relevante pagina/blog van Anchore over SBOM's indien beschikbaar]
- Syft op GitHub: anchore/syft
- Grype op GitHub: anchore/grype
- Doe mee aan de communitydiscussie: anchore.com
- Alle open source-projecten van Anchore: github.com/anchore
- Meld je aan voor de OSS-nieuwsbrief: get.anchore.com
#OpenSourceSecurity #SBOM #SoftwareSupplyChainSecurity
[pl] Na żywo: SBOM i poprawki bezpieczeństwa: Programiści Anchore ulepszają Syft i Grype (22 październ...
Dołącz do naszej cotygodniowej transmisji na żywo z *Open Source Security*! Obejrzyj, jak zespoły ds. relacji z deweloperami i inżynierii w Anchore współpracują w czasie rzeczywistym nad kluczowymi narzędziami *Open Supply Chain Security*. Ta sesja koncentruje się na ulepszaniu *Syft* (do generowania *SBOM*) i *Grype* (do *skanowania luk w zabezpieczeniach*), rozwiązując problemy zgłaszane przez społeczność i pull requesty.
W każdy czwartek „Open Source Gardening” oferuje przejrzyste spojrzenie na utrzymanie popularnych projektów *open source security*. Zajmiemy się tematami oznaczonymi jako „wymagające dyskusji” i, jeśli pozwoli na to czas, omówimy inne interesujące kwestie. Poznaj najlepsze praktyki programistyczne, poznaj wyzwania związane z dokładnością *SBOM* i obserwuj, jak ewoluują narzędzia *skanowania luk w zabezpieczeniach*. Niezależnie od tego, czy jesteś współtwórcą, użytkownikiem, czy po prostu ciekawi Cię *bezpieczeństwo open source*, dołącz do nas, aby poznać i porozmawiać z twórcami narzędzi OSS firmy Anchore.
*Program:*
- Omówienie i rozwiązanie problemów/PR oznaczonych jako „wymagające dyskusji”.
- Zajmij się innymi priorytetowymi lub interesującymi projektami społecznościowymi dla Syft, Grype i pokrewnych projektów.
*Zasoby i dowiedz się więcej:*
- Dowiedz się więcej o SBOM: [Link do strony/przewodnika Anchore dotyczącego filaru SBOM, jeśli dostępny]
- Zanurz się w temacie bezpieczeństwa łańcucha dostaw oprogramowania: [Link do odpowiedniej strony/bloga Anchore dotyczącego filaru, jeśli dostępny]
- Syft na GitHubie: anchore/syft
- Grype na GitHubie: anchore/grype
- Dołącz do dyskusji społeczności: anchore.com
- Wszystkie projekty open source Anchore: github.com/anchore
- Zapisz się do newslettera OSS: get.anchore.com
#OpenSourceSecurity #SBOM #SoftwareSupplyChainSecurity
[pt-BR] Live de SBOM e Correções de Segurança: Desenvolvedores da Anchore aprimoram o Syft e o Grype (22 ...
Participe da nossa transmissão ao vivo semanal sobre *Segurança de Código Aberto*! Veja as equipes de Relações com Desenvolvedores e Engenharia da Anchore colaborando em tempo real em ferramentas cruciais de *Segurança da Cadeia de Suprimentos de Software*. Esta sessão se concentra em aprimorar o *Syft* (para geração de *SBOM*) e o *Grype* (para *varredura de vulnerabilidades*), abordando problemas e pull requests levantados pela comunidade.
Todas as quintas-feiras, o "Open Source Gardening" oferece uma visão transparente sobre a manutenção de projetos populares de *segurança de código aberto*. Vamos nos aprofundar em itens marcados como "precisa de discussão" e, se houver tempo, abordar outras contribuições interessantes. Aprenda as melhores práticas de desenvolvimento, entenda os desafios da precisão do *SBOM* e veja como as ferramentas de *varredura de vulnerabilidades* evoluem. Seja você um colaborador, usuário ou apenas curioso sobre *segurança de código aberto*, participe para aprender e interagir com as mentes por trás das ferramentas de código aberto da Anchore.
*Agenda:*
- Discutir e resolver problemas/PRs marcados como "precisa de discussão".
- Abordar outras contribuições prioritárias ou interessantes da comunidade para o Syft, Grype e projetos relacionados.
*Recursos e Saiba Mais:*
- Saiba mais sobre SBOMs: [Link para a página/guia do pilar SBOM da Anchore, se disponível]
- Explore a Segurança da Cadeia de Suprimentos de Software: [Link para a página/blog relevante do pilar Anchore, se disponível]
- Syft no GitHub: anchore/syft
- Grype no GitHub: anchore/grype
- Participe da discussão da comunidade: anchore.com
- Todos os projetos de código aberto da Anchore: github.com/anchore
- Inscreva-se na newsletter de código aberto: get.anchore.com
#SegurançaDeCódigoAberto #SBOM #SegurançaDaCadeiaDeSuprimentosDeSoftware
[uk] Live SBOM та виправлення безпеки: розробники Anchore вдосконалюють Syft та Grype (22 жовтня)
Приєднуйтесь до нашої щотижневої прямої трансляції *Безпека відкритого коду*! Дивіться, як команди Anchore зі зв'язків з розробниками та інженерії співпрацюють у режимі реального часу над ключовими інструментами *Безпеки ланцюга постачання програмного забезпечення*. Ця сесія зосереджена на вдосконаленні *Syft* (для створення *SBOM*) та *Grype* (для *сканування вразливостей*), вирішенні проблем, порушених спільнотою, та запитах на враження.
Щочетверга «Садівництво з відкритим кодом» пропонує прозорий погляд на підтримку популярних проектів *безпеки відкритого коду*. Ми заглибимося в пункти, позначені як «потребує обговорення», і, якщо дозволить час, розглянемо інші цікаві внески. Вивчіть передові практики розробки, зрозумійте проблеми точності *SBOM* та побачите, як розвиваються інструменти *сканування вразливостей*. Незалежно від того, чи ви учасник, користувач чи просто цікавитеся *безпекою відкритого коду*, приєднуйтесь, щоб навчатися та взаємодіяти з ідеалами, що стоять за інструментами OSS від Anchore.
*Порядок денний:*
- Обговорення та вирішення проблем/запитів на враження з тегом «потребує обговорення».
- Розгляньте інші пріоритетні або цікаві внески спільноти для Syft, Grype та пов'язаних проектів.
*Ресурси та докладніша інформація:*
- Дізнайтеся про SBOM: [Посилання на сторінку/посібник Anchore з SBOM, якщо є]
- Зануртесь у безпеку ланцюжка постачання програмного забезпечення: [Посилання на відповідну сторінку/блог Anchore, якщо є]
- Syft на GitHub: anchore/syft
- Grype на GitHub: anchore/grype
- Приєднуйтесь до обговорення спільноти: anchore.com
- Усі проекти з відкритим кодом Anchore: github.com/anchore
- Підпишіться на розсилку OSS: get.anchore.com
#OpenSourceSecurity #SBOM #SoftwareSupplyChainSecurity
438 views
Part 2: From Docker Compose up to Terraform on AWS, and the CI That Checks It
Part 1 ended with a pipeline that turns HL7 v2 into FHIR R4 and runs on a laptop with make demo. This part is about the distance between that and something a trust could run, and about the checks that tell you whether you have crossed it.
The short version: the distance is larger than the Terraform makes it look, and the first thing I did this week was build the pipeline that proves it.
The problem
docker compose up gives you a working system and almost no evidence. It tells you the code runs. It tells you nothing about whether the database is reachable from the internet, whether a credential is sitting in the history, or whether the thing you deploy is the thing you tested.
In most settings that gap is a nuisance. In an NHS setting, it is the whole job. The data is patient-identifiable, auditors ask questions about provenance, and "it worked on my laptop" doesn't answer any of them.
So the move from compose to AWS is not really a move from one runtime to another. It is a move from a system you have seen working to a system you can show is working. That needs two things: infrastructure described as code, and a pipeline that checks it on every change.
I had the first. I did not have the second, and this week showed me what that was costing.
What I built
The repo describes an AWS deployment in Terraform: a VPC with public, private and database subnets, an EKS cluster with a managed node group, an RDS Postgres instance for the HAPI FHIR server, an S3 bucket for the dead-letter path, and KMS keys. terraform plan reports 46 resources.
!The local stack on the left and the AWS target on the right, with the CI pipeline between them
Two honest notes before anything else.
The provider block in infra/terraform/versions.tf is this:
provider "aws" {
region = var.aws_region
access_key = "mock"
secret_key = "mock"
skip_credentials_validation = true
skip_metadata_api_check = true
skip_requesting_account_id = true
}
That is how the plan runs in CI without an AWS account. It hasn't always been like that. In April I ran apply against my own AWS account to see the stack come up, and that is where the EKS add-on version conflicts in docs/lessons-learnt.md came from. Nothing from that run is still up, so the code you can clone today has been planned, not deployed. The mock credentials keep it free for anyone else to run.
The second note is worse, and the pipeline found it.
The pipeline, and what it found
Until this week the repo had a .gitlab-ci.yml describing five stages, and nothing had ever run it. Porting it to GitHub Actions took an afternoon. Getting it green took longer, because it kept being right. Some of what it found turned up while I was porting it, and the rest arrived on its first real run.
The secret scan had never scanned anything
The pipeline runs Gitleaks. The repo has a .gitleaks.toml. The file held exactly this:
# Gitleaks config - ignore false positives in vendored terraform modules
One comment. No rules, and no [extend] block. Gitleaks' documentation describes two options for a custom config: "define your own configuration, default rules do not apply", or extend one, where "useDefault will extend the default gitleaks config built into the binary".
Mine was the first kind. A configuration with no rules, replacing roughly a hundred built-in ones.
I checked it rather than assuming. A directory with a planted Slack bot token, scanned three ways with gitleaks 8.28.0:
no config file leaks found: 1 exit 1
the repo's .gitleaks.toml no leaks found exit 0
[extend] useDefault = true leaks found: 1 exit 1
The middle line is the one that matters. For months, a secret scan ran, found nothing, and the nothing meant nothing. The repo also carries docs/verification/gitleaks.json, a stored run showing zero findings, which I had been treating as evidence that the repo was clean. It is evidence that the scanner was switched off.
When I first wrote this section, the next line said I had no reason to think there was a secret in there. Then the fixed scanner ran over the git history and found one.
On 26 April I committed a PDS API key to .env.example while getting a demo working. The next commit blanked the value. The file looked clean from then on, and the key sat in the public history for six months. A scanner pointed at the current files would never have seen it. gitleaks git reads every commit, and it did.
The key is revoked now. It stays in the history because rewriting a public history breaks every clone and tag. Revoking it is what makes it harmless. The repo's .gitleaksignore now holds that one finding's fingerprint, with a comment saying when the key was committed and when it was revoked. Any other secret still fails the build.
So the stored report with zero findings wasn't just meaningless. It was wrong, and I had been treating it as evidence.
The test job could not have passed
The GitLab test job runs:
pytest -q --junitxml=junit.xml --cov=. --cov-report=xml
pytest-cov appears in none of the three requirements-dev.txt files. I ran that command against each service in a clean virtualenv built from its pinned requirements, and got the same thing three times:
error: unrecognised arguments: --cov=. --cov-report=xml
The tests themselves passed. Sixteen of them pass as soon as you drop the flags. It was the job around them that had never worked, and because nothing ran it, nothing said so.
With pytest-cov added, the numbers are ingest 98 per cent, transform 83 per cent, pds-client 93 per cent.
The database could call the internet
The new pipeline runs Trivy against the Terraform. Its first finding was critical, in the security group in front of the FHIR database:
resource "aws_security_group" "rds" {
description = "HAPI FHIR Postgres, ingress from EKS nodes only"
ingress {
description = "Postgres from EKS"
from_port = 5432
to_port = 5432
protocol = "tcp"
security_groups = [module.eks.node_security_group_id]
}
egress {
from_port = 0
to_port = 0
protocol = "-1"
cidr_blocks = ["0.0.0.0/0"]
}
}
Look at the care in the ingress rule and the shrug in the egress one. Inbound is locked to the node group's security group, port 5432, TCP only. Outbound is every port, every protocol, every address on the internet.
The description even says "ingress from EKS nodes only", which is true and beside the point. I wrote a careful inbound rule, felt careful, and pasted the default outbound rule underneath it.
The fix restricts egress to the VPC.
The cluster API was open to the internet
My first count of Trivy findings was wrong. I ran it on a copy of the repo where it never downloaded the community EKS module, so it only scanned my own files. A clean checkout in CI downloads the module and scans what my inputs do to it. That found three more critical findings.
Two were the same problem. The EKS API endpoint was public and open to 0.0.0.0/0:
# API endpoint is private by default; grant access to the CI runner via
# the public endpoint + CIDR allow-list when needed.
cluster_endpoint_public_access = true
cluster_endpoint_public_access_cidrs = ["0.0.0.0/0"] # tighten in prod
The comment says private. The code says public, to everyone. Nothing outside the VPC needs that endpoint, because Argo CD pulls from inside the cluster, so it is now private.
The third was node egress to any address, the same rule as the database. This one I kept. The nodes need outbound internet to pull images and to call the PDS API. It sits in a .trivyignore.yaml, scoped to the one module file and with the reason written next to it. I checked the scope by putting the database rule back the way it was: the build failed.
A dependency I never chose
The image scan failed on all three services for the same reason. fastapi==0.115.0 pulls in starlette 0.38.6, which has CVE-2024-47874, rated high. I had pinned FastAPI and never looked at what it brought with it.
Bumping FastAPI alone wasn't enough. The newer Starlette releases had high findings of their own, fixed only in 1.x, and prometheus-fastapi-instrumentator 7.0.0 capped Starlette below 1.0. Both had to move. All sixteen tests still pass, and coverage hasn't changed.
What is left on the Terraform is four findings, none above medium: IAM authentication and deletion protection on the database, a customer-managed key for Performance Insights, and access logging on the bucket. Those are real, and they are on the list for Part 5. Every run prints them, along with the accepted one, so they don't live only in my head.
!The seven CI jobs, which ones gate the merge, and what the first runs found
What the pipeline actually checks
Seven jobs run on every pull request into master:
1. lint, ruff over each service.
2. test, pytest with coverage over each service.
3. secrets, Gitleaks over both the working tree and the git history.
4. sast, Semgrep with the p/ci, p/python and p/security-audit rulesets.
5. terraform, fmt -check, then init -backend=false and validate.
6. iac-scan, Trivy against the Terraform.
7. image, a Docker build per service, then a Trivy image scan and a Syft SBOM.
A few decisions inside that are worth more than the list.
Every version is pinned, down to the scanner binaries. The gitleaks problem was a security tool that silently stopped checking, and a floating latest tag is the same failure wearing a different hat. If a tool changes what it catches, I want that to arrive as a version bump I can read in a diff.
terraform validate runs with -backend=false, which initialises the providers without touching remote state, so the job needs no AWS credentials at all. Validation is a question about syntax and types, not about an account.
The IaC scan reports everything and fails only on high and critical. A gate you have not triaged is a gate someone turns off in a week. Report first, then promote findings to blocking as you fix them.
The image is built and scanned but not pushed. There is nowhere to push it to yet, and inventing a registry to make the diagram look complete would be the same instinct that produced the egress rule.
And one job did not come across at all. The GitLab pipeline ended with a deploy stage that bumped a Helm values file and let Argo CD sync it. Its rule was if: $CI_COMMIT_BRANCH == "main". This repo's branch is master. That job could never have run on any commit, which is a tidy summary of the whole week: the pipeline described a system nobody had checked.
Best practices worth stealing
Commit the Terraform lock file. HashiCorp's documentation says "You should include this file in your version control repository", because Terraform "remembers the decisions it made in a dependency lock file" so that "it can (by default) make the same decisions again in future". Mine was in .gitignore. CI is exactly the second machine that needs to make the same decision.
Make the local command and the CI command the same one. The repo's Makefile already had make tf-validate, running init -backend=false, validate and fmt -check. The CI job runs the same three. If it passes on your machine, it passes in CI, and you stop pushing commits to find out.
Scan the history, not just the tree. gitleaks dir checks what is there now. gitleaks git checks what was ever there. A secret removed in a later commit is still published. While you are at it: detect is deprecated, and the README says "v8.19.0 introduced a change that deprecated detect and protect". The modes are git, dir and stdin now.
Make the tool fail loudly or not at all. Semgrep prints its findings and exits 0 unless you pass --error. Trivy does the same unless you pass --exit-code 1, and it is in two of my jobs. So three of the seven would have been decorative by default: they would have printed the problem in a log nobody opens and gone green.
Gitleaks is the exception, and I had it wrong until I tested it. Its help text reads --exit-code int exit code when leaks have been encountered (default 1), which I first skimmed as requiring the flag. It is not: gitleaks exits 1 on a finding whether you ask or not. I had already written the opposite into a draft of this article. Checking the three tools took one command each.
Read why a gate went red. My first iac-scan job passed --no-progress to trivy config. That flag works on trivy image and doesn't exist on trivy config, so the job failed before it scanned a single file. Red, for a reason that had nothing to do with Terraform.
Fix the name, not the rule. Semgrep flagged requests.append({... "http://snomed.info/sct" ...}) as an unencrypted HTTP request. It was a Python list called requests, holding FHIR MedicationRequests, and the URL is a SNOMED CT system identifier that FHIR requires in that exact form. Renaming the list to medication_requests cleared it without switching anything off.
Where AI helps here, and where it doesn't
The port was a good use of AI. Translating a GitLab pipeline into Actions is mechanical, well-documented work, and the shape of the answer is known before you start.
What it did not do is notice. The gitleaks config, the key in the history, the missing pytest-cov, the egress rule and the open endpoint were all found by running things and reading the output, not by looking at the code and thinking about it. Every one of those files reads as correct. A config file with an allowlist comment looks like a config file. A requirements file without pytest-cov looks like a requirements file. An egress rule set to 0.0.0.0/0 is the most common four characters in any Terraform repo.
The same thing happened to me twice in two weeks. In Part 1 it was a retry wrapper raising its own exception type, so the dead-letter path never ran. Here it is a scanner with its rules switched off. Both passed review, mine included, because reading code tells you what it says and running it tells you what it does.
Running things has a catch of its own. The first Trivy count in this article came from an AI-assisted run on a copy of the repo that never downloaded the EKS module. It ran, it printed numbers, and the numbers were wrong. CI's clean checkout was the run that counted.
So the rule from Part 1 survives contact with Part 2: AI drafts, and the specification, the tests and the running system decide. I would add a line to it now. The output of a check is only evidence if you have seen the check fail, in the same place it will run for real.
What I'd do differently
I would have built the pipeline first, before the Terraform, before the Helm charts, probably before the third service. Not because CI is more important than the code, but because for eight weeks I had five stages of YAML that described a quality bar and enforced none of it. That is worse than having no pipeline, because it reads like one.
I would also have protected master before the first workflow landed. The pull request that added the pipeline merged with its own checks red, because nothing required them to pass. A required status check is one setting.
The other thing is smaller and more annoying. docs/lessons-learnt.md and docs/security.md both say every AWS resource carries a DataClass=patient-identifiable tag through Terraform's provider-level default_tags, and describe the audit query that tag makes possible. The default_tags block in versions.tf is commented out. The documentation is describing a feature of the system I meant to build. Fixing that properly belongs with Part 5, on security and compliance, and it is going to be the theme of that article.
Sources
- HashiCorp: Dependency lock file
- HashiCorp: terraform validate
- HashiCorp: terraform fmt
- Gitleaks
- Trivy: misconfiguration scanning
- Trivy AVD-AWS-0104: unrestricted egress
- Trivy AVD-AWS-0040: public EKS endpoint
- Trivy: filtering and .trivyignore.yaml
- GitHub advisory for CVE-2024-47874 in Starlette
- GitHub: about protected branches
- Semgrep CLI reference
- Anchore Syft
- GitHub Actions: workflow syntax
- The code for this article, tag part-2
Next
Part 3, on 28 October, is about the mapping itself: HL7 v2 ADT messages to FHIR R4, and the places it goes quietly wrong, several of them found by readers of Part 1.
What does your pipeline check that you have never watched fail?
---
This is a personal project. It is not affiliated with or endorsed by NHS England or any NHS organisation. It uses the public PDS FHIR sandbox and, earlier in the project, the PDS integration test environment, with synthetic test data only. Views are my own.
11 reactions · 2 comments
Live SBOM & Security Fixes: Anchore Devs Improve Syft & Grype (October 15th)
Join our weekly *Open Source Security* live stream! Watch Anchore's Developer Relations and Engineering teams collaborate in real-time on crucial *Software Supply Chain Security* tools. This session focuses on improving *Syft* (for *SBOM* generation) and *Grype* (for *vulnerability scanning*), addressing community-raised issues and pull requests.
Every Thursday, "Open Source Gardening" offers a transparent look into maintaining popular *open source security* projects. We'll dive into items marked 'needs discussion' and, time permitting, tackle other interesting contributions. Learn development best practices, understand the challenges of *SBOM* accuracy, and see how *vulnerability scanning* tools evolve. Whether you're a contributor, user, or just curious about *open source security*, tune in to learn and engage with the minds behind Anchore's OSS tools.
*Agenda:*
- Discuss and resolve issues/PRs tagged 'needs discussion'.
- Tackle other high-priority or interesting community contributions for Syft, Grype, and related projects.
*Resources & Learn More:*
- Learn about SBOMs: [Link to Anchore's SBOM pillar page/guide if available]
- Dive into Software Supply Chain Security: [Link to relevant Anchore pillar page/blog if available]
- Syft on GitHub: anchore/syft
- Grype on GitHub: anchore/grype
- Join the Community Discussion: anchore.com
- All Anchore Open Source Projects: github.com/anchore
- Sign-up for the OSS Newsletter: get.anchore.com
#OpenSourceSecurity #SBOM #SoftwareSupplyChainSecurity
[ko] 실시간 SBOM 및 보안 수정: Anchore 개발자들이 개선한 Syft 및 Grype (10월 15일)
매주 목요일 진행되는 *오픈 소스 보안* 라이브 스트림에 참여하세요! Anchore의 개발자 관계 및 엔지니어링 팀이 중요한 *소프트웨어 공급망 보안* 도구를 위해 실시간으로 협업하는 모습을 지켜보세요. 이번 세션에서는 *SBOM* 생성 도구인 *Syft*와 *취약점 스캔 도구*인 *Grype* 개선에 초점을 맞추고, 커뮤니티에서 제기된 문제와 풀 리퀘스트를 해결합니다.
매주 목요일, "오픈 소스 가드닝"에서는 인기 있는 *오픈 소스 보안* 프로젝트를 유지 관리하는 과정을 투명하게 공개합니다. '토론 필요'로 표시된 항목을 심층적으로 다루고, 시간이 허락한다면 다른 흥미로운 기여 사항들도 해결합니다. 개발 모범 사례를 배우고, *SBOM* 정확도의 어려움을 이해하고, *취약점 스캔* 도구의 발전 과정을 살펴보세요. 기여자, 사용자, 또는 *오픈 소스 보안*에 관심 있는 분이라면 누구나 참여하여 Anchore의 오픈 소스 도구를 만든 사람들과 소통하고 배울 수 있는 기회를 놓치지 마세요.
*아젠다:*
- '토론 필요' 태그가 있는 문제/풀 리퀘스트 논의 및 해결
*토론 필요' 태그가 있는 문제/풀 리퀘스트 논의 및 해결* - Syft, Grype 및 관련 프로젝트에 대한 우선순위가 높거나 흥미로운 커뮤니티 기여 활동을 진행합니다.
*자료 및 자세히 알아보기:*
- SBOM에 대해 알아보기: [Anchore의 SBOM 핵심 페이지/가이드 링크(있는 경우)]
- 소프트웨어 공급망 보안 심층 분석: [관련 Anchore 핵심 페이지/블로그 링크(있는 경우)]
- Syft GitHub: anchore/syft
- Grype GitHub: anchore/grype
- 커뮤니티 토론 참여: anchore.com
- 모든 Anchore 오픈 소스 프로젝트: github.com/anchore
- OSS 뉴스레터 신청: get.anchore.com
#오픈소스보안 #SBOM #소프트웨어공급망보안
[nl-NL] Live SBOM & beveiligingsoplossingen: Anchore-ontwikkelaars verbeteren Syft & Grype (15 oktober)
Neem deel aan onze wekelijkse livestream over *Open Source Security*! Kijk hoe de teams Developer Relations en Engineering van Anchore in realtime samenwerken aan cruciale tools voor *Software Supply Chain Security*. Deze sessie richt zich op het verbeteren van *Syft* (voor het genereren van *SBOM*-bestanden) en *Grype* (voor *kwetsbaarheidsscans*), het aanpakken van door de community aangekaarte problemen en pull requests.
Elke donderdag biedt "Open Source Gardening" een transparante blik op het onderhoud van populaire *open source security*-projecten. We duiken in items die gemarkeerd zijn als 'moet besproken worden' en, indien de tijd het toelaat, behandelen we andere interessante bijdragen. Leer over best practices voor ontwikkeling, begrijp de uitdagingen van *SBOM*-nauwkeurigheid en zie hoe tools voor *kwetsbaarheidsscans* evolueren. Of je nu een bijdrager, gebruiker bent of gewoon nieuwsgierig naar *open source security*, kijk mee om te leren en in gesprek te gaan met de mensen achter de OSS-tools van Anchore.
*Agenda:*
- Bespreken en oplossen van problemen/pull requests met de tag 'moet besproken worden'.
- Pak andere prioritaire of interessante communitybijdragen aan voor Syft, Grype en gerelateerde projecten.
*Bronnen & Meer informatie:*
- Leer meer over SBOM's: [Link naar de pagina/handleiding van Anchore over SBOM's indien beschikbaar]
- Duik in Software Supply Chain Security: [Link naar de relevante pagina/blog van Anchore over SBOM's indien beschikbaar]
- Syft op GitHub: anchore/syft
- Grype op GitHub: anchore/grype
- Doe mee aan de communitydiscussie: anchore.com
- Alle open source-projecten van Anchore: github.com/anchore
- Meld je aan voor de OSS-nieuwsbrief: get.anchore.com
#OpenSourceSecurity #SBOM #SoftwareSupplyChainSecurity
1 like · 151 views
Coding Agents Pass Up to 91% of Tasks in a New Benchmark. At Most 25% Are Also Secure
- Book: Ship It — the pragmatic startup tech stack
- Also by me: Thinking in Go (2-book series) — Complete Guide to Go Programming + Hexagonal Architecture in Go
- My project: Hermes IDE | GitHub — an IDE for developers who ship with Claude Code and other AI coding tools
- Me: xgabriel.com | GitHub
---
A coding agent rewrote the missing file at the heart of a Java configuration importer. All 14 hidden functional tests passed. All four security tests failed, because the default SnakeYAML constructor it used "honors every !!class tag" in the uploaded YAML (the paper, Section 5.4 and Appendix F.2). The agent was Kimi-K3. Claude Fable 5 and GPT-5.6-Sol parsed the same input with SnakeYAML's SafeConstructor and passed both suites. Qwen3.8-Max and GLM-5.3 made Kimi-K3's mistake.
That case comes from the Last Secure Code Benchmark (LSCBench), submitted to arXiv on October 10, 2026 by researchers from the National University of Singapore and Alibaba Group, including the Qwen team (author list). The headline: six frontier agents pass 73.6% to 91.3% of tasks functionally, and the best of them writes code that is both working and secure on 25.1% (project page).
What LSCBench actually tests
The benchmark has 450 tasks built from 150 real vulnerabilities, across seven languages and 24 CWE categories (arXiv). Of those 150 scenarios, 115 come from public CVEs and 35 are Java applications written by security experts (project page).
The trick is in the prompt. In the authors' words, "Every task asks only for functionality, through a specification that never mentions security" (arXiv). That is how most people prompt a coding agent. You ask for the import feature, not for a deserialization-safe import feature.
Each task runs at one of three sizes: fill in a masked function, write a removed file, or rebuild an emptied source tree from a spec. A task scores only if two hidden suites both pass, functional tests and security tests that replay the original attack. No partial credit, no judge model (project page).
The leaderboard
All six models ran at their highest reasoning effort. Five ran inside Claude Code v2.1.143 and GPT-5.6-Sol ran inside Codex v0.154.0 (README). Numbers from the project page:
| Model | Harness | Works | Works and secure |
|---|---|---|---|
| Claude Fable 5 | Claude Code | 91.1% | 25.1% |
| GPT-5.6-Sol | Codex | 89.1% | 24.7% |
| Qwen3.8-Max | Claude Code | 89.3% | 22.0% |
| GLM-5.3 | Claude Code | 87.1% | 21.3% |
| DeepSeek-V4-Pro | Claude Code | 73.6% | 18.0% |
| Kimi-K3 | Claude Code | 91.3% | 16.4% |
Look at the last row. Kimi-K3 has the highest functional pass rate and the lowest secure one. A green test suite told you nothing about which agent was safer.
Across all 2,700 runs, 66% ended with code that works and is still vulnerable (project page). Of the 150 scenarios, 57 were never secured by any model.
!Editorial illustration of a house whose front door is triple-locked and glowing orange while a back window stands wide open
Working code, open window: the shape of most LSCBench runs.
Where the code breaks
The project page breaks down how often runs ended both working and secure, all six models combined. By language: C and Python 30%, JavaScript 27%, C++ 19%, Java 18%, Go 14%, PHP 10% (project page).
The weakness-family chart uses a different base, the share of working code that was also secure, and the spread there is wider. Memory safety comes out best at 44%. Injection sits at 28%. Server-side request forgery is at 3% and information exposure at 1% (project page).
The paper's case studies show what that looks like (Appendix F):
- Command injection, Java: four of the six models passed mount arguments to ProcessBuilder as a list. Qwen3.8-Max and Kimi-K3 built a string for sh -c.
- SSRF, Go: in a LocalAI task, GPT-5.6-Sol's GetURI read any path it was handed, file:// URLs included. The reference fix confines reads to the models directory. No model did that.
- Information exposure, Go: in a syft task, GLM-5.3 followed the tag convention of neighbouring structs, so an attestation password showed up in config dumps and SBOM output. All six models made the same choice.
None of these are exotic. A reviewer who goes looking for them can catch all three.
!Editorial illustration of a magnifying glass over a stack of code sheets, with one sheet showing an orange crack running through it
SSRF and information exposure: 3% and 1% of working code was also secure.
One sentence helped. It didn't fix it
The authors reran four of the six models with one sentence appended to every task, asking for an implementation that meets the functional requirements "while also being secure" (Section 5.5). Works-and-secure scores went up:
- GPT-5.6-Sol: 24.7% to 46.2%
- GLM-5.3: 21.3% to 38.2%
- Qwen3.8-Max: 22.0% to 37.6%
- DeepSeek-V4-Pro: 18.0% to 19.1%
Functional pass rates moved by a few points either way. The paper's verdict: "most tasks stay insecure even with the reminder", and SSRF and information exposure stay near the bottom (Section 5.5). Claude Fable 5 and Kimi-K3 weren't in that rerun.
What to do with this on Monday
Add the reminder anyway. The paper appended it to the task. A line in your AGENTS.md or CLAUDE.md is the nearest everyday equivalent, though the paper didn't test that placement. For three of the four models it added about 16 to 22 points.
Then write the test the benchmark writes: replay the attack. If an agent builds a loader that takes a model name, check that it refuses a URL and a path that climbs out of the directory.
from pathlib import Path
import pytest
MODELS = Path("models").resolve()
def resolve_model(uri: str) -> Path:
if "://" in uri:
raise ValueError("plain model names only")
p = (MODELS / uri).resolve()
if not p.is_relative_to(MODELS):
raise ValueError("outside the models dir")
return p
@pytest.mark.parametrize("uri", [
"ftp://example.com/model.bin",
"../secrets.txt",
])
def test_rejects_escape(uri):
with pytest.raises(ValueError):
resolve_model(uri)
Review agent work for security on purpose, in small pieces. I build Hermes IDE, so weigh this with that in mind. Its Review Desk (⌘G, Ctrl+Shift+G on Windows and Linux) shows an agent's changes by turn or by file and sends a line comment back to the agent that wrote it (README). It won't spot an SSRF on its own, but it splits a 40-file change into turns you can actually read.
!The Hermes IDE Review Desk in By turn view for a Claude Code task, with two turns listed, a diff of one file and a drafted commit message
The Review Desk (⌘G) in By turn view for a Claude Code task in orders-api: two turns, turn 1's diff of src/db.ts, the changed-files list, and a commit message drafted from the turns.
You can also run the benchmark against your own agent setup. It ships as a Harbor dataset (LSCBench itself is Apache 2.0), and needs Harbor 0.24+, Docker, Python 3.12+ and about 58 GB of task images. The projects contain exploitable vulnerabilities, so the README says to run it in an isolated environment (README). The sanity check first, where reference solutions should score 1:
pip install harbor
harbor run \
-d last-secure-code-benchmark/last-secure-code-benchmark@v1.0 \
-a oracle
I haven't run it myself.
Read the fine print before you quote it
The leaderboard tests the model versions available when the paper was written; newer releases may score differently. Every number is pass@1, one attempt per task. Qwen3.8-Max, one of the six models scored, was also the construction agent that wrote the tests and specifications; the authors argue its mid-field result shows no advantage (arXiv). The paper is an arXiv preprint, so treat it as one until someone replicates it.
---
If this was useful
Vibe-coding a side project is the easy half. Ship It covers the rest of the road from localhost to production for a small team: hosting, payments, auth, CI/CD and monitoring, the places where "it works" and "it's safe to put online" stop being the same thing. If you run several coding agents on that work, Hermes IDE is free, source-available and on GitHub.
Mentions
Syft : Un outil CLI et une bibliothèque Go pour générer inventaire des composants logiciels à partir d'images de conteneurs et de systèmes de fichiers. 👉 anchore/syft
Automated Artifact Promotion Pipeline from Dev to Prod Manual promotions, rebuild-driven releases, and scattered binaries produce familiar symptoms: inconsistent test vs prod behavior, long release lead times, and audits that point to missing evidence. The worst cases show teams rebuilding the same commit multiple times and losing confidence in which binary actually shipped; the result is firefighting that costs time and customer trust. Contents - [Why promote artifacts instead of rebuilding for reliability and traceability] - [Designing repository tiers and the promotion flow] - [Automating promotion with CI/CD and quality gates] - [Rollback, audit trails, and provenance for safe recovery and traceability] - [Practical Application: checklists and step-by-step promotion protocol] - [Sources] Why promote artifacts instead of rebuilding for reliability and traceability Promoting artifacts is not dogma — it solves concrete problems that rebuilding cannot reliably eliminate. A build that passed unit, integration, and security tests at 10:02 UTC must be the exact object that reaches production; rebuilding the same commit later often pulls in different transient inputs (base image tags, mirror responses, cached dependencies) and produces bitwise-different outputs. SLSA defines provenance as the verifiable metadata that ties a produced artifact to the builder, invocation, and materials used to produce it; keeping that artifact as the single source of truth preserves that chain. A promoted artifact serves as a birth certificate: the SHA checksum, the SLSA/in-toto predicate or attestation, the SBOM, test results, and the CI build-id travel with the artifact from dev to prod. That makes audits precise and rollbacks trivial (deploy this exact digest). Vendors and repositories already provide first-class promotion workflows so that promotions attach metadata and preserve integrity rather than relying on fragile rebuild heuristics. Practical corollary: use a strong digest algorithm (SHA-256 or better) when you record artifact identity, and store that digest as searchable metadata in your repository and deployment manifests. NIST guidance on secure software practices reinforces provenance and artifact-level controls as part of a defendable delivery process. Designing repository tiers and the promotion flow The repository layout is the scaffolding of your promotion pipeline. Keep the design simple, enforceable, and aligned with teams’ workflows. Example minimal tiering pattern | Tier | Purpose | Mutability | Retention / lifecycle | Typical consumers | |---|---:|---|---|---| | dev | Immediate CI output, fast uploads | Mutable, auto-clean | Short retention or capped per-project (e.g., keep last 30 builds) | Developers, CI jobs | | staging | QA/Integration testing and security validation | Semi-immutable (copy-on-promote) | Medium retention, signed promotions | QA, release engineering | | prod | Immutable production artifacts | Immutable; signed + retention policy | Long-term archival; legal/compliance retention | Runtime envs, ops | Common implementation patterns and their trade-offs | Promotion method | How it works | Pros | Cons | |---|---|---|---| | Copy-on-promote (recommended) | Copy artifact blobs from dev repo → staging/prod and attach promotion metadata | Preserves source object, keeps original dev builds intact, easy audit trail. | Requires storage for duplicate blobs unless deduping by repo manager. | | Move-on-promote | Physically move artifact between repos | Saves storage, simpler final state | Loses quick access to original dev repository; more risk if promotion was accidental | | Release bundles / signed collections | Group artifacts into a signed bundle that is promoted as a unit | Stronger release-level traceability and signing; supports multi-artifact releases | Additional operational complexity; requires repository features (e.g., RLM) | Repository design specifics that make promotion reliable - Use separate credentials and ACLs per tier: developers push to dev, QA and automated gates control staging, only CI/CD with approval can promote to prod. - Enforce immutability for production-tier objects (object write-once, read-many), with signed attestation and no destructive deletes except via controlled retention policies. - Provide virtual or aggregated read-repos for consumers so deployments can resolve a single logical repository (e.g., myorg-release) that maps to prod when promoted. - Record and index metadata: build.name, build.number, commit_sha, sha256, sbom_path, attestation_id. The repository’s build-info object should be the canonical link between CI build and binary. Automating promotion with CI/CD and quality gates Automation is the enforcement plane for your promotion rules — tests and scans must run in CI, attestations must be generated, and only then must the pipeline perform a promotion action. A compact promotion flow (pipeline stages) 1. Build: compile, run unit tests; record build-info (build.name, build.number, commit, artifact digests) and upload artifacts to dev repo. 2. Static verification: run SBOM generation and vulnerability scans (syft, grype/trivy), run license checks. Sign the SBOM/attestation. 3. Integration and regression: run integration suites, performance smoke checks, canary smoke runs (optional). 4. Quality gate evaluation: evaluate scan results and test pass/fail; quality gate enforces policy e.g., block promotion on critical CVEs or failed required tests. 5. Attest and sign: produce an in-toto / SLSA-compatible provenance attestation and sign with cosign (or equivalent) and store the attestation alongside the artifact. 6. Promote: call repository promotion APIs (jf rt bpr, Nexus staging/release, Harbor copy/replicate, or equivalent) to move/copy artifact to staging or prod. 7. Deploy: runtime systems pull by digest (image@sha256:...) or release bundle reference. Concrete examples and commands - Generate an SBOM and scan: # Generate SBOM (Syft) syft myorg/my-app:${GITHUB_SHA} -o spdx-json=sbom.spdx.json # Scan (Grype) using SBOM for speed grype sbom:sbom.spdx.json -o json > grype-report.json - Sign an OCI image or a blob with cosign (keyless or key-backed): # Keyless (recommended for CI with OIDC) cosign sign myregistry/my-app@sha256:${IMAGE_DIGEST} # With private key cosign sign --key cosign.key myregistry/my-app@sha256:${IMAGE_DIGEST} - Promote a build in Artifactory (example): # Promote build number 125 to staging-local, keep the original build in dev jf rt bpr my-app 125 staging-local --status="QA-Approved" --comment="Auto-promoted" --copy=true Quality gates: enforce as code - Gate evaluation must be scriptable. A simple gate (example) rejects promotion if any severity == "Critical" is present in the scanner JSON: critical_count=$(jq '[.matches[].vulnerability.severity | select(.=="Critical")] | length' grype-report.json) test $critical_count -eq 0 || (echo "Critical vulns found — aborting promotion" && exit 1) Use ephemeral CI credentials and workload federation - Tokenless or short-lived credentials (OIDC) reduce risk of long-lived secrets in CI. GitHub Actions, GitLab, and major clouds support OIDC flows that allow CI jobs to mint temporary credentials for artifact pushes or signing operations. > Important: Automating promotion without attestations is only automation — not security. Attach SLSA/in-toto attestations and cryptographic signatures as part of the promotion workflow to make machine-verified checks possible downstream. Rollback, audit trails, and provenance for safe recovery and traceability Rollback mechanics should be a non-event because your pipeline promoted immutable artifacts with complete metadata. Rollback patterns - Redeploy by digest: store the deployed image or artifact digest in your release record and use that digest to roll back. Kubernetes deploy manifests should pin images by digest: image: myregistry/my-app@sha256:<digest>. # Example Kubernetes quick rollback by setting deployment image to previous digest kubectl set image deployment/myapp myapp=myregistry/my-app@sha256:<previous-digest> --record - Re-promote prior Release Bundle: if you used a Release Bundle or signed collection to promote to prod, re-publish that bundle to a "rollback" or "canary" environment and redeploy from it. - Blue/Green or Canary: use promoted artifacts to run a safe parallel rollout; if errors occur, switch traffic back to the previous promoted digest. Audit trails and traceability - The repository's build-info or release bundle records are the canonical audit records: build id, commit, artifact digests, test reports, scanner outputs, attestation IDs, promoting user or CI job, and timestamps. Record these in an immutable audit store or archive the repository’s promotion metadata. - Store SBOM and attestations next to the artifact in the repository or in an attestation store (OCI registries support in-toto attestation blobs attached to images; Docker/OCI attestations are supported in registry specs). - Map audit records to operational incidents: when a vulnerability is discovered, query artifact provenance to find all downstream consumers and determine impact quickly. Provenance and verification - Use SLSA/in-toto predicates for build provenance and verification summary attestations so downstream consumers (operators, auditors, supply-chain scanners) can automate trust checks and enforcement. - Verification tools (cosign, in-toto verification tooling) should be part of promotion pipelines and pre-deployment admission controllers. Practical Application: checklists and step-by-step promotion protocol The following protocol assumes a build produces one canonical artifact (container image or archive), an SBOM, and an attestation; the repository supports signed promotions or copy-on-promote. Checklist — repository and policy essentials - [ ] Dev repo exists and allows CI uploads only. - [ ] Staging repo is semi-immutable and accessible to QA. - [ ] Prod repo is immutable, requires approval/CI token to promote. - [ ] Retention policies configured: auto-prune old dev artifacts, retain prod artifacts per compliance. - [ ] Repository collects build-info and indexes sha256, commit, sbom, attestation. - [ ] Signing tooling available: cosign + key management or keyless OIDC flows. - [ ] SBOM and scanner in CI: syft + grype/trivy. - [ ] Quality gate policy codified (e.g., no Critical or high CVEs, integration tests pass). - [ ] Promotion API automation tested end-to-end. Step-by-step promotion protocol (executable) 1. Build and upload # GitHub Actions excerpt (condensed) permissions: id-token: write # allow OIDC where needed contents: read jobs: build: runs-on: ubuntu-latest steps: - uses: actions/checkout@v4 - name: Build image run: | docker build -t $REGISTRY/my-app:${GITHUB_SHA} . - name: Push image to dev repo run: docker push $REGISTRY/my-app:${GITHUB_SHA} - name: Publish build-info (example: jfrog) run: | jf rt upload "target/*.jar" "libs-dev-local/my-app/${GITHUB_RUN_NUMBER}/" jf rt bp my-app ${GITHUB_RUN_NUMBER} 2. Generate SBOM and scan syft $REGISTRY/my-app:${GITHUB_SHA} -o spdx-json=sbom.spdx.json grype sbom:sbom.spdx.json -o json > grype-report.json 3. Evaluate quality gate (example policy) critical_count=$(jq '[.matches[] | select(.vulnerability.severity=="Critical")] | length' grype-report.json) if [ "$critical_count" -ne 0 ]; then echo "Promotion blocked: critical vulnerabilities present" exit 1 fi 4. Produce provenance and sign # Produce a simple in-toto/SLSA-style attestation (tooling-specific) cosign attest --predicate sbom.spdx.json --type sbom $REGISTRY/my-app:${GITHUB_SHA} cosign sign $REGISTRY/my-app:${GITHUB_SHA} 5. Promote build # Example: promote by build-info using JFrog CLI jf rt bpr my-app ${GITHUB_RUN_NUMBER} libs-staging-local \ --status="QA-Approved" \ --comment="Passed tests & scans" \ --copy=true 6. Record the release record - Persist a release record (DB or ticket) with keys: artifact_digest, build_number, commit_sha, attestation_id, sbom_path, promoted_by, timestamp. Metrics to instrument (baseline formulas) - Provenance coverage = artifacts_in_prod_with_slsa_provenance / total_artifacts_in_prod. Track weekly; target > 95%. - Promotion lead time = median(time from build completion → promotion to staging). Monitor for regressions. - Blocked promotions = count(promotions_failed_quality_gate) per release window. - Storage growth rate = delta(storage_used) / month; enforce retention thresholds to control costs. - Rollback frequency = count(rollback events) / month; high frequency indicates release quality issues. Governance checklist (operationalizing promotion) - Require signed attestations for production promotions. - Define role-based approvals for promotions (who can trigger staging → prod). - Automate evidence collection for audits: store promotion metadata and scanner output in an immutable store. - Periodically test rollback playbooks and restore-from-artifact drills. Sources SLSA — Provenance - SLSA specification and the provenance model used to link build outputs to source, builder, and invocation data; used to justify preserving provenance during promotion. Sigstore — Cosign Quickstart - Cosign quickstart and attestation signing/verification details; used for signing and attestation examples. JFrog — How Does Build Promotion Work - Official Artifactory description of build promotion, metadata, and release bundle concepts; used for promotion command examples and design patterns. Anchore Syft (SBOM generation) - Tool documentation for generating SBOMs; used for SBOM generation step examples. Anchore Grype (vulnerability scanning) - Vulnerability scanner docs supporting SBOM-based scanning and automation examples. NIST SP 800-218 — Secure Software Development Framework (SSDF) - NIST guidance on secure software development, provenance, and supply-chain artifacts; used to support governance and compliance guidance. GitHub Actions — OpenID Connect reference - Documentation for OIDC integration in CI to obtain short-lived credentials; used to justify OIDC usage in CI.
The Ultimate Developer Stack: 23 Trending GitHub Repos | 28-10-2026 | Dev Repos Daily cutt.ly 🔥 Nobody Told You About This New AI Repo (Summer2027-Internships) Stay on top of the open source ecosystem with this handpicked selection of trending GitHub repositories. From innovative developer tools to groundbreaking frameworks, these are the projects making waves in the software community right now. October 28, 2026 What is inside this video: - Top 23 trending GitHub repositories ranked by stars gained today - Developer insights and project overviews for every featured repo - AI-narrated walkthrough of each open source project - Direct links to all repositories below for easy access ⏱️ TIMESTAMPS (YouTube Chapters): 00:00 - Intro: Today's High-Impact Tools 00:09 - Trending Leaderboard Overview 00:25 - #1 Summer2027-Internships 00:54 - #2 n8n 01:24 - #3 datahub 01:45 - #4 upscayl 02:08 - #5 free-for-dev 02:33 - #6 awesome-remote-job 02:59 - #7 Data-Science-For-Beginners 03:27 - #8 PowerToys 03:50 - #9 neovim 04:10 - #10 jellyfin 04:33 - #11 llama_index 04:56 - #12 syft 05:18 - #13 playwright 05:46 - #14 plane 06:09 - #15 pgvector 06:28 - #16 awesome 06:59 - #17 runner-images 07:19 - #18 rustdesk 07:43 - #19 lazygit 08:05 - #20 transformers 08:31 - #21 directus 09:02 - #22 gitleaks 09:22 - #23 OpenCore-Legacy-Patcher 09:45 - Outro & Key Takeaways ━━━━━━━━━━━━━━━━━━━━━━━ TODAY'S TOP 23 TRENDING REPOSITORIES: ━━━━━━━━━━━━━━━━━━━━━━━ #1 SimplifyJobs/Summer2027-Internships (⭐ 48.2k • +21 today • Python) Summer 2027 software engineering, data science, AI, quant, product management, and hardware internship postings. Updated daily by Simplify and Pitt CSC. 🔗 SimplifyJobs/Summer2027-Internships #2 n8n-io/n8n (⭐ 208.9k • +161 today • TypeScript) Fair-code workflow automation platform with native AI capabilities. Combine visual building with custom code, self-host or cloud, 400+ integrations. 🔗 n8n-io/n8n #3 datahub-project/datahub (⭐ 12.9k • +10 today • Python) The Context Platform for your Data and AI Stack 🔗 datahub-project/datahub #4 upscayl/upscayl (⭐ 51.2k • +76 today • TypeScript) 🆙 Upscayl - #1 Free and Open Source AI Image Upscaler for Linux, MacOS and Windows. 🔗 upscayl/upscayl #5 ripienaar/free-for-dev (⭐ 140.2k • +55 today • HTML) A list of SaaS, PaaS and IaaS offerings that have free tiers of interest to devops and infradev 🔗 ripienaar/free-for-dev #6 lukasz-madon/awesome-remote-job (⭐ 50k • +99 today • Unknown) A curated list of awesome remote jobs and resources. Inspired by vinta/awesome-python 🔗 lukasz-madon/awesome-remote-job #7 microsoft/Data-Science-For-Beginners (⭐ 37.8k • +47 today • Jupyter Notebook) 10 Weeks, 20 Lessons, Data Science for All! 🔗 microsoft/Data-Science-For-Beginners #8 microsoft/PowerToys (⭐ 140.1k • +84 today • C) Microsoft PowerToys is a collection of utilities that supercharge productivity and customization on Windows 🔗 microsoft/PowerToys #9 neovim/neovim (⭐ 103.2k • +41 today • Vim Script) Vim-fork focused on extensibility and usability 🔗 neovim/neovim #10 jellyfin/jellyfin (⭐ 58.7k • +74 today • C#) The Free Software Media System - Server Backend & API 🔗 jellyfin/jellyfin #11 run-llama/llama_index (⭐ 52.7k • +23 today • Python) LlamaIndex is the document processing platform for AI 🔗 run-llama/llama_index #12 anchore/syft (⭐ 9.8k • +14 today • Go) CLI tool and library for generating a Software Bill of Materials from container images and filesystems 🔗 anchore/syft #13 microsoft/playwright (⭐ 98.7k • +90 today • TypeScript) Playwright is a framework for Web Testing and Automation. It allows testing Chromium, Firefox and WebKit with a single API. 🔗 microsoft/playwright #14 makeplane/plane (⭐ 61.6k • +64 today • TypeScript) 🔥🔥🔥 Open-source Jira, Linear, Monday, and ClickUp alternative. Plane is a modern project management platform to manage tasks, sprints, docs, and triage. 🔗 makeplane/plane #15 pgvector/pgvector (⭐ 23.5k • +17 today • C) Open-source vector similarity search for Postgres 🔗 pgvector/pgvector ━━━━━━━━━━━━━━━━━━━━━━━ Subscribe to @devrepos for daily GitHub trending repositories, open source roundups, and developer news. New videos every day covering the best open source software and trending projects on GitHub. [ar] أفضل حزمة أدوات للمطورين: 23 مستودعاً رائجاً على GitHub | 28-10-2026 | مستودعات المطورين اليومية cutt.ly 🔥 لم يخبرك أحد عن هذا المستودع الجديد للذكاء الاصطناعي (تدريب صيفي 2027) ابقَ على اطلاع دائم بأحدث التطورات في عالم البرمجيات مفتوحة المصدر مع هذه المجموعة المختارة بعناية من مستودعات GitHub الرائجة. من أدوات تطوير مبتكرة إلى أطر عمل رائدة، هذه هي المشاريع التي تُحدث ضجة في مجتمع البرمجيات حاليًا. ... ٢٨ أكتوبر ٢٠٢٦ محتوى هذا الفيديو: - أفضل ٢٣ مستودعًا رائجًا على GitHub، مُرتبة حسب عدد النجوم المكتسبة اليوم - رؤى المطورين ونظرة عامة على المشاريع لكل مستودع مميز - شرح صوتي مُعزز بالذكاء الاصطناعي لكل مشروع مفتوح المصدر - روابط مباشرة لجميع المستودعات أدناه لسهولة الوصول ⏱️ الفواصل الزمنية (فصول يوتيوب): ٠٠:٠٠ - مقدمة: أدوات اليوم الأكثر تأثيرًا ٠٠:٠٩ - نظرة عامة على قائمة المتصدرين الرائجة ٠٠:٢٥ - #١ تدريب صيفي ٢٠٢٧ ٠٠:٥٤ - #٢ n8n ٠١:٢٤ - #٣ datahub ٠١:٤٥ - #٤ upscayl ٠٢:٠٨ - #٥ free-for-dev ٠٢:٣٣ - #٦ awesome-remote-job ٠٢:٥٩ - #٧ علوم البيانات للمبتدئين ٠٣:٢٧ - #٨ باور تويز 03:50 - #9 نيوفيم 04:10 - #10 جيلي فين 04:33 - #11 لاما إندكس 04:56 - #12 سيفت 05:18 - #13 بلاي رايت 05:46 - #14 بلين 06:09 - #15 بي جي فيكتور 06:28 - #16 أوسوم 06:59 - #17 رانر إيمجز 07:19 - #18 رست ديسك 07:43 - #19 ليزي جيت 08:05 - #20 ترانسفورمرز 08:31 - #21 دايركت توس 09:02 - #22 جيت ليكس 09:22 - #23 أوبن كور ليجاسي باتشر 09:45 - الخاتمة والمفتاح أهم النقاط ━━━━━━━━━━━━━━━━━━━━━━━━ أفضل 23 موقعًا رائجًا اليوم: ━━━━━━━━━━━━━━━━━━━━━━━ #1 SimplifyJobs/Summer2027-Internships (⭐ 48.2 ألف • +21 اليوم • بايثون) فرص تدريب صيفية لعام 2027 في هندسة البرمجيات، وعلوم البيانات، والذكاء الاصطناعي، والتحليل الكمي، وإدارة المنتجات، والأجهزة. يتم تحديثها يوميًا بواسطة Simplify و Pitt CSC. 🔗 SimplifyJobs/Summer2027-Internships #2 n8n-io/n8n (⭐ 208.9 ألف • +161 اليوم • TypeScript) منصة أتمتة سير العمل البرمجية العادلة مع إمكانيات ذكاء اصطناعي مدمجة. اجمع بين البناء المرئي والبرمجة المخصصة، مع إمكانية الاستضافة الذاتية أو السحابية، وأكثر من 400 تكامل. منصة أتمتة سير العمل البرمجية العادلة مع إمكانيات الذكاء الاصطناعي المدمجة. 🔗 n8n-io/n8n #3 datahub-project/datahub (⭐ 12.9 ألف • +10 اليوم • بايثون) منصة السياق لبياناتك وتقنيات الذكاء الاصطناعي 🔗 datahub-project/datahub #4 upscayl/upscayl (⭐ 51.2 ألف • +76 اليوم • تايب سكريبت) 🆙 Upscayl - برنامج مجاني ومفتوح المصدر لتحسين جودة الصور بتقنية الذكاء الاصطناعي، يعمل على أنظمة لينكس وماك أو إس وويندوز. ... #3 🔗 upscayl/upscayl #5 ripienaar/free-for-dev (⭐ 140.2 ألف • +55 اليوم • HTML) قائمة بعروض SaaS وPaaS وIaaS التي تتضمن مستويات مجانية تهم مطوري DevOps وInfradev 🔗 ripienaar/free-for-dev #6 lukasz-madon/awesome-remote-job (⭐ 50 ألف • +99 اليوم • غير معروف) قائمة منتقاة من أفضل الوظائف والموارد عن بُعد. مستوحى من vinta/awesome-python 🔗 lukasz-madon/awesome-remote-job #7 مايكروسوفت/علوم البيانات للمبتدئين (⭐ 37.8 ألف • +47 اليوم • Jupyter Notebook) 10 أسابيع، 20 درسًا، علوم البيانات للجميع! #7 🔗 microsoft/Data-Science-For-Beginners #8 microsoft/PowerToys (⭐ 140.1 ألف • +84 اليوم • C) مجموعة أدوات Microsoft PowerToys تُعزز الإنتاجية وتُتيح تخصيص نظام Windows. 🔗 microsoft/PowerToys #9 neovim/neovim (⭐ 103.2 ألف • +41 اليوم • سكربت Vim) نسخة مُعدّلة من Vim تُركز على قابلية التوسع وسهولة الاستخدام. 🔗 neovim/neovim #10 jellyfin/jellyfin (⭐ 58.7 ألف • +74 اليوم • C#) نظام الوسائط البرمجية الحرة - خادم خلفي وواجهة برمجة تطبيقات (API) 🔗 jellyfin/jellyfin #11 run-llama/llama_index (⭐ ٥٢٫٧ ألف • +٢٣ اليوم • بايثون) LlamaIndex هي منصة معالجة المستندات للذكاء الاصطناعي 🔗 run-llama/llama_index #١٢ anchore/syft (⭐ ٩٫٨ ألف • +١٤ اليوم • جو) أداة سطر أوامر ومكتبة لإنشاء قائمة مكونات برمجية من صور الحاويات وأنظمة الملفات 🔗 anchore/syft #١٣ microsoft/playwright (⭐ ٩٨٫٧ ألف • +٩٠ اليوم • تايب سكريبت) Playwright هو إطار عمل لاختبار وأتمتة الويب. يتيح اختبار Chromium وFirefox وWebKit باستخدام واجهة برمجة تطبيقات واحدة. #١٣ microsoft/playwright (⭐ ٩٨٫٧ ألف • +٩٠ اليوم • تايب سكريبت) Playwright هو إطار عمل لاختبار وأتمتة الويب. يتيح اختبار Chromium وFirefox وWebKit باستخدام واجهة برمجة تطبيقات واحدة. 🔗 microsoft/playwright #14 makeplane/plane (⭐ 61.6 ألف • +64 اليوم • TypeScript) 🔥🔥🔥 بديل مفتوح المصدر لـ Jira وLinear وMonday وClickUp. Plane منصة حديثة لإدارة المشاريع، تُتيح إدارة المهام، والسباقات، والوثائق، وفرز المهام. Plane 🔗 makeplane/plane #15 pgvector/pgvector (⭐ 23.5 ألف • +17 اليوم • C) بحث مفتوح المصدر عن تشابه المتجهات لـ Postgres 🔗 pgvector/pgvector ━━━━━━━━━━━━━━━━━━━━━━━ اشترك في @devrepos للاطلاع على أحدث مستودعات GitHub الرائجة، وملخصات المشاريع مفتوحة المصدر، وأخبار المطورين. فيديوهات جديدة يوميًا تغطي أفضل برامج المصادر المفتوحة والمشاريع الرائجة على GitHub. [bn] ডেভেলপারদের জন্য সেরা কালেকশন: ২৩টি ট্রেন্ডিং গিটহাব রিপোজিটরি | ২৮-১০-২০২৬ | ডেভ রিপোস ডেইলি cutt.ly 🔥 এই নতুন এআই রিপোটির কথা আপনাকে কেউ বলেনি (সামার ২০২৭-ইন্টার্নশিপ) ট্রেন্ডিং গিটহাব রিপোজিটরিগুলোর এই বিশেষভাবে নির্বাচিত সংগ্রহের মাধ্যমে ওপেন সোর্স ইকোসিস্টেমের সাথে আপ-টু-ডেট থাকুন। উদ্ভাবনী ডেভেলপার টুলস থেকে শুরু করে যুগান্তকারী ফ্রেমওয়ার্ক পর্যন্ত, এই প্রজেক্টগুলোই এখন সফটওয়্যার কমিউনিটিতে আলোড়ন সৃষ্টি করছে। ২৮শে অক্টোবর, ২০২৬ এই ভিডিওতে যা আছে: আজ অর্জিত স্টারের ভিত্তিতে র্যাঙ্ক করা শীর্ষ ২৩টি ট্রেন্ডিং গিটহাব রিপোজিটরি - প্রতিটি ফিচার করা রিপোর জন্য ডেভেলপারদের মতামত এবং প্রজেক্টের সংক্ষিপ্ত বিবরণ - প্রতিটি ওপেন সোর্স প্রজেক্টের AI-বর্ণিত ওয়াকথ্রু - সহজে অ্যাক্সেসের জন্য নিচে সমস্ত রিপোজিটরির সরাসরি লিঙ্ক ⏱️ টাইমস্ট্যাম্প (ইউটিউব চ্যাপ্টার): ০০:০০ - ভূমিকা: আজকের হাই-ইমপ্যাক্ট টুলস ০০:০৯ - ট্রেন্ডিং লিডারবোর্ডের সংক্ষিপ্ত বিবরণ ০০:২৫ - #১ Summer2027-Internships ০০:৫৪ - #২ n8n ০১:২৪ - #৩ datahub ০১:৪৫ - #৪ upscayl ০২:০৮ - #৫ free-for-dev ০২:৩৩ - #৬ awesome-remote-job ০২:৫৯ - #৭ Data-Science-For-Beginners ০৩:২৭ - #৮ পাওয়ারটয়েজ ০৩:৫০ - #৯ নিওভিম ০৪:১০ - #১০ জেলিফিন ০৪:৩৩ - #১১ লামা_ইনডেক্স ০৪:৫৬ - #১২ সাইফট ০৫:১৮ - #১৩ প্লেরাইট ০৫:৪৬ - #১৪ প্লেন ০৬:০৯ - #১৫ পিজিভেক্টর ০৬:২৮ - #১৬ অসাম ০৬:৫৯ - #১৭ রানার-ইমেজেস ০৭:১৯ - #১৮ রাস্টডেস্ক ০৭:৪৩ - #১৯ লেজিগিট ০৮:০৫ - #২০ ট্রান্সফর্মার্স ০৮:৩১ - #২১ ডিরেক্টাস ০৯:০২ - #২২ গিটলিকস ০৯:২২ - #২৩ ওপেনকোর-লেগ্যাসি-প্যাচার ০৯:৪৫ - আউটরো ও কী মূল কথা ━━━━━━━━━━━━━━━━━━━━━━━ আজকের শীর্ষ ২৩টি ট্রেন্ডিং রিপোজিটরি: ━━━━━━━━━━━━━━━━━━━━━━ #১ SimplifyJobs/Summer2027-Internships (⭐ ৪৮.২ হাজার • আজ +২১ • পাইথন) সামার ২০২৭ সফটওয়্যার ইঞ্জিনিয়ারিং, ডেটা সায়েন্স, এআই, কোয়ান্ট, প্রোডাক্ট ম্যানেজমেন্ট, এবং হার্ডওয়্যার ইন্টার্নশিপের পোস্ট। Simplify এবং Pitt CSC দ্বারা প্রতিদিন আপডেট করা হয়। 🔗 SimplifyJobs/Summer2027-Internships #২ n8n-io/n8n (⭐ ২০৮.৯ হাজার • আজ +১৬১ • টাইপস্ক্রিপ্ট) নেটিভ এআই সক্ষমতাসহ ফেয়ার-কোড ওয়ার্কফ্লো অটোমেশন প্ল্যাটফর্ম। ভিজ্যুয়াল বিল্ডিংয়ের সাথে কাস্টম কোড, সেলফ-হোস্ট বা ক্লাউড, ৪০০+ ইন্টিগ্রেশন একত্রিত করুন। 🔗 n8n-io/n8n #৩ datahub-project/datahub (⭐ ১২.৯ হাজার • আজ +১০ • পাইথন) আপনার ডেটা এবং এআই স্ট্যাকের জন্য কনটেক্সট প্ল্যাটফর্ম। 🔗 datahub-project/datahub #৪ upscayl/upscayl (⭐ ৫১.২ হাজার • আজ +৭৬ • টাইপস্ক্রিপ্ট) 🆙 Upscayl - লিনাক্স, ম্যাকওএস এবং উইন্ডোজের জন্য #১ ফ্রি এবং ওপেন সোর্স এআই ইমেজ আপস্কেলার। 🔗 upscayl/upscayl #5 ripienaar/free-for-dev (⭐ 140.2k • আজ +55 • HTML) SaaS, PaaS এবং IaaS অফারগুলির একটি তালিকা, যেগুলির ফ্রি টিয়ার রয়েছে এবং যা ডেভঅপ্স ও ইনফ্রাডেভের জন্য আকর্ষণীয়। 🔗 ripienaar/free-for-dev #6 lukasz-madon/awesome-remote-job (⭐ 50k • আজ +99 • অজানা) চমৎকার রিমোট চাকরি এবং রিসোর্সের একটি সংকলিত তালিকা। vinta/awesome-python দ্বারা অনুপ্রাণিত 🔗 lukasz-madon/awesome-remote-job #৭ microsoft/Data-Science-For-Beginners (⭐ ৩৭.৮ হাজার • আজ +৪৭ • জুপিটার নোটবুক) ১০ সপ্তাহ, ২০টি পাঠ, সকলের জন্য ডেটা সায়েন্স! 🔗 microsoft/Data-Science-For-Beginners #৮ microsoft/PowerToys (⭐ ১৪০.১ হাজার • আজ +৮৪ • C) মাইক্রোসফট পাওয়ারটয়েজ হলো ইউটিলিটিগুলোর একটি সংগ্রহ যা উইন্ডোজে উৎপাদনশীলতা এবং কাস্টমাইজেশনকে দারুণভাবে বাড়িয়ে তোলে। 🔗 microsoft/PowerToys #৯ neovim/neovim (⭐ ১০৩.২ হাজার • আজ +৪১ • Vim Script) এক্সটেনসিবিলিটি এবং ব্যবহারযোগ্যতার উপর দৃষ্টি নিবদ্ধ একটি ভিম-ফর্ক। 🔗 neovim/neovim #১০ jellyfin/jellyfin (⭐ ৫৮.৭ হাজার • আজ +৭৪ • C#) ফ্রি সফটওয়্যার মিডিয়া সিস্টেম - সার্ভার ব্যাকএন্ড এবং এপিআই। 🔗 jellyfin/jellyfin #১১ run-llama/llama_index (⭐ ৫২.৭ হাজার • আজ +২৩) • পাইথন) লামা ইনডেক্স (LlamaIndex) হলো এআই (AI)-এর জন্য ডকুমেন্ট প্রসেসিং প্ল্যাটফর্ম 🔗 run-llama/llama_index #১২ অ্যাঙ্কোর/সিফট (⭐ ৯.৮ হাজার • আজ +১৪ • গো) কন্টেইনার ইমেজ এবং ফাইলসিস্টেম থেকে সফটওয়্যার বিল অফ মেটেরিয়ালস (Software Bill of Materials) তৈরি করার জন্য একটি সিএলআই (CLI) টুল এবং লাইব্রেরি 🔗 anchore/syft #১৩ মাইক্রোসফট/প্লেরাইট (⭐ ৯৮.৭ হাজার • আজ +৯০ • টাইপস্ক্রিপ্ট) প্লেরাইট (Playwright) হলো ওয়েব টেস্টিং এবং অটোমেশনের জন্য একটি ফ্রেমওয়ার্ক। এটি একটিমাত্র এপিআই (API) দিয়ে ক্রোমিয়াম (Chromium), ফায়ারফক্স (Firefox) এবং ওয়েবকিট (WebKit) পরীক্ষা করার সুযোগ দেয়। 🔗 microsoft/playwright #১৪ মেকপ্লেন/প্লেন (⭐ ৬১.৬ হাজার • আজ +৬৪ • টাইপস্ক্রিপ্ট) 🔥🔥🔥 ওপেন-সোর্স জিরা (Jira), লিনিয়ার (Linear), মানডে (Monday), এবং ক্লিকআপ (ClickUp)-এর বিকল্প। প্লেন হলো টাস্ক, স্প্রিন্ট, ডক্স এবং ট্রায়েজ পরিচালনার জন্য একটি আধুনিক প্রজেক্ট ম্যানেজমেন্ট প্ল্যাটফর্ম। 🔗 makeplane/plane #15 pgvector/pgvector (⭐ ২৩.৫ হাজার • আজ +১৭ • C) পোস্টগ্রেসের জন্য ওপেন-সোর্স ভেক্টর সিমিলারিটি সার্চ 🔗 pgvector/pgvector ━━━━━━━━━━━━━━━━━━━━━━ প্রতিদিনের গিটহাব ট্রেন্ডিং রিপোজিটরি, ওপেন সোর্স রাউন্ডআপ এবং ডেভেলপার নিউজের জন্য @devrepos-এ সাবস্ক্রাইব করুন। প্রতিদিন গিটহাবের সেরা ওপেন সোর্স সফটওয়্যার এবং ট্রেন্ডিং প্রজেক্টগুলো নিয়ে নতুন ভিডিও আসে। [de-DE] Der ultimative Entwickler-Stack: 23 angesagte GitHub-Repos | 28.10.2026 | Dev Repos Daily cutt.ly 🔥 Dieses neue KI-Repository ist noch ein Geheimtipp (Sommer 2027 – Praktika) Bleiben Sie mit dieser handverlesenen Auswahl angesagter GitHub-Repositories immer auf dem Laufenden im Open-Source-Ökosystem. Von innovativen Entwicklertools bis hin zu bahnbrechenden Frameworks – diese Projekte begeistern die Software-Community geradezu. 28. Oktober 2026 Inhalt dieses Videos: - Die 23 beliebtesten GitHub-Repositories, sortiert nach den heute erhaltenen Sternen - Entwickler-Einblicke und Projektübersichten zu jedem vorgestellten Repository - KI-gestützter Rundgang durch jedes Open-Source-Projekt - Direkte Links zu allen Repositories für einfachen Zugriff ⏱️ ZEITSTEMPEL (YouTube-Kapitel): 00:00 - Intro: Die wichtigsten Tools von heute 00:09 - Übersicht der beliebtesten Repositories 00:25 - #1 Sommer 2027 – Praktika 00:54 - #2 n8n 01:24 - #3 datahub 01:45 - #4 upscayl 02:08 - #5 free-for-dev 02:33 - #6 awesome-remote-job 02:59 - #7 Data-Science-For-Beginners 03:27 - #8 PowerToys 03:50 – #9 neovim 04:10 – #10 jellyfin 04:33 – #11 llama_index 04:56 – #12 syft 05:18 – #13 playwright 05:46 – #14 plane 06:09 – #15 pgvector 06:28 – #16 awesome 06:59 – #17 runner-images 07:19 – #18 rustdesk 07:43 – #19 lazygit 08:05 – #20 transformers 08:31 – #21 directus 09:02 – #22 gitleaks 09:22 – #23 OpenCore-Legacy-Patcher 09:45 – Abspann & Legende Wichtigste Erkenntnisse ━━━━━━━━━━━━━━━━━━━━━━━ Die 23 beliebtesten Jobportale von heute: ━━━━━━━━━━━━━━━━━━━━━━━ #1 SimplifyJobs/Sommer 2027 – Praktika (⭐ 48,2k • +21 heute • Python) Stellenangebote für Praktika im Bereich Softwareentwicklung, Data Science, KI, Quantitative Methoden, Produktmanagement und Hardware im Sommer 2027. Täglich aktualisiert von Simplify und Pitt CSC. 🔗 SimplifyJobs/Summer2027-Internships #2 n8n-io/n8n (⭐ 208,9k • +161 heute • TypeScript) Fair-Code-Workflow-Automatisierungsplattform mit nativen KI-Funktionen. Visuelles Erstellen mit benutzerdefiniertem Code kombinieren, selbst hosten oder in der Cloud, über 400 Integrationen. 🔗 n8n-io/n8n #3 datahub-project/datahub (⭐ 12,9k • +10 heute • Python) Die Kontextplattform für Ihren Daten- und KI-Stack. 🔗 datahub-project/datahub #4 upscayl/upscayl (⭐ 51,2k • +76 heute • TypeScript) 🆙 Upscayl – Nr. 1 kostenloser Open-Source-KI-Bild-Upscaler für Linux, macOS und Windows. 🔗 upscayl/upscayl #5 ripienaar/free-for-dev (⭐ 140.200 • +55 heute • HTML) Eine Liste von SaaS-, PaaS- und IaaS-Angeboten mit kostenlosen Tarifen, die für DevOps- und Infrastrukturentwickler interessant sind. 🔗 ripienaar/free-for-dev #6 lukasz-madon/awesome-remote-job (⭐ 50.000 • +99 heute • Unbekannt) Eine kuratierte Liste mit tollen Remote-Jobs und Ressourcen. Inspiriert von vinta/awesome-python 🔗 lukasz-madon/awesome-remote-job #7 microsoft/Data-Science-For-Beginners (⭐ 37,8k • +47 heute • Jupyter Notebook) 10 Wochen, 20 Lektionen: Data Science für alle! 🔗 microsoft/Data-Science-For-Beginners #8 microsoft/PowerToys (⭐ 140,1k • +84 heute • C) Microsoft PowerToys ist eine Sammlung von Hilfsprogrammen, die die Produktivität und Anpassungsmöglichkeiten unter Windows deutlich verbessern. 🔗 microsoft/PowerToys #9 neovim/neovim (⭐ 103,2k • +41 heute • Vim Script) Vim-Fork mit Fokus auf Erweiterbarkeit und Benutzerfreundlichkeit. 🔗 neovim/neovim #10 jellyfin/jellyfin (⭐ 58,7k • +74 heute • C#) Das Free Software Media System – Server-Backend & API 🔗 jellyfin/jellyfin #11 run-llama/llama_index (⭐ 52,7k • +23 heute • Python) LlamaIndex ist die Dokumentenverarbeitungsplattform für KI. 🔗 run-llama/llama_index #12 anchore/syft (⭐ 9,8k • +14 heute • Go) CLI-Tool und Bibliothek zur Generierung einer Software-Stückliste aus Container-Images und Dateisystemen. 🔗 anchore/syft #13 microsoft/playwright (⭐ 98,7k • +90 heute • TypeScript) Playwright ist ein Framework für Webtests und -automatisierung. Es ermöglicht das Testen von Chromium, Firefox und WebKit mit einer einzigen API. 🔗 microsoft/playwright #14 makeplane/plane (⭐ 61,6k • +64 heute • TypeScript) 🔥🔥🔥 Plane ist eine Open-Source-Alternative zu Jira, Linear, Monday und ClickUp. Es handelt sich um eine moderne Projektmanagement-Plattform zur Verwaltung von Aufgaben, Sprints, Dokumenten und Priorisierung. 🔗 makeplane/plane #15 pgvector/pgvector (⭐ 23,5k • +17 heute • C) Open-Source-Vektorähnlichkeitssuche für PostgreSQL 🔗 pgvector/pgvector ━━━━━━━━━━━━━━━━━━━━━━━━ Abonniere @devrepos für täglich aktuelle GitHub-Repositories, Open-Source-Übersichten und Entwickler-News. Täglich neue Videos zu den besten Open-Source-Softwareprojekten und Trendprojekten auf GitHub. [es-US] El stack definitivo para desarrolladores: 23 repositorios de GitHub en tendencia | 28/10/2026 | D... cutt.ly 🔥 Nadie te habló de este nuevo repositorio de IA (Prácticas de verano de 2027) Mantente al día con el ecosistema de código abierto con esta selección de repositorios de GitHub que marcan tendencia. Desde herramientas innovadoras para desarrolladores hasta frameworks revolucionarios, estos son los proyectos que están causando sensación en la comunidad de software. 28 de octubre de 2026 Contenido de este video: - Los 23 repositorios de GitHub más populares, clasificados según las estrellas obtenidas hoy. - Información para desarrolladores y descripciones generales de cada repositorio destacado. - Tutorial guiado por IA de cada proyecto de código abierto. - Enlaces directos a todos los repositorios a continuación para un acceso fácil. ⏱️ MARCAS DE TIEMPO (Capítulos de YouTube): 00:00 - Introducción: Herramientas de alto impacto de hoy 00:09 - Resumen de la clasificación de tendencias 00:25 - N.° 1: Prácticas de verano de 2027 00:54 - N.° 2: n8n 01:24 - N.° 3: datahub 01:45 - N.° 4: upscayl 02:08 - N.° 5: free-for-dev 02:33 - N.° 6: awesome-remote-job 02:59 - N.° 7: Ciencia de datos para principiantes 03:27 - N.° 8 PowerToys 03:50 - #9 neovim 04:10 - #10 jellyfin 04:33 - #11 llama_index 04:56 - #12 syft 05:18 - #13 playwright 05:46 - #14 plane 06:09 - #15 pgvector 06:28 - #16 awesome 06:59 - #17 runner-images 07:19 - #18 rustdesk 07:43 - #19 lazygit 08:05 - #20 transformers 08:31 - #21 directus 09:02 - #22 gitleaks 09:22 - #23 OpenCore-Legacy-Patcher 09:45 - Outro y clave Conclusiones ━━━━━━━━━━━━━━━━━━━━━━━ LOS 23 REPOSITORIOS MÁS POPULARES DE HOY: ━━━━━━━━━━━━━━━━━━━━━━━━ #1 SimplifyJobs/Summer2027-Interships (⭐ 48.2k • +21 hoy • Python) Ofertas de prácticas de verano de 2027 en ingeniería de software, ciencia de datos, IA, análisis cuantitativo, gestión de productos y hardware. Actualizado diariamente por Simplify y Pitt CSC. 🔗 SimplifyJobs/Summer2027-Internships #2 n8n-io/n8n (⭐ 208.9k • +161 hoy • TypeScript) Plataforma de automatización de flujos de trabajo con código justo y capacidades de IA nativas. Combina la creación visual con código personalizado, autoalojamiento o en la nube, más de 400 integraciones. 🔗 n8n-io/n8n #3 datahub-project/datahub (⭐ 12.9k • +10 hoy • Python) La plataforma de contexto para tu pila de datos e IA. 🔗 datahub-project/datahub #4 upscayl/upscayl (⭐ 51.2k • +76 hoy • TypeScript) 🆙 Upscayl: el escalador de imágenes con IA gratuito y de código abierto n.° 1 para Linux, macOS y Windows. 🔗 upscayl/upscayl #5 ripienaar/free-for-dev (⭐ 140.2k • +55 hoy • HTML) Una lista de ofertas de SaaS, PaaS e IaaS con planes gratuitos de interés para devops e infradev. 🔗 ripienaar/free-for-dev #6 lukasz-madon/awesome-remote-job (⭐ 50k • +99 hoy • Desconocido) Una lista seleccionada de excelentes trabajos y recursos remotos. Inspirado en vinta/awesome-python 🔗 lukasz-madon/awesome-remote-job #7 microsoft/Ciencia de Datos para Principiantes (⭐ 37.8k • +47 hoy • Jupyter Notebook) 10 semanas, 20 lecciones: ¡Ciencia de Datos para todos! 🔗 microsoft/Data-Science-For-Beginners #8 microsoft/PowerToys (⭐ 140.1k • +84 hoy • C) Microsoft PowerToys es una colección de utilidades que potencian la productividad y la personalización en Windows. 🔗 microsoft/PowerToys #9 neovim/neovim (⭐ 103.2k • +41 hoy • Vim Script) Bifurcación de Vim centrada en la extensibilidad y la usabilidad. 🔗 neovim/neovim #10 jellyfin/jellyfin (⭐ 58.7k • +74 hoy • C#) Sistema de medios de software libre: backend y API del servidor. 🔗 jellyfin/jellyfin #11 run-llama/llama_index (⭐ 52.7k • +23 hoy • Python) LlamaIndex es la plataforma de procesamiento de documentos para IA. 🔗 run-llama/llama_index #12 anchore/syft (⭐ 9.8k • +14 hoy • Go) Herramienta y biblioteca de línea de comandos para generar una lista de materiales de software a partir de imágenes de contenedores y sistemas de archivos. 🔗 anchore/syft #13 microsoft/playwright (⭐ 98.7k • +90 hoy • TypeScript) Playwright es un framework para pruebas y automatización web. Permite probar Chromium, Firefox y WebKit con una única API. 🔗 microsoft/playwright #14 makeplane/plane (⭐ 61.6k • +64 hoy • TypeScript) 🔥🔥🔥 Alternativa de código abierto a Jira, Linear, Monday y ClickUp. Plane es una plataforma moderna de gestión de proyectos para administrar tareas, sprints, documentación y priorización de tareas. 🔗 makeplane/plane #15 pgvector/pgvector (⭐ 23.5k • +17 hoy • C) Búsqueda de similitud vectorial de código abierto para PostgreSQL 🔗 pgvector/pgvector ━━━━━━━━━━━━━━━━━━━━━━━━ Suscríbete a @devrepos para ver diariamente los repositorios más populares de GitHub, resúmenes de código abierto y noticias para desarrolladores. Nuevos videos cada d... [fr-FR] Le stack ultime du développeur : 23 dépôts GitHub en vogue | 28/10/2026 | Dev Repos Daily cutt.ly 🔥 Personne ne vous a parlé de ce nouveau dépôt d'IA (Stages été 2027) Restez à la pointe de l'écosystème open source grâce à cette sélection exclusive de dépôts GitHub incontournables. Des outils de développement innovants aux frameworks révolutionnaires, découvrez les projets qui font sensation dans la communauté du logiciel en ce moment. 28 octobre 2026 Contenu de cette vidéo : - Les 23 dépôts GitHub les plus populaires, classés par nombre d'étoiles gagnées aujourd'hui - Présentations et analyses de chaque dépôt mis en avant - Visite guidée commentée par une IA de chaque projet open source - Liens directs vers tous les dépôts ci-dessous pour un accès facile ⏱️ HORODATAGE (Chapitres YouTube) : 00:00 - Introduction : Les outils à fort impact du jour 00:09 - Aperçu du classement des tendances 00:25 - N° 1 Summer2027-Internships 00:54 - N° 2 n8n 01:24 - N° 3 datahub 01:45 - N° 4 upscayl 02:08 - N° 5 free-for-dev 02:33 - N° 6 awesome-remote-job 02:59 - N° 7 Data-Science-For-Beginners 03:27 - N° 8 PowerToys 03:50 - #9 neovim 04:10 - #10 jellyfin 04:33 - #11 llama_index 04:56 - #12 syft 05:18 - #13 playwright 05:46 - #14 plane 06:09 - #15 pgvector 06:28 - #16 awesome 06:59 - #17 runner-images 07:19 - #18 rustdesk 07:43 - #19 lazygit 08:05 - #20 transformers 08:31 - #21 directus 09:02 - #22 gitleaks 09:22 - #23 OpenCore-Legacy-Patcher 09:45 - Conclusion et légende Points clés ━━━━━━━━━━━━━━━━━━━━━━ TOP 23 DES DÉPÔTS LES PLUS CONSULTÉS AUJOURD'HUI : ━━━━━━━━━━━━━━━━━━━━━━━ N° 1 SimplifyJobs/Stages Été 2027 (⭐ 48,2 k • +21 aujourd'hui • Python) Offres de stage Été 2027 en génie logiciel, science des données, IA, analyse quantitative, gestion de produits et matériel informatique. Mise à jour quotidienne par Simplify et Pitt CSC. 🔗 SimplifyJobs/Summer2027-Internships #2 n8n-io/n8n (⭐ 208,9 k • +161 aujourd'hui • TypeScript) Plateforme d'automatisation des flux de travail FairCode avec des fonctionnalités d'IA natives. Combinez la création visuelle avec du code personnalisé, auto-hébergé ou cloud, plus de 400 intégrations. 🔗 n8n-io/n8n #3 datahub-project/datahub (⭐ 12,9 k • +10 aujourd'hui • Python) La plateforme Context pour votre stack de données et d'IA 🔗 datahub-project/datahub #4 upscayl/upscayl (⭐ 51,2 k • +76 aujourd'hui • TypeScript) 🆙 Upscayl - Upscaler d'images IA gratuit et open source n° 1 pour Linux, macOS et Windows. 🔗 upscayl/upscayl #5 ripienaar/free-for-dev (⭐ 140,2 k • +55 aujourd'hui • HTML) Liste d'offres SaaS, PaaS et IaaS proposant des versions gratuites intéressantes pour les développeurs DevOps et Infrastructure. 🔗 ripienaar/free-for-dev #6 lukasz-madon/awesome-remote-job (⭐ 50 k • +99 aujourd'hui • Inconnu) Sélection d'offres d'emploi et de ressources intéressantes pour le télétravail. Inspiré par vinta/awesome-python 🔗 lukasz-madon/awesome-remote-job #7 microsoft/Data-Science-For-Beginners (⭐ 37,8 k • +47 aujourd'hui • Jupyter Notebook) 10 semaines, 20 leçons : la science des données pour tous ! 🔗 microsoft/Data-Science-For-Beginners #8 microsoft/PowerToys (⭐ 140,1 k • +84 aujourd'hui • C) Microsoft PowerToys est une collection d'utilitaires qui optimisent la productivité et la personnalisation sous Windows. 🔗 microsoft/PowerToys #9 neovim/neovim (⭐ 103,2 k • +41 aujourd'hui • Script Vim) Une version dérivée de Vim axée sur l'extensibilité et la facilité d'utilisation. 🔗 neovim/neovim #10 jellyfin/jellyfin (⭐ 58,7 k • +74 aujourd'hui • C#) Le système de gestion de médias de logiciels libres : serveur et API. 🔗 jellyfin/jellyfin #11 run-llama/llama_index (⭐ 52,7 k • +23 aujourd'hui • Python) LlamaIndex est une plateforme de traitement de documents pour l'IA. 🔗 run-llama/llama_index #12 anchore/syft (⭐ 9,8 k • +14 aujourd'hui • Go) Outil et bibliothèque en ligne de commande pour générer une nomenclature logicielle à partir d'images de conteneurs et de systèmes de fichiers. 🔗 anchore/syft #13 microsoft/playwright (⭐ 98,7 k • +90 aujourd'hui • TypeScript) Playwright est un framework pour les tests et l'automatisation web. Il permet de tester Chromium, Firefox et WebKit avec une API unique. 🔗 microsoft/playwright #14 makeplane/plane (⭐ 61,6 k • +64 aujourd'hui • TypeScript) 🔥🔥🔥 Alternative open source à Jira, Linear, Monday et ClickUp. Plane est une plateforme moderne de gestion de projet permettant de gérer les tâches, les sprints, la documentation et le triage. 🔗 makeplane/plane #15 pgvector/pgvector (⭐ 23,5 k • +17 aujourd'hui • C) Outil open source de recherche de similarité vectorielle pour Postgres 🔗 pgvector/pgvector ━━━━━━━━━━━━━━━━━━━━━━ Abonnez-vous à @devrepos pour découvrir chaque jour les dépôts GitHub les plus ... [hi] बेहतरीन डेवलपर स्टैक: 23 ट्रेंडिंग GitHub रिपोज़ | 28-10-2026 | डेव रिपोज़ डेली cutt.ly 🔥 इस नए AI रिपॉजिटरी के बारे में आपको किसी ने नहीं बताया (ग्रीष्म 2027 - इंटर्नशिप) ओपन सोर्स इकोसिस्टम की नवीनतम जानकारी के लिए GitHub के इन चुनिंदा रिपॉजिटरी का इस्तेमाल करें। इनोवेटिव डेवलपर टूल्स से लेकर क्रांतिकारी फ्रेमवर्क तक, ये वो प्रोजेक्ट हैं जो सॉफ्टवेयर जगत में धूम मचा रहे हैं। 28 अक्टूबर, 2026 इस वीडियो में क्या है: - आज प्राप्त स्टार रेटिंग के आधार पर शीर्ष 23 ट्रेंडिंग GitHub रिपॉजिटरी - प्रत्येक प्रदर्शित रिपॉजिटरी के लिए डेवलपर अंतर्दृष्टि और प्रोजेक्ट अवलोकन - प्रत्येक ओपन सोर्स प्रोजेक्ट का AI-नैरेटेड वॉकथ्रू - आसान पहुँच के लिए नीचे सभी रिपॉजिटरी के सीधे लिंक ⏱️ टाइमस्टैम्प (YouTube अध्याय): 00:00 - परिचय: आज के उच्च-प्रभाव वाले उपकरण 00:09 - ट्रेंडिंग लीडरबोर्ड अवलोकन 00:25 - #1 समर 2027 इंटर्नशिप 00:54 - #2 n8n 01:24 - #3 datahub 01:45 - #4 upscayl 02:08 - #5 फ्री-फॉर-डेव 02:33 - #6 शानदार रिमोट जॉब 02:59 - #7 डेटा साइंस फॉर बिगिनर्स 03:27 - #8 पॉवर टॉयज़ 03:50 - #9 नेओविम 04:10 - #10 जेलीफिन 04:33 - #11 लामा_इंडेक्स 04:56 - #12 सिफ्ट 05:18 - #13 प्लेराइट 05:46 - #14 प्लेन 06:09 - #15 पीजीवेक्टर 06:28 - #16 ऑसम 06:59 - #17 रनर-इमेजेज 07:19 - #18 रस्टडेस्क 07:43 - #19 लेज़ीगिट 08:05 - #20 ट्रांसफॉर्मर्स 08:31 - #21 डायरेक्टस 09:02 - #22 गिटलीक्स 09:22 - #23 ओपनकोर-लेगेसी-पैचर 09:45 - आउट्रो और कुंजी मुख्य बिंदु ━━━━━━━━━━━━━━━━━━━━━━━━ आज के शीर्ष 23 ट्रेंडिंग रिपॉजिटरी: ━━━━━━━━━━━━━━━━━━━━━━━━ #1 SimplifyJobs/Summer2027-इंटर्नशिप (⭐ 48.2k • आज +21 • पायथन) ग्रीष्मकालीन 2027 के लिए सॉफ्टवेयर इंजीनियरिंग, डेटा साइंस, एआई, क्वांट, प्रोडक्ट मैनेजमेंट और हार्डवेयर इंटर्नशिप के अवसर। Simplify और Pitt CSC द्वारा प्रतिदिन अपडेट किया जाता है। 🔗 SimplifyJobs/Summer2027-Internships #2 n8n-io/n8n (⭐ 208.9k • आज +161 • TypeScript) नेटिव AI क्षमताओं वाला फेयर-कोड वर्कफ़्लो ऑटोमेशन प्लेटफ़ॉर्म। विज़ुअल बिल्डिंग को कस्टम कोड के साथ मिलाएं, सेल्फ-होस्ट या क्लाउड का उपयोग करें, 400+ इंटीग्रेशन उपलब्ध हैं। 🔗 n8n-io/n8n #3 datahub-project/datahub (⭐ 12.9k • आज +10 • Python) आपके डेटा और AI स्टैक के लिए कॉन्टेक्स्ट प्लेटफ़ॉर्म 🔗 datahub-project/datahub #4 upscayl/upscayl (⭐ 51.2k • आज +76 • TypeScript) 🆙 Upscayl - Linux, MacOS और Windows के लिए नंबर 1 मुफ़्त और ओपन सोर्स AI इमेज अपस्केलर। 🔗 upscayl/upscayl #5 ripienaar/free-for-dev (⭐ 140.2k • आज +55 • HTML) SaaS, PaaS और IaaS सेवाओं की एक सूची जिनमें DevOps और InfraDevelop के लिए उपयोगी निःशुल्क विकल्प उपलब्ध हैं। 🔗 ripienaar/free-for-dev #6 lukasz-madon/awesome-remote-job (⭐ 50k • आज +99 • अज्ञात) शानदार रिमोट जॉब्स और संसाधनों की एक चुनिंदा सूची। vinta/awesome-python से प्रेरित 🔗 lukasz-madon/awesome-remote-job #7 microsoft/Data-Science-For-Beginners (⭐ 37.8k • आज +47 • Jupyter Notebook) 10 सप्ताह, 20 पाठ, सभी के लिए डेटा साइंस! 🔗 microsoft/Data-Science-For-Beginners #8 microsoft/PowerToys (⭐ 140.1k • आज +84 • C) Microsoft PowerToys यूटिलिटीज़ का एक संग्रह है जो Windows पर उत्पादकता और अनुकूलन को बढ़ाता है। 🔗 microsoft/PowerToys #9 neovim/neovim (⭐ 103.2k • आज +41 • Vim Script) विस्तारशीलता और उपयोगिता पर केंद्रित Vim-फोर्क 🔗 neovim/neovim #10 jellyfin/jellyfin (⭐ 58.7k • आज +74 • C#) फ्री सॉफ्टवेयर मीडिया सिस्टम - सर्वर बैकएंड और API 🔗 jellyfin/jellyfin #11 run-llama/llama_index (⭐ 52.7k • आज +23 • Python) LlamaIndex एक AI-आधारित दस्तावेज़ प्रसंस्करण प्लेटफ़ॉर्म है। 🔗 run-llama/llama_index #12 anchore/syft (⭐ 9.8k • आज +14 • Go) कंटेनर इमेज और फ़ाइल सिस्टम से सॉफ़्टवेयर बिल ऑफ़ मैटेरियल्स जनरेट करने के लिए एक CLI टूल और लाइब्रेरी। 🔗 anchore/syft #13 microsoft/playwright (⭐ 98.7k • आज +90 • TypeScript) Playwright वेब टेस्टिंग और ऑटोमेशन के लिए एक फ़्रेमवर्क है। यह एक ही API के साथ Chromium, Firefox और WebKit की टेस्टिंग की सुविधा देता है। 🔗 microsoft/playwright #14 makeplane/plane (⭐ 61.6k • आज +64 • TypeScript) 🔥🔥🔥 ओपन-सोर्स Jira, Linear, Monday और ClickUp का विकल्प। Plane एक आधुनिक प्रोजेक्ट मैनेजमेंट प्लेटफॉर्म है जिसका उपयोग टास्क, स्प्रिंट, डॉक्स और ट्राइएज को मैनेज करने के लिए किया जाता है। 🔗 makeplane/plane #15 pgvector/pgvector (⭐ 23.5k • आज +17 • C) पोस्टग्रेस के लिए ओपन-सोर्स वेक्टर समानता खोज 🔗 pgvector/pgvector ━━━━━━━━━━━━━━━━━━━━━━━━ दैनिक GitHub ट्रेंडिंग रिपॉजिटरी, ओपन सोर्स राउंडअप और डेवलपर समाचारों के लिए @devrepos को सब्सक्राइब करें। GitHub पर सर्वश्रेष्ठ ओपन सोर्स सॉफ़्टवेयर और ट्रेंडिंग प्रोजेक्ट्स को कवर करने वाले नए वीडियो हर दिन देखें। [id] Tumpukan Perangkat Lunak Pengembang Terbaik: 23 Repositori GitHub Terpopuler | 28-10-2026 | Dev R... cutt.ly 🔥 Belum Ada yang Memberitahu Anda Tentang Repositori AI Baru Ini (Magang Musim Panas 2027) Tetap terhubung dengan ekosistem open source dengan pilihan repositori GitHub yang sedang tren ini. Dari alat pengembang yang inovatif hingga kerangka kerja yang inovatif, ini adalah proyek-proyek yang sedang membuat gebrakan di komunitas perangkat lunak saat ini. 28 Oktober 2026 Isi video ini: - 23 repositori GitHub terpopuler yang diurutkan berdasarkan bintang yang diperoleh hari ini - Wawasan pengembang dan ikhtisar proyek untuk setiap repositori unggulan - Panduan yang dinarasikan AI untuk setiap proyek sumber terbuka - Tautan langsung ke semua repositori di bawah ini untuk akses mudah ⏱️ CAP WAKTU (Bab YouTube): 00:00 - Pendahuluan: Alat-alat Berdampak Tinggi Hari Ini 00:09 - Ikhtisar Papan Peringkat Terpopuler 00:25 - #1 Magang Musim Panas 2027 00:54 - #2 n8n 01:24 - #3 datahub 01:45 - #4 upscayl 02:08 - #5 free-for-dev 02:33 - #6 awesome-remote-job 02:59 - #7 Ilmu Data untuk Pemula 03:27 - #8 PowerToys 03:50 - #9 neovim 04:10 - #10 jellyfin 04:33 - #11 llama_index 04:56 - #12 syft 05:18 - #13 playwright 05:46 - #14 plane 06:09 - #15 pgvector 06:28 - #16 awesome 06:59 - #17 runner-images 07:19 - #18 rustdesk 07:43 - #19 lazygit 08:05 - #20 transformers 08:31 - #21 directus 09:02 - #22 gitleaks 09:22 - #23 OpenCore-Legacy-Patcher 09:45 - Outro & Key Poin Penting ━━━━━━━━━━━━━━━━━━━━━━━ 23 REPOSITORI YANG SEDANG TREN HARI INI: ━━━━━━━━━━━━━━━━━━━━━━━ #1 SimplifyJobs/Summer2027-Internships (⭐ 48,2 ribu • +21 hari ini • Python) Lowongan magang musim panas 2027 di bidang rekayasa perangkat lunak, ilmu data, AI, kuantitatif, manajemen produk, dan perangkat keras. Diperbarui setiap hari oleh Simplify dan Pitt CSC. 🔗 SimplifyJobs/Summer2027-Internships #2 n8n-io/n8n (⭐ 208,9 ribu • +161 hari ini • TypeScript) Platform otomatisasi alur kerja fair-code dengan kemampuan AI asli. Gabungkan pembuatan visual dengan kode kustom, hosting sendiri atau cloud, 400+ integrasi. 🔗 n8n-io/n8n #3 datahub-project/datahub (⭐ 12.9k • +10 hari ini • Python) Platform Konteks untuk Tumpukan Data dan AI Anda 🔗 datahub-project/datahub #4 upscayl/upscayl (⭐ 51.2k • +76 hari ini • TypeScript) 🆙 Upscayl - Pengoptimal Gambar AI Gratis dan Sumber Terbuka #1 untuk Linux, MacOS, dan Windows. 🔗 upscayl/upscayl #5 ripienaar/free-for-dev (⭐ 140.2k • +55 hari ini • HTML) Daftar penawaran SaaS, PaaS, dan IaaS yang memiliki tingkatan gratis yang menarik bagi devops dan infradev 🔗 ripienaar/free-for-dev #6 lukasz-madon/awesome-remote-job (⭐ 50k • +99 hari ini • Tidak diketahui) Daftar pilihan pekerjaan dan sumber daya jarak jauh yang luar biasa. Terinspirasi oleh vinta/awesome-python 🔗 lukasz-madon/awesome-remote-job #7 microsoft/Data-Science-For-Beginners (⭐ 37.8k • +47 hari ini • Jupyter Notebook) 10 Minggu, 20 Pelajaran, Ilmu Data untuk Semua! 🔗 microsoft/Data-Science-For-Beginners #8 microsoft/PowerToys (⭐ 140.1k • +84 hari ini • C) Microsoft PowerToys adalah kumpulan utilitas yang meningkatkan produktivitas dan kustomisasi di Windows 🔗 microsoft/PowerToys #9 neovim/neovim (⭐ 103.2k • +41 hari ini • Skrip Vim) Vim-fork yang berfokus pada ekstensibilitas dan kegunaan 🔗 neovim/neovim #10 jellyfin/jellyfin (⭐ 58.7k • +74 hari ini • C#) Sistem Media Perangkat Lunak Gratis - Backend Server & API 🔗 jellyfin/jellyfin #11 run-llama/llama_index (⭐ 52.7k • +23 hari ini • Python) LlamaIndex adalah platform pemrosesan dokumen untuk AI 🔗 run-llama/llama_index #12 anchore/syft (⭐ 9.8k • +14 hari ini • Go) Alat dan pustaka CLI untuk menghasilkan Daftar Material Perangkat Lunak dari citra kontainer dan sistem file 🔗 anchore/syft #13 microsoft/playwright (⭐ 98.7k • +90 hari ini • TypeScript) Playwright adalah kerangka kerja untuk Pengujian dan Otomatisasi Web. Ini memungkinkan pengujian Chromium, Firefox, dan WebKit dengan satu API. 🔗 microsoft/playwright #14 makeplane/plane (⭐ 61.6k • +64 hari ini • TypeScript) 🔥🔥🔥 Alternatif Jira, Linear, Monday, dan ClickUp sumber terbuka. Plane adalah platform manajemen proyek modern untuk mengelola tugas, sprint, dokumen, dan triase. 🔗 makeplane/plane #15 pgvector/pgvector (⭐ 23.5k • +17 hari ini • C) Pencarian kesamaan vektor sumber terbuka untuk Postgres 🔗 pgvector/pgvector ━━━━━━━━━━━━━━━━━━━━━━━ Berlangganan @devrepos untuk repositori GitHub yang sedang tren setiap hari, rangkuman sumber terbuka, dan berita pengembang. Video baru setiap hari yang membahas perangkat lunak sumber terbuka terbaik dan proyek-proyek yang sedang tren di GitHub. [it] Lo stack definitivo per sviluppatori: 23 repository GitHub di tendenza | 28/10/2026 | Dev Repos D... Italiano: cutt.ly 🔥 Nessuno ti ha parlato di questo nuovo repository di IA (Tirocini estivi 2027) Rimani aggiornato sull'ecosistema open source con questa selezione accurata di repository GitHub di tendenza. Da strumenti di sviluppo innovativi a framework rivoluzionari, questi sono i progetti che stanno facendo scalpore nella comunità del software in questo momento. 28 ottobre 2026 Contenuto del video: - I 23 repository GitHub più popolari, classificati in base alle stelle guadagnate oggi - Approfondimenti per sviluppatori e panoramiche dei progetti per ogni repository presentato - Guida interattiva con narrazione AI per ogni progetto open source - Link diretti a tutti i repository qui sotto per un facile accesso ⏱️ INDICE DEI CONTENUTI (Capitoli di YouTube): 00:00 - Introduzione: Strumenti di grande impatto di oggi 00:09 - Panoramica della classifica dei più popolari 00:25 - #1 Summer2027-Internships 00:54 - #2 n8n 01:24 - #3 datahub 01:45 - #4 upscayl 02:08 - #5 free-for-dev 02:33 - #6 awesome-remote-job 02:59 - #7 Data-Science-For-Beginners 03:27 - #8 PowerToys 03:50 - #9 neovim 04:10 - #10 jellyfin 04:33 - #11 llama_index 04:56 - #12 syft 05:18 - #13 playwright 05:46 - #14 plane 06:09 - #15 pgvector 06:28 - #16 awesome 06:59 - #17 runner-images 07:19 - #18 rustdesk 07:43 - #19 lazygit 08:05 - #20 transformers 08:31 - #21 directus 09:02 - #22 gitleaks 09:22 - #23 OpenCore-Legacy-Patcher 09:45 - Outro e Key Punti chiave ━━━━━━━━━━━━━━━━━━━━━━━━ I 23 REPOSITORY PIÙ DI TENDENZA DI OGGI: ━━━━━━━━━━━━━━━━━━━━━━ #1 SimplifyJobs/Summer2027-Internships (⭐ 48.2k • +21 oggi • Python) Offerte di stage per l'estate 2027 in ingegneria del software, data science, IA, analisi quantitativa, gestione del prodotto e hardware. Aggiornato quotidianamente da Simplify e Pitt CSC. #1 SimplifyJobs/Summer2027-Internships (⭐ 48.2k • +21 oggi • Python) Offerte di stage per l'estate 2027 in ingegneria del software, data science, IA, analisi quantitativa, gestione del prodotto e hardware. 🔗 SimplifyJobs/Summer2027-Internships #2 n8n-io/n8n (⭐ 208.9k • +161 oggi • TypeScript) Piattaforma di automazione del flusso di lavoro con codice equo e funzionalità native di IA. Combina la creazione visuale con codice personalizzato, self-hosting o cloud, oltre 400 integrazioni. 🔗 n8n-io/n8n #3 datahub-project/datahub (⭐ 12.9k • +10 oggi • Python) La piattaforma di contesto per il tuo stack di dati e IA 🔗 datahub-project/datahub #4 upscayl/upscayl (⭐ 51.2k • +76 oggi • TypeScript) 🆙 Upscayl - Il miglior strumento gratuito e open source per l'upscaling di immagini basato sull'IA per Linux, MacOS e Windows. 🔗 upscayl/upscayl #5 ripienaar/free-for-dev (⭐ 140.2k • +55 oggi • HTML) Un elenco di offerte SaaS, PaaS e IaaS con piani gratuiti di interesse per DevOps e InfraDev 🔗 ripienaar/free-for-dev #6 lukasz-madon/awesome-remote-job (⭐ 50k • +99 oggi • Sconosciuto) Un elenco curato di fantastiche offerte di lavoro da remoto e risorse. Ispirato da vinta/awesome-python 🔗 lukasz-madon/awesome-remote-job #7 microsoft/Data-Science-For-Beginners (⭐ 37.8k • +47 oggi • Jupyter Notebook) 10 settimane, 20 lezioni, Data Science per tutti! 🔗 microsoft/Data-Science-For-Beginners #8 microsoft/PowerToys (⭐ 140.1k • +84 oggi • C) Microsoft PowerToys è una raccolta di utilità che potenziano la produttività e la personalizzazione su Windows 🔗 microsoft/PowerToys #9 neovim/neovim (⭐ 103.2k • +41 oggi • Vim Script) Fork di Vim focalizzato su estensibilità e usabilità 🔗 neovim/neovim #10 jellyfin/jellyfin (⭐ 58.7k • +74 oggi • C#) Il sistema multimediale software libero - Backend server e API 🔗 jellyfin/jellyfin #11 run-llama/llama_index (⭐ 52.7k • +23 oggi • Python) LlamaIndex è la piattaforma di elaborazione documenti per l'IA 🔗 run-llama/llama_index #12 anchore/syft (⭐ 9.8k • +14 oggi • Go) Strumento e libreria CLI per la generazione di una distinta base software da immagini container e filesystem 🔗 anchore/syft #13 microsoft/playwright (⭐ 98.7k • +90 oggi • TypeScript) Playwright è un framework per il test e l'automazione web. Consente di testare Chromium, Firefox e WebKit con un'unica API. 🔗 microsoft/playwright #14 makeplane/plane (⭐ 61.6k • +64 oggi • TypeScript) 🔥🔥🔥 Alternativa open source a Jira, Linear, Monday e ClickUp. Plane è una moderna piattaforma di gestione progetti per gestire attività, sprint, documentazione e priorità. #14 makeplane/plane (⭐ 61.6k • +64 oggi • TypeScript) 🔥🔥🔥 Un'alternativa open source a Jira, Linear, Monday e ClickUp. Plane è una moderna piattaforma di gestione progetti per gestire attività, sprint, documentazione e priorità. #14 makeplane/plane (⭐ 61.6k • +64 oggi • TypeScript) 🔥🔥🔥 Un'alternativa open source a Jira, Linear, M... [iw] הסטאק האולטימטיבי למפתחים: 23 פרויקטי GitHub חמים | 28/10/2026 | Dev Repos Daily cutt.ly 🔥 אף אחד לא סיפר לכם על מאגר הבינה המלאכותית החדש הזה (קיץ 2027 - התמחויות) הישארו מעודכנים במערכת האקולוגית של קוד פתוח עם מבחר נבחר זה של מאגרי GitHub טרנדיים. מכלי פיתוח חדשניים ועד מסגרות פורצות דרך, אלו הפרויקטים שעושים גלים בקהילת התוכנה כרגע. 28 באוקטובר, 2026 מה יש בסרטון הזה: - 23 מאגרי GitHub הטרנדיים ביותר מדורגים לפי כוכבים שנצברו היום - תובנות מפתחים וסקירות פרויקטים עבור כל מאגר מומלץ - סיור מקיף על כל פרויקט קוד פתוח באמצעות בינה מלאכותית - קישורים ישירים לכל המאגרים למטה לגישה נוחה ⏱️ חותמות זמן (פרקי YouTube): 00:00 - מבוא: הכלים בעלי ההשפעה הגבוהה של היום 00:09 - סקירת טבלת המובילים הטרנדיים 00:25 - #1 קיץ 2027 - התמחויות 00:54 - #2 n8n 01:24 - #3 datahub 01:45 - #4 upscayl 02:08 - #5 free-for-dev 02:33 - #6 awesome-remote-job 02:59 - #7 Data-Science-For-Beginners 03:27 - #8 PowerToys 03:50 - #9 neovim 04:10 - #10 jellyfin 04:33 - #11 llama_index 04:56 - #12 syft 05:18 - #13 playwright 05:46 - #14 plane 06:09 - #15 pgvector 06:28 - #16 awesome 06:59 - #17 runner-images 07:19 - #18 rustdesk 07:43 - #19 lazygit 08:05 - #20 transformers 08:31 - #21 directus 09:02 - #22 gitleaks 09:22 - #23 OpenCore-Legacy-Patcher 09:45 - סיום וסולם נקודות חשובות ━━━━━━━━━━━━━━━━━━━━━━━ 23 המאגרים הטרנדיים ביותר של היום: ━━━━━━━━━━━━━━━━━━━━━━━ #1 SimplifyJobs/Kitchen2027-Internships (⭐ 48.2k • +21 היום • Python) פרסומי התמחויות בהנדסת תוכנה, מדעי נתונים, בינה מלאכותית, כימות, ניהול מוצר וחומרה בקיץ 2027. מתעדכנים מדי יום על ידי Simplify ו-Pitt CSC. 🔗 SimplifyJobs/Summer2027-Internships #2 n8n-io/n8n (⭐ 208.9k • +161 היום • TypeScript) פלטפורמת אוטומציה של זרימת עבודה בקוד הוגן עם יכולות בינה מלאכותית מקוריות. שלב בנייה ויזואלית עם קוד מותאם אישית, אירוח עצמי או ענן, 400+ אינטגרציות. 🔗 n8n-io/n8n #3 datahub-project/datahub (⭐ 12.9k • +10 היום • Python) פלטפורמת ההקשר עבור מחסנית הנתונים והבינה המלאכותית שלך 🔗 datahub-project/datahub #4 upscayl/upscayl (⭐ 51.2k • +76 היום • TypeScript) 🆙 Upscayl - #1 משדרג תמונות בינה מלאכותית חינמי וקוד פתוח עבור לינוקס, MacOS ו-Windows. 🔗 upscayl/upscayl #5 ripienaar/free-for-dev (⭐ 140.2k • +55 היום • HTML) רשימה של הצעות SaaS, PaaS ו-IaaS שיש להן שכבות חינמיות שמעניינות מפתחי פיתוח ופיתוח אינפרא-אדום 🔗 ripienaar/free-for-dev #6 lukasz-madon/awesome-remote-job (⭐ 50k • +99 היום • לא ידוע) רשימה אוצרת של עבודות ומשאבים מדהימים מרחוק. בהשראת vinta/awesome-python 🔗 lukasz-madon/awesome-remote-job #7 microsoft/Data-Science-For-Beginners (⭐ 37.8k • +47 היום • Jupyter Notebook) 10 שבועות, 20 שיעורים, מדעי נתונים לכולם! 🔗 microsoft/Data-Science-For-Beginners #8 microsoft/PowerToys (⭐ 140.1k • +84 היום • C) Microsoft PowerToys הוא אוסף של כלי עזר שמשפרים את הפרודוקטיביות וההתאמה האישית ב-Windows 🔗 microsoft/PowerToys #9 neovim/neovim (⭐ 103.2k • +41 היום • סקריפט Vim) Vim-fork המתמקד בהרחבה ושימושיות 🔗 neovim/neovim #10 jellyfin/jellyfin (⭐ 58.7k • +74 היום • C#) מערכת המדיה של תוכנה חופשית - שרת Backend ו-API 🔗 jellyfin/jellyfin #11 run-llama/llama_index (⭐ 52.7k • +23 היום • Python) LlamaIndex היא פלטפורמת עיבוד מסמכים עבור בינה מלאכותית 🔗 run-llama/llama_index #12 anchore/syft (⭐ 9.8k • +14 היום • Go) כלי וספרייה של ממשק שורת פקודה (CLI) ליצירת רשימת חומרים של תוכנה מתמונות של מכולות ומערכות קבצים 🔗 anchore/syft #13 microsoft/playwright (⭐ 98.7k • +90 היום • TypeScript) Playwright היא מסגרת לבדיקות אינטרנט ואוטומציה. היא מאפשרת בדיקת Chromium, Firefox ו-WebKit עם API יחיד. 🔗 microsoft/playwright #14 makeplane/plane (⭐ 61.6k • +64 היום • TypeScript) 🔥🔥🔥 אלטרנטיבה בקוד פתוח ל-Jira, Linear, Monday ו-ClickUp. Plane היא פלטפורמת ניהול פרויקטים מודרנית לניהול משימות, ספרינטים, מסמכים וטראז'. 🔗 makeplane/plane #15 pgvector/pgvector (⭐ 23.5k • +17 היום • C) חיפוש דמיון וקטורי בקוד פתוח עבור Postgres 🔗 pgvector/pgvector ━━━━━━━━━━━━━━━━━━━━━━━━ הירשמו ל-@devrepos לקבלת מאגרי GitHub יומיים פופולריים, סיכומים בקוד פתוח וחדשות מפתחים. סרטונים חדשים מדי יום המכסים את תוכנות הקוד הפתוח הטובות ביותר ופרויקטים פופולריים ב-GitHub. [ja] 究極の開発者スタック：GitHubでトレンドのレポジトリ23選 | 2026年10月28日 | 開発者レポジトリ・デイリー cutt.ly 🔥 誰も教えてくれなかった、注目のAIリポジトリ（2027年夏期インターンシップ） 厳選された話題のGitHubリポジトリで、オープンソースエコシステムの最新情報を常に把握しましょう。革新的な開発ツールから画期的なフレームワークまで、ソフトウェアコミュニティで今まさに注目を集めているプロジェクトをご紹介します。 2026年10月28日 この動画の内容： - 本日獲得したスター数でランキングされた、GitHubで話題のリポジトリ上位23件 - 各リポジトリの開発者向け解説とプロジェクト概要 - AIによるナレーション付き、各オープンソースプロジェクトの解説 - すべてのリポジトリへの直接リンク（下記参照） ⏱️ タイムスタンプ（YouTubeチャプター）： 00:00 - はじめに：今日の注目ツール 00:09 - トレンドランキング概要 00:25 - #1 Summer2027-Internships 00:54 - #2 n8n 01:24 - #3 datahub 01:45 - #4 upscayl 02:08 - #5 free-for-dev 02:33 - #6 awesome-remote-job 02:59 - #7 Data-Science-For-Beginners 03:27 - #8 PowerToys 03:50 - #9 neovim 04:10 - #10 jellyfin 04:33 - #11 llama_index 04:56 - #12 syft 05:18 - #13 playwright 05:46 - #14 plane 06:09 - #15 pgvector 06:28 - #16 awe
your app's lockfile doesn't inventory the OS packages in its container. Syft inventories supported OS and language packages in the built image and exports an SBOM. useful when the question is "what did we actually ship?" anchore/syft
grype ⭐ 13k Grype scans container images and filesystems to find known vulnerabilities, for developers and security teams. 🔗 anchore/grype #opensource t.co
Dependabot's now a month late on Python and Go CVEs --- title: "Dependabot's now a month late on Python and Go CVEs" published: true description: "Since May, Dependabot's taken a median of 36 days to pick up new Python and Go CVEs from NVD, and criticals are no quicker." tags: "python, security, github, go" canonical_url: "blog.peng.ly" cover_image: "blog.peng.ly" ai_assisted: true --- Django put out a security release on 4 August. One of the fixes, CVE-2026-15307, stops staff users writing files to disk through GeoDjango lookups, which Django says could be "in some cases enabling remote code execution". Here's what GitHub's advisory API says about it: $ gh api /advisories/GHSA-wvqv-fj8w-qmhm \ --jq '{nvd_published_at, published_at, github_reviewed_at}' { "github_reviewed_at": "2026-09-30T23:25:46Z", "nvd_published_at": "2026-08-04T17:16:46Z", "published_at": "2026-08-04T18:31:27Z" } It was public and on GitHub within an hour and a half. Then it waited 57 days for someone at GitHub to review it, and until then Dependabot doesn't tell anyone. Trivy and Grype didn't spot the ones still waiting either, which I'll get to. GitHub did warn about this. Its June post on the advisory backlog told Dependabot users: > New advisories may take longer to trigger, with critical issues prioritized. I wanted to know how much longer, and whether criticals really do go first. How a CVE gets to Dependabot There are two usual ways into GitHub's Advisory Database. A maintainer can publish an advisory on their own repo, and GitHub reviews that. Or someone else publishes the CVE (Apache, the Django team, the Go team, VulnCheck, a bug bounty platform), NVD lists it, and GitHub imports it automatically as "unreviewed". An unreviewed advisory doesn't say which package or versions it's about, and Dependabot only alerts on reviewed ones, so nothing happens until a curator fills that in. Django's went the second way, and that's the route most of this post is about. May fell off a cliff Here's the share of PyPI and Go CVEs on that route that GitHub reviewed within 30 days of NVD listing them: !NVD-route CVEs reviewed within 30 days, PyPI and Go NVD-route CVEs reviewed within 30 days, PyPI and Go (the data) _By the month NVD listed them. September's left out, as by 15 October PyPA and the Go team had only added 3 from its first fortnight_ Every month from May 2025 to April 2026 was somewhere between 73 and 100%. Then May dropped to 57%, and June and July didn't make it to one in ten. Across May to mid-September it's 31%, against 88% for the same months last year. August's a bit better at 24%, but that's only 37 CVEs and nearly all of them Python, so I wouldn't call it a recovery yet. It's both ecosytems at once, too. PyPI went from 81% to 34%, and Go from 96% to 27%. The typical wait went from same-day to 36 days. You can't see GitHub's queue from its API, as unreviewed advisories don't name a package, so I came at it from the other end. PyPA and the Go team keep their own vulnerability databases on OSV. I took every CVE from 2024 onwards in those, kept the ones that came in through NVD and not a repo advisory, and looked up when GitHub reviewed each. That's about 2,000 CVEs, 450 of them from this May to mid-September. I left out Go's standard library, since GitHub doesn't review those in any year, and openssl-encrypt, a small Python package that got 50 CVEs in two batches in August and would have dragged that month down on its own. npm and Maven don't have a database of their own outside GitHub's, so I can't do this for them. They might be fine, I've no idea. Criticals wait just as long So, "critical issues prioritized": !Reviewed within 30 days, by severity Reviewed within 30 days, by severity (the data) _15 of 20 critical, 35 of 40 high and 126 of 140 medium or low CVEs last year, then 22 of 70, 44 of 130 and 77 of 254 this year_ Criticals were the slowest group last year too, so I doubt it's new. Seven critical golang.org/x/crypto CVEs NVD listed on 22 May (one is the SSH agent not enforcing a key's confirm-before-use constraint) were all reviewed on 25 June, 34 days later. Maybe criticals do jump the queue for other kinds of advisory, but for these I cant see it. Big projects too I half expected a long tail of obscure stuff nobody installs. Here's the share of each project's NVD-route CVEs reviewed within 30 days: | Package | 2024-25 | 2026 | | ------------------- | ------- | ----- | | Mattermost | 154/155 | 18/42 | | Apache Airflow | 27/27 | 5/48 | | Gitea | 10/10 | 0/15 | | golang.org/x/crypto | 3/5 | 0/14 | | Django | 26/26 | 3/13 | The 2026 column is May to mid-September again. Airflow there includes its provider packages, and Mattermost all its modules and plugins. Airflow core on its own went from 21 of 21 to none of 34. They do get there in the end. 99% of June's CVEs have been reviewed by now, 83% of July's and 73% of August's. 36 from May to mid-September still haven't, and when I checked them all again on 16 October, none had moved. Repo advisories wait too The other route isn't any quicker. Once a maintainer publishes an advisory, GitHub's docs say reviewing it and sending Dependabot alerts "can take up to 72 hours". In September someone from GitHub's community team replied to a thread about slow CVE requests: > we're currently processing records in the order they're received, with a turnaround of approximately five weeks. And personally, since mid-August maintainers have published 58 of the advisories I've reported, 51 of them for packages Dependabot covers. GitHubs reviewed 9 so far, which took anywhere from 6 to 38 days, and the oldest one still missing from its database went public on 14 August. NIST changed something the same fortnight Why now? Tbh I don't know. GitHub says that "since mid-April" it hasn't consistently met its own goals for publishing. On 15 April, NIST changed how NVD works: it now only adds its own details, like severity scores and product lists, to CVEs that meet certain criteria (actively exploited, used by the US government and so on), and the rest wait. So maybe GitHub's curators leaned on NVD's details and lost them when NIST stopped. Or maybe they're just burried under everything else coming in - GitHub's June post says its CNA got almost 4,000 CVE requests in May alone, nearly ten times the year before. My repo advisories come with the package and versions already filled in by the maintainer, so they don't need anything from NVD, and they're slow too. That makes me lean towards the queue, but I can't prove it from out here. Quite honestly, this isn't good enough. GitHub - you need to do better. Millions of downstream apps trust you with their security, and you're taking weeks or months to send out Dependabot alerts for known critical bugs. Trivy and Grype don't see them either On 15 October I took 16 of the still-unreviewed PyPI CVEs, pinned each one's affected version in a requirements.txt, and ran Trivy 0.76 and Grype 0.120 on default settings. Neither found a single one. Grype with CPE matching turned on found 5. osv-scanner checks OSV, which has PyPA's database in it, and found all 16, which is a bit of a given since that's where I got them from, but thats also the point. If PyPA has it, osv-scanner will tell you, and it's one line to try: osv-scanner scan source -r . Go's less clear cut. Go's own database had 83% of these CVEs within a month last year and 19% this year, so govulncheck isn't any quicker than GitHub for these right now. I'll run it all again in November and see whether the wait's back under a month.
Live SBOM & Security Fixes: Anchore Devs Improve Syft & Grype (October 22nd) Join our weekly *Open Source Security* live stream! Watch Anchore's Developer Relations and Engineering teams collaborate in real-time on crucial *Software Supply Chain Security* tools. This session focuses on improving *Syft* (for *SBOM* generation) and *Grype* (for *vulnerability scanning*), addressing community-raised issues and pull requests. Every Thursday, "Open Source Gardening" offers a transparent look into maintaining popular *open source security* projects. We'll dive into items marked 'needs discussion' and, time permitting, tackle other interesting contributions. Learn development best practices, understand the challenges of *SBOM* accuracy, and see how *vulnerability scanning* tools evolve. Whether you're a contributor, user, or just curious about *open source security*, tune in to learn and engage with the minds behind Anchore's OSS tools. *Agenda:* - Discuss and resolve issues/PRs tagged 'needs discussion'. - Tackle other high-priority or interesting community contributions for Syft, Grype, and related projects. *Resources & Learn More:* - Learn about SBOMs: [Link to Anchore's SBOM pillar page/guide if available] - Dive into Software Supply Chain Security: [Link to relevant Anchore pillar page/blog if available] - Syft on GitHub: anchore/syft - Grype on GitHub: anchore/grype - Join the Community Discussion: anchore.com - All Anchore Open Source Projects: github.com/anchore - Sign-up for the OSS Newsletter: get.anchore.com #OpenSourceSecurity #SBOM #SoftwareSupplyChainSecurity [ar] بث مباشر حول SBOM وإصلاحات الأمان: مطورو Anchore يعملون على تحسين Syft وGrype (22 أكتوبر) انضموا إلى بثنا المباشر الأسبوعي حول *أمن البرمجيات مفتوحة المصدر*! شاهدوا فرق علاقات المطورين والهندسة في Anchore وهم يتعاونون مباشرةً على أدوات *أمن سلسلة توريد البرمجيات* الأساسية. تركز هذه الجلسة على تحسين *Syft* (لإنشاء *SBOM*) و*Grype* (لفحص الثغرات الأمنية)، ومعالجة المشكلات التي يطرحها المجتمع وطلبات السحب. في كل خميس، تقدم لكم "صيانة البرمجيات مفتوحة المصدر" نظرةً شاملةً على صيانة مشاريع *أمن البرمجيات مفتوحة المصدر* الشائعة. سنتعمق في المواضيع التي تحمل علامة "بحاجة إلى نقاش"، وإذا سمح الوقت، سنتناول مساهمات أخرى مثيرة للاهتمام. تعرّفوا على أفضل ممارسات التطوير، وافهموا تحديات دقة *SBOM*، وشاهدوا كيف تتطور أدوات *فحص الثغرات الأمنية*. سواء كنتم مساهمين أو مستخدمين أو مجرد مهتمين بأمن البرمجيات مفتوحة المصدر، تابعونا لتتعلموا وتتفاعلوا مع العقول التي تقف وراء أدوات Anchore مفتوحة المصدر. *جدول الأعمال:* - مناقشة وحل المشكلات/طلبات السحب التي تحمل علامة "بحاجة إلى نقاش". - مناقشة وحل المشكلات/طلبات السحب التي تحمل علامة "بحاجة إلى نقاش". - - المساهمة في مشاريع مجتمعية أخرى ذات أولوية عالية أو مثيرة للاهتمام لمشاريع Syft وGrype والمشاريع ذات الصلة. *الموارد والمزيد من المعلومات:* - تعرّف على مكونات SBOM: [رابط لصفحة/دليل Anchore الخاص بمكونات SBOM إن وُجد] - تعمّق في أمن سلسلة توريد البرمجيات: [رابط لصفحة/مدونة Anchore ذات الصلة إن وُجدت] - Syft على GitHub: anchore/syft - Grype على GitHub: anchore/grype - انضم إلى نقاش المجتمع: anchore.com - جميع مشاريع Anchore مفتوحة المصدر: github.com/anchore - اشترك في النشرة الإخبارية للمشاريع مفتوحة المصدر: get.anchore.com #أمن_البرمجيات_مفتوحة_المصدر #SBOM #أمن_سلسلة_توريد_البرمجيات [bn] লাইভ SBOM ও সিকিউরিটি ফিক্স: Anchore ডেভেলপাররা Syft ও Grype-এর উন্নতি ঘটিয়েছেন (২২শে অক্টোবর) আমাদের সাপ্তাহিক *ওপেন সোর্স সিকিউরিটি* লাইভ স্ট্রিমে যোগ দিন! Anchore-এর ডেভেলপার রিলেশনস এবং ইঞ্জিনিয়ারিং টিমকে গুরুত্বপূর্ণ *সফটওয়্যার সাপ্লাই চেইন সিকিউরিটি* টুলস নিয়ে রিয়েল-টাইমে একসাথে কাজ করতে দেখুন। এই সেশনটি *Syft* (*SBOM* তৈরির জন্য) এবং *Grype* (*ভালনারেবিলিটি স্ক্যানিং*-এর জন্য)-এর উন্নতি সাধন, এবং কমিউনিটি-উত্থিত ইস্যু ও পুল রিকোয়েস্টগুলো সমাধান করার উপর আলোকপাত করবে। প্রতি বৃহস্পতিবার, "ওপেন সোর্স গার্ডেনিং" জনপ্রিয় *ওপেন সোর্স সিকিউরিটি* প্রজেক্টগুলো রক্ষণাবেক্ষণের একটি স্বচ্ছ চিত্র তুলে ধরে। আমরা 'আলোচনা প্রয়োজন' হিসেবে চিহ্নিত বিষয়গুলো নিয়ে গভীরভাবে আলোচনা করব এবং সময় পেলে অন্যান্য আকর্ষণীয় কন্ট্রিবিউশনগুলোও সমাধান করব। ডেভেলপমেন্টের সেরা অনুশীলনগুলো শিখুন, *SBOM*-এর নির্ভুলতার চ্যালেঞ্জগুলো বুঝুন, এবং দেখুন কীভাবে *ভালনারেবিলিটি স্ক্যানিং* টুলগুলো বিকশিত হচ্ছে। আপনি একজন কন্ট্রিবিউটর, ব্যবহারকারী, বা *ওপেন সোর্স সিকিউরিটি* সম্পর্কে শুধু কৌতূহলীই হোন না কেন, Anchore-এর OSS টুলগুলোর পেছনের কারিগরদের সাথে শিখতে ও যুক্ত হতে আমাদের সাথে যোগ দিন। *এজেন্ডা:* - 'আলোচনা প্রয়োজন' হিসেবে ট্যাগ করা ইস্যু/PR নিয়ে আলোচনা এবং সমাধান করা। - Syft, Grype, এবং সম্পর্কিত প্রোজেক্টগুলোর জন্য অন্যান্য উচ্চ-অগ্রাধিকার সম্পন্ন বা আকর্ষণীয় কমিউনিটি কন্ট্রিবিউশনে অংশ নিন। *রিসোর্স ও আরও জানুন:* - SBOM সম্পর্কে জানুন: [উপলব্ধ থাকলে Anchore-এর SBOM পিলার পেজ/গাইডের লিঙ্ক] - সফটওয়্যার সাপ্লাই চেইন সিকিউরিটি সম্পর্কে বিস্তারিত জানুন: [উপলব্ধ থাকলে প্রাসঙ্গিক Anchore পিলার পেজ/ব্লগের লিঙ্ক] - GitHub-এ Syft: anchore/syft - GitHub-এ Grype: anchore/grype - কমিউনিটি আলোচনায় যোগ দিন: anchore.com - Anchore-এর সকল ওপেন সোর্স প্রোজেক্ট: github.com/anchore - OSS নিউজলেটারের জন্য সাইন-আপ করুন: get.anchore.com #OpenSourceSecurity #SBOM #SoftwareSupplyChainSecurity [iw] שידור חי של SBOM ותיקוני אבטחה: מפתחי Anchore משפרים את Syft ו-Grype (22 באוקטובר) הצטרפו לשידור החי השבועי שלנו של *אבטחת קוד פתוח*! צפו בצוותי יחסי המפתחים וההנדסה של Anchore משתפים פעולה בזמן אמת בכלים חיוניים של *אבטחת שרשרת אספקה של תוכנה*. מפגש זה מתמקד בשיפור *Syft* (לייצור *SBOM*) ו-*Grype* (לסריקת פגיעויות*), תוך התייחסות לבעיות שהועלו על ידי הקהילה ובקשות משיכה. בכל יום חמישי, "גינון קוד פתוח" מציע מבט שקוף על תחזוקת פרויקטים פופולריים של *אבטחת קוד פתוח*. נצלול לפריטים המסומנים 'צריך דיון', ובמידת הזמן, נטפל בתרומות מעניינות אחרות. למדו שיטות עבודה מומלצות לפיתוח, הבינו את האתגרים של דיוק *SBOM*, ונראו כיצד כלי *סריקת פגיעויות* מתפתחים. בין אם אתם תורמים, משתמשים או סתם סקרנים לגבי *אבטחת קוד פתוח*, הצטרפו כדי ללמוד וליצור קשר עם המוחות שמאחורי כלי ה-OSS של Anchore. *סדר יום:* - דנו ופתרו בעיות/יחסי ציבור המסומנים 'צריך דיון'. *סדר יום:* - התמודד עם תרומות קהילתיות אחרות בעלות עדיפות גבוהה או מעניינות עבור Syft, Grype ופרויקטים קשורים. *משאבים ומידע נוסף:* - למד על SBOMs: [קישור לדף/מדריך עמודי התווך של SBOM של Anchore אם זמין] - התעמק באבטחת שרשרת אספקה של תוכנה: [קישור לדף/בלוג רלוונטי של Anchore אם זמין] - Syft ב-GitHub: anchore/syft - Grype ב-GitHub: anchore/grype - הצטרף לדיון הקהילתי: anchore.com - כל פרויקטי הקוד הפתוח של Anchore: github.com/anchore - הירשם לניוזלטר של OSS: get.anchore.com #אבטחתקודפתוח #SBOM #אבטחתשרשרתאספקהשלתוכנה [ko] 실시간 SBOM 및 보안 패치: Anchore 개발자들의 Syft와 Grype 개선 (10월 22일) 매주 목요일 진행되는 *오픈 소스 보안* 라이브 스트림에 참여하세요! Anchore의 개발자 관계 및 엔지니어링 팀이 중요한 *소프트웨어 공급망 보안* 도구를 위해 실시간으로 협업하는 모습을 지켜보세요. 이번 세션에서는 *SBOM* 생성 도구인 *Syft*와 *취약점 스캔 도구*인 *Grype* 개선에 초점을 맞추고, 커뮤니티에서 제기된 문제와 풀 리퀘스트를 해결합니다. 매주 목요일, "오픈 소스 가드닝"에서는 인기 있는 *오픈 소스 보안* 프로젝트를 유지 관리하는 과정을 투명하게 공개합니다. '토론 필요'로 표시된 항목을 심층적으로 다루고, 시간이 허락한다면 다른 흥미로운 기여 사항들도 해결합니다. 개발 모범 사례를 배우고, *SBOM* 정확도의 어려움을 이해하고, *취약점 스캔* 도구의 발전 과정을 살펴보세요. 기여자, 사용자, 또는 *오픈 소스 보안*에 관심 있는 분이라면 누구나 참여하여 Anchore의 오픈 소스 도구를 만든 사람들과 소통하고 배울 수 있는 기회를 놓치지 마세요. *아젠다:* - '토론 필요' 태그가 있는 문제/풀 리퀘스트 논의 및 해결 *토론 필요' 태그가 있는 문제/풀 리퀘스트 논의 및 해결* - Syft, Grype 및 관련 프로젝트에 대한 우선순위가 높거나 흥미로운 커뮤니티 기여 활동을 진행합니다. *자료 및 자세히 알아보기:* - SBOM에 대해 알아보기: [Anchore의 SBOM 핵심 페이지/가이드 링크(있는 경우)] - 소프트웨어 공급망 보안 심층 분석: [관련 Anchore 핵심 페이지/블로그 링크(있는 경우)] - Syft GitHub: anchore/syft - Grype GitHub: anchore/grype - 커뮤니티 토론 참여: anchore.com - 모든 Anchore 오픈 소스 프로젝트: github.com/anchore - OSS 뉴스레터 신청: get.anchore.com #오픈소스보안 #SBOM #소프트웨어공급망보안 [ml] തത്സമയ SBOM & സുരക്ഷാ പരിഹാരങ്ങൾ: Syft & Grype മെച്ചപ്പെടുത്തി Anchore ഡെവലപ്പർമാർ (ഒക്ടോബർ 22) ഞങ്ങളുടെ പ്രതിവാര *ഓപ്പൺ സോഴ്സ് സെക്യൂരിറ്റി* ലൈവ് സ്ട്രീമിൽ ചേരൂ! നിർണായകമായ *സോഫ്റ്റ്വെയർ സപ്ലൈ ചെയിൻ സെക്യൂരിറ്റി* ടൂളുകളിൽ ആങ്കറിന്റെ ഡെവലപ്പർ റിലേഷൻസ് ആൻഡ് എഞ്ചിനീയറിംഗ് ടീമുകൾ തത്സമയം സഹകരിക്കുന്നത് കാണുക. ഈ സെഷൻ *Syft* (*SBOM* ജനറേഷനായി) *Grype* (*vulnerability scanning*-നായി) മെച്ചപ്പെടുത്തുന്നതിലും, കമ്മ്യൂണിറ്റി ഉന്നയിക്കുന്ന പ്രശ്നങ്ങൾ പരിഹരിക്കുന്നതിലും, പുൾ അഭ്യർത്ഥനകൾ പരിഹരിക്കുന്നതിലും ശ്രദ്ധ കേന്ദ്രീകരിക്കുന്നു. എല്ലാ വ്യാഴാഴ്ചയും, "ഓപ്പൺ സോഴ്സ് ഗാർഡനിംഗ്" ജനപ്രിയ *ഓപ്പൺ സോഴ്സ് സുരക്ഷാ* പ്രോജക്റ്റുകൾ പരിപാലിക്കുന്നതിനെക്കുറിച്ചുള്ള സുതാര്യമായ ഒരു വീക്ഷണം വാഗ്ദാനം ചെയ്യുന്നു. 'ചർച്ച ആവശ്യമാണ്' എന്ന് അടയാളപ്പെടുത്തിയ ഇനങ്ങളിൽ ഞങ്ങൾ മുഴുകുകയും സമയം അനുവദിക്കുന്നതുപോലെ മറ്റ് രസകരമായ സംഭാവനകൾ കൈകാര്യം ചെയ്യുകയും ചെയ്യും. വികസനത്തിലെ മികച്ച രീതികൾ പഠിക്കുക, *SBOM* കൃത്യതയുടെ വെല്ലുവിളികൾ മനസ്സിലാക്കുക, *vulnerability scanning* ടൂളുകൾ എങ്ങനെ വികസിക്കുന്നുവെന്ന് കാണുക. നിങ്ങൾ ഒരു സംഭാവകനോ ഉപയോക്താവോ ആകട്ടെ, അല്ലെങ്കിൽ *ഓപ്പൺ സോഴ്സ് സുരക്ഷ*യെക്കുറിച്ച് ജിജ്ഞാസയുള്ളവനോ ആകട്ടെ, ആങ്കറിന്റെ OSS ടൂളുകളുടെ പിന്നിലെ മനസ്സുകളെ പഠിക്കാനും അവരുമായി ഇടപഴകാനും ട്യൂൺ ചെയ്യുക. *അജണ്ട:* - 'ചർച്ച ആവശ്യമാണ്' എന്ന് ടാഗ് ചെയ്തിരിക്കുന്ന പ്രശ്നങ്ങൾ/PR-കൾ ചർച്ച ചെയ്ത് പരിഹരിക്കുക. - Syft, Grype, അനുബന്ധ പ്രോജക്റ്റുകൾ എന്നിവയ്ക്കായി ഉയർന്ന മുൻഗണനയുള്ളതോ താൽപ്പര്യമുണർത്തുന്നതോ ആയ മറ്റ് കമ്മ്യൂണിറ്റി സംഭാവനകൾ കൈകാര്യം ചെയ്യുക. *വിഭവങ്ങളും കൂടുതലറിയുക:* - SBOM-കളെക്കുറിച്ച് അറിയുക: [ലഭ്യമെങ്കിൽ Anchore-ന്റെ SBOM പില്ലർ പേജിലേക്കുള്ള/ഗൈഡിലേക്കുള്ള ലിങ്ക്] - സോഫ്റ്റ്വെയർ സപ്ലൈ ചെയിൻ സുരക്ഷയിലേക്ക് കടക്കുക: [ലഭ്യമെങ്കിൽ പ്രസക്തമായ Anchore പില്ലർ പേജിലേക്കുള്ള/ബ്ലോഗിലേക്കുള്ള ലിങ്ക്] - Syft on GitHub: anchore/syft - GitHub-ലെ Grype: anchore/grype - കമ്മ്യൂണിറ്റി ചർച്ചയിൽ ചേരുക: anchore.com - എല്ലാ Anchore ഓപ്പൺ സോഴ്സ് പ്രോജക്റ്റുകളും: github.com/anchore - OSS വാർത്താക്കുറിപ്പിനായി സൈൻ അപ്പ് ചെയ്യുക: get.anchore.com #OpenSourceSecurity #SBOM #SoftwareSupplyChainSecurity [nl-NL] Live SBOM & beveiligingsoplossingen: Anchore-ontwikkelaars verbeteren Syft & Grype (22 oktober) Neem deel aan onze wekelijkse livestream over *Open Source Security*! Kijk hoe de teams Developer Relations en Engineering van Anchore in realtime samenwerken aan cruciale tools voor *Software Supply Chain Security*. Deze sessie richt zich op het verbeteren van *Syft* (voor het genereren van *SBOM*-bestanden) en *Grype* (voor *kwetsbaarheidsscans*), het aanpakken van door de community aangekaarte problemen en pull requests. Elke donderdag biedt "Open Source Gardening" een transparante blik op het onderhoud van populaire *open source security*-projecten. We duiken in items die gemarkeerd zijn als 'moet besproken worden' en, indien de tijd het toelaat, behandelen we andere interessante bijdragen. Leer over best practices voor ontwikkeling, begrijp de uitdagingen van *SBOM*-nauwkeurigheid en zie hoe tools voor *kwetsbaarheidsscans* evolueren. Of je nu een bijdrager, gebruiker bent of gewoon nieuwsgierig naar *open source security*, kijk mee om te leren en in gesprek te gaan met de mensen achter de OSS-tools van Anchore. *Agenda:* - Bespreken en oplossen van problemen/pull requests met de tag 'moet besproken worden'. - Pak andere prioritaire of interessante communitybijdragen aan voor Syft, Grype en gerelateerde projecten. *Bronnen & Meer informatie:* - Leer meer over SBOM's: [Link naar de pagina/handleiding van Anchore over SBOM's indien beschikbaar] - Duik in Software Supply Chain Security: [Link naar de relevante pagina/blog van Anchore over SBOM's indien beschikbaar] - Syft op GitHub: anchore/syft - Grype op GitHub: anchore/grype - Doe mee aan de communitydiscussie: anchore.com - Alle open source-projecten van Anchore: github.com/anchore - Meld je aan voor de OSS-nieuwsbrief: get.anchore.com #OpenSourceSecurity #SBOM #SoftwareSupplyChainSecurity [pl] Na żywo: SBOM i poprawki bezpieczeństwa: Programiści Anchore ulepszają Syft i Grype (22 październ... Dołącz do naszej cotygodniowej transmisji na żywo z *Open Source Security*! Obejrzyj, jak zespoły ds. relacji z deweloperami i inżynierii w Anchore współpracują w czasie rzeczywistym nad kluczowymi narzędziami *Open Supply Chain Security*. Ta sesja koncentruje się na ulepszaniu *Syft* (do generowania *SBOM*) i *Grype* (do *skanowania luk w zabezpieczeniach*), rozwiązując problemy zgłaszane przez społeczność i pull requesty. W każdy czwartek „Open Source Gardening” oferuje przejrzyste spojrzenie na utrzymanie popularnych projektów *open source security*. Zajmiemy się tematami oznaczonymi jako „wymagające dyskusji” i, jeśli pozwoli na to czas, omówimy inne interesujące kwestie. Poznaj najlepsze praktyki programistyczne, poznaj wyzwania związane z dokładnością *SBOM* i obserwuj, jak ewoluują narzędzia *skanowania luk w zabezpieczeniach*. Niezależnie od tego, czy jesteś współtwórcą, użytkownikiem, czy po prostu ciekawi Cię *bezpieczeństwo open source*, dołącz do nas, aby poznać i porozmawiać z twórcami narzędzi OSS firmy Anchore. *Program:* - Omówienie i rozwiązanie problemów/PR oznaczonych jako „wymagające dyskusji”. - Zajmij się innymi priorytetowymi lub interesującymi projektami społecznościowymi dla Syft, Grype i pokrewnych projektów. *Zasoby i dowiedz się więcej:* - Dowiedz się więcej o SBOM: [Link do strony/przewodnika Anchore dotyczącego filaru SBOM, jeśli dostępny] - Zanurz się w temacie bezpieczeństwa łańcucha dostaw oprogramowania: [Link do odpowiedniej strony/bloga Anchore dotyczącego filaru, jeśli dostępny] - Syft na GitHubie: anchore/syft - Grype na GitHubie: anchore/grype - Dołącz do dyskusji społeczności: anchore.com - Wszystkie projekty open source Anchore: github.com/anchore - Zapisz się do newslettera OSS: get.anchore.com #OpenSourceSecurity #SBOM #SoftwareSupplyChainSecurity [pt-BR] Live de SBOM e Correções de Segurança: Desenvolvedores da Anchore aprimoram o Syft e o Grype (22 ... Participe da nossa transmissão ao vivo semanal sobre *Segurança de Código Aberto*! Veja as equipes de Relações com Desenvolvedores e Engenharia da Anchore colaborando em tempo real em ferramentas cruciais de *Segurança da Cadeia de Suprimentos de Software*. Esta sessão se concentra em aprimorar o *Syft* (para geração de *SBOM*) e o *Grype* (para *varredura de vulnerabilidades*), abordando problemas e pull requests levantados pela comunidade. Todas as quintas-feiras, o "Open Source Gardening" oferece uma visão transparente sobre a manutenção de projetos populares de *segurança de código aberto*. Vamos nos aprofundar em itens marcados como "precisa de discussão" e, se houver tempo, abordar outras contribuições interessantes. Aprenda as melhores práticas de desenvolvimento, entenda os desafios da precisão do *SBOM* e veja como as ferramentas de *varredura de vulnerabilidades* evoluem. Seja você um colaborador, usuário ou apenas curioso sobre *segurança de código aberto*, participe para aprender e interagir com as mentes por trás das ferramentas de código aberto da Anchore. *Agenda:* - Discutir e resolver problemas/PRs marcados como "precisa de discussão". - Abordar outras contribuições prioritárias ou interessantes da comunidade para o Syft, Grype e projetos relacionados. *Recursos e Saiba Mais:* - Saiba mais sobre SBOMs: [Link para a página/guia do pilar SBOM da Anchore, se disponível] - Explore a Segurança da Cadeia de Suprimentos de Software: [Link para a página/blog relevante do pilar Anchore, se disponível] - Syft no GitHub: anchore/syft - Grype no GitHub: anchore/grype - Participe da discussão da comunidade: anchore.com - Todos os projetos de código aberto da Anchore: github.com/anchore - Inscreva-se na newsletter de código aberto: get.anchore.com #SegurançaDeCódigoAberto #SBOM #SegurançaDaCadeiaDeSuprimentosDeSoftware [uk] Live SBOM та виправлення безпеки: розробники Anchore вдосконалюють Syft та Grype (22 жовтня) Приєднуйтесь до нашої щотижневої прямої трансляції *Безпека відкритого коду*! Дивіться, як команди Anchore зі зв'язків з розробниками та інженерії співпрацюють у режимі реального часу над ключовими інструментами *Безпеки ланцюга постачання програмного забезпечення*. Ця сесія зосереджена на вдосконаленні *Syft* (для створення *SBOM*) та *Grype* (для *сканування вразливостей*), вирішенні проблем, порушених спільнотою, та запитах на враження. Щочетверга «Садівництво з відкритим кодом» пропонує прозорий погляд на підтримку популярних проектів *безпеки відкритого коду*. Ми заглибимося в пункти, позначені як «потребує обговорення», і, якщо дозволить час, розглянемо інші цікаві внески. Вивчіть передові практики розробки, зрозумійте проблеми точності *SBOM* та побачите, як розвиваються інструменти *сканування вразливостей*. Незалежно від того, чи ви учасник, користувач чи просто цікавитеся *безпекою відкритого коду*, приєднуйтесь, щоб навчатися та взаємодіяти з ідеалами, що стоять за інструментами OSS від Anchore. *Порядок денний:* - Обговорення та вирішення проблем/запитів на враження з тегом «потребує обговорення». - Розгляньте інші пріоритетні або цікаві внески спільноти для Syft, Grype та пов'язаних проектів. *Ресурси та докладніша інформація:* - Дізнайтеся про SBOM: [Посилання на сторінку/посібник Anchore з SBOM, якщо є] - Зануртесь у безпеку ланцюжка постачання програмного забезпечення: [Посилання на відповідну сторінку/блог Anchore, якщо є] - Syft на GitHub: anchore/syft - Grype на GitHub: anchore/grype - Приєднуйтесь до обговорення спільноти: anchore.com - Усі проекти з відкритим кодом Anchore: github.com/anchore - Підпишіться на розсилку OSS: get.anchore.com #OpenSourceSecurity #SBOM #SoftwareSupplyChainSecurity
Part 2: From Docker Compose up to Terraform on AWS, and the CI That Checks It Part 1 ended with a pipeline that turns HL7 v2 into FHIR R4 and runs on a laptop with make demo. This part is about the distance between that and something a trust could run, and about the checks that tell you whether you have crossed it. The short version: the distance is larger than the Terraform makes it look, and the first thing I did this week was build the pipeline that proves it. The problem docker compose up gives you a working system and almost no evidence. It tells you the code runs. It tells you nothing about whether the database is reachable from the internet, whether a credential is sitting in the history, or whether the thing you deploy is the thing you tested. In most settings that gap is a nuisance. In an NHS setting, it is the whole job. The data is patient-identifiable, auditors ask questions about provenance, and "it worked on my laptop" doesn't answer any of them. So the move from compose to AWS is not really a move from one runtime to another. It is a move from a system you have seen working to a system you can show is working. That needs two things: infrastructure described as code, and a pipeline that checks it on every change. I had the first. I did not have the second, and this week showed me what that was costing. What I built The repo describes an AWS deployment in Terraform: a VPC with public, private and database subnets, an EKS cluster with a managed node group, an RDS Postgres instance for the HAPI FHIR server, an S3 bucket for the dead-letter path, and KMS keys. terraform plan reports 46 resources. !The local stack on the left and the AWS target on the right, with the CI pipeline between them Two honest notes before anything else. The provider block in infra/terraform/versions.tf is this: provider "aws" { region = var.aws_region access_key = "mock" secret_key = "mock" skip_credentials_validation = true skip_metadata_api_check = true skip_requesting_account_id = true } That is how the plan runs in CI without an AWS account. It hasn't always been like that. In April I ran apply against my own AWS account to see the stack come up, and that is where the EKS add-on version conflicts in docs/lessons-learnt.md came from. Nothing from that run is still up, so the code you can clone today has been planned, not deployed. The mock credentials keep it free for anyone else to run. The second note is worse, and the pipeline found it. The pipeline, and what it found Until this week the repo had a .gitlab-ci.yml describing five stages, and nothing had ever run it. Porting it to GitHub Actions took an afternoon. Getting it green took longer, because it kept being right. Some of what it found turned up while I was porting it, and the rest arrived on its first real run. The secret scan had never scanned anything The pipeline runs Gitleaks. The repo has a .gitleaks.toml. The file held exactly this: # Gitleaks config - ignore false positives in vendored terraform modules One comment. No rules, and no [extend] block. Gitleaks' documentation describes two options for a custom config: "define your own configuration, default rules do not apply", or extend one, where "useDefault will extend the default gitleaks config built into the binary". Mine was the first kind. A configuration with no rules, replacing roughly a hundred built-in ones. I checked it rather than assuming. A directory with a planted Slack bot token, scanned three ways with gitleaks 8.28.0: no config file leaks found: 1 exit 1 the repo's .gitleaks.toml no leaks found exit 0 [extend] useDefault = true leaks found: 1 exit 1 The middle line is the one that matters. For months, a secret scan ran, found nothing, and the nothing meant nothing. The repo also carries docs/verification/gitleaks.json, a stored run showing zero findings, which I had been treating as evidence that the repo was clean. It is evidence that the scanner was switched off. When I first wrote this section, the next line said I had no reason to think there was a secret in there. Then the fixed scanner ran over the git history and found one. On 26 April I committed a PDS API key to .env.example while getting a demo working. The next commit blanked the value. The file looked clean from then on, and the key sat in the public history for six months. A scanner pointed at the current files would never have seen it. gitleaks git reads every commit, and it did. The key is revoked now. It stays in the history because rewriting a public history breaks every clone and tag. Revoking it is what makes it harmless. The repo's .gitleaksignore now holds that one finding's fingerprint, with a comment saying when the key was committed and when it was revoked. Any other secret still fails the build. So the stored report with zero findings wasn't just meaningless. It was wrong, and I had been treating it as evidence. The test job could not have passed The GitLab test job runs: pytest -q --junitxml=junit.xml --cov=. --cov-report=xml pytest-cov appears in none of the three requirements-dev.txt files. I ran that command against each service in a clean virtualenv built from its pinned requirements, and got the same thing three times: error: unrecognised arguments: --cov=. --cov-report=xml The tests themselves passed. Sixteen of them pass as soon as you drop the flags. It was the job around them that had never worked, and because nothing ran it, nothing said so. With pytest-cov added, the numbers are ingest 98 per cent, transform 83 per cent, pds-client 93 per cent. The database could call the internet The new pipeline runs Trivy against the Terraform. Its first finding was critical, in the security group in front of the FHIR database: resource "aws_security_group" "rds" { description = "HAPI FHIR Postgres, ingress from EKS nodes only" ingress { description = "Postgres from EKS" from_port = 5432 to_port = 5432 protocol = "tcp" security_groups = [module.eks.node_security_group_id] } egress { from_port = 0 to_port = 0 protocol = "-1" cidr_blocks = ["0.0.0.0/0"] } } Look at the care in the ingress rule and the shrug in the egress one. Inbound is locked to the node group's security group, port 5432, TCP only. Outbound is every port, every protocol, every address on the internet. The description even says "ingress from EKS nodes only", which is true and beside the point. I wrote a careful inbound rule, felt careful, and pasted the default outbound rule underneath it. The fix restricts egress to the VPC. The cluster API was open to the internet My first count of Trivy findings was wrong. I ran it on a copy of the repo where it never downloaded the community EKS module, so it only scanned my own files. A clean checkout in CI downloads the module and scans what my inputs do to it. That found three more critical findings. Two were the same problem. The EKS API endpoint was public and open to 0.0.0.0/0: # API endpoint is private by default; grant access to the CI runner via # the public endpoint + CIDR allow-list when needed. cluster_endpoint_public_access = true cluster_endpoint_public_access_cidrs = ["0.0.0.0/0"] # tighten in prod The comment says private. The code says public, to everyone. Nothing outside the VPC needs that endpoint, because Argo CD pulls from inside the cluster, so it is now private. The third was node egress to any address, the same rule as the database. This one I kept. The nodes need outbound internet to pull images and to call the PDS API. It sits in a .trivyignore.yaml, scoped to the one module file and with the reason written next to it. I checked the scope by putting the database rule back the way it was: the build failed. A dependency I never chose The image scan failed on all three services for the same reason. fastapi==0.115.0 pulls in starlette 0.38.6, which has CVE-2024-47874, rated high. I had pinned FastAPI and never looked at what it brought with it. Bumping FastAPI alone wasn't enough. The newer Starlette releases had high findings of their own, fixed only in 1.x, and prometheus-fastapi-instrumentator 7.0.0 capped Starlette below 1.0. Both had to move. All sixteen tests still pass, and coverage hasn't changed. What is left on the Terraform is four findings, none above medium: IAM authentication and deletion protection on the database, a customer-managed key for Performance Insights, and access logging on the bucket. Those are real, and they are on the list for Part 5. Every run prints them, along with the accepted one, so they don't live only in my head. !The seven CI jobs, which ones gate the merge, and what the first runs found What the pipeline actually checks Seven jobs run on every pull request into master: 1. lint, ruff over each service. 2. test, pytest with coverage over each service. 3. secrets, Gitleaks over both the working tree and the git history. 4. sast, Semgrep with the p/ci, p/python and p/security-audit rulesets. 5. terraform, fmt -check, then init -backend=false and validate. 6. iac-scan, Trivy against the Terraform. 7. image, a Docker build per service, then a Trivy image scan and a Syft SBOM. A few decisions inside that are worth more than the list. Every version is pinned, down to the scanner binaries. The gitleaks problem was a security tool that silently stopped checking, and a floating latest tag is the same failure wearing a different hat. If a tool changes what it catches, I want that to arrive as a version bump I can read in a diff. terraform validate runs with -backend=false, which initialises the providers without touching remote state, so the job needs no AWS credentials at all. Validation is a question about syntax and types, not about an account. The IaC scan reports everything and fails only on high and critical. A gate you have not triaged is a gate someone turns off in a week. Report first, then promote findings to blocking as you fix them. The image is built and scanned but not pushed. There is nowhere to push it to yet, and inventing a registry to make the diagram look complete would be the same instinct that produced the egress rule. And one job did not come across at all. The GitLab pipeline ended with a deploy stage that bumped a Helm values file and let Argo CD sync it. Its rule was if: $CI_COMMIT_BRANCH == "main". This repo's branch is master. That job could never have run on any commit, which is a tidy summary of the whole week: the pipeline described a system nobody had checked. Best practices worth stealing Commit the Terraform lock file. HashiCorp's documentation says "You should include this file in your version control repository", because Terraform "remembers the decisions it made in a dependency lock file" so that "it can (by default) make the same decisions again in future". Mine was in .gitignore. CI is exactly the second machine that needs to make the same decision. Make the local command and the CI command the same one. The repo's Makefile already had make tf-validate, running init -backend=false, validate and fmt -check. The CI job runs the same three. If it passes on your machine, it passes in CI, and you stop pushing commits to find out. Scan the history, not just the tree. gitleaks dir checks what is there now. gitleaks git checks what was ever there. A secret removed in a later commit is still published. While you are at it: detect is deprecated, and the README says "v8.19.0 introduced a change that deprecated detect and protect". The modes are git, dir and stdin now. Make the tool fail loudly or not at all. Semgrep prints its findings and exits 0 unless you pass --error. Trivy does the same unless you pass --exit-code 1, and it is in two of my jobs. So three of the seven would have been decorative by default: they would have printed the problem in a log nobody opens and gone green. Gitleaks is the exception, and I had it wrong until I tested it. Its help text reads --exit-code int exit code when leaks have been encountered (default 1), which I first skimmed as requiring the flag. It is not: gitleaks exits 1 on a finding whether you ask or not. I had already written the opposite into a draft of this article. Checking the three tools took one command each. Read why a gate went red. My first iac-scan job passed --no-progress to trivy config. That flag works on trivy image and doesn't exist on trivy config, so the job failed before it scanned a single file. Red, for a reason that had nothing to do with Terraform. Fix the name, not the rule. Semgrep flagged requests.append({... "http://snomed.info/sct" ...}) as an unencrypted HTTP request. It was a Python list called requests, holding FHIR MedicationRequests, and the URL is a SNOMED CT system identifier that FHIR requires in that exact form. Renaming the list to medication_requests cleared it without switching anything off. Where AI helps here, and where it doesn't The port was a good use of AI. Translating a GitLab pipeline into Actions is mechanical, well-documented work, and the shape of the answer is known before you start. What it did not do is notice. The gitleaks config, the key in the history, the missing pytest-cov, the egress rule and the open endpoint were all found by running things and reading the output, not by looking at the code and thinking about it. Every one of those files reads as correct. A config file with an allowlist comment looks like a config file. A requirements file without pytest-cov looks like a requirements file. An egress rule set to 0.0.0.0/0 is the most common four characters in any Terraform repo. The same thing happened to me twice in two weeks. In Part 1 it was a retry wrapper raising its own exception type, so the dead-letter path never ran. Here it is a scanner with its rules switched off. Both passed review, mine included, because reading code tells you what it says and running it tells you what it does. Running things has a catch of its own. The first Trivy count in this article came from an AI-assisted run on a copy of the repo that never downloaded the EKS module. It ran, it printed numbers, and the numbers were wrong. CI's clean checkout was the run that counted. So the rule from Part 1 survives contact with Part 2: AI drafts, and the specification, the tests and the running system decide. I would add a line to it now. The output of a check is only evidence if you have seen the check fail, in the same place it will run for real. What I'd do differently I would have built the pipeline first, before the Terraform, before the Helm charts, probably before the third service. Not because CI is more important than the code, but because for eight weeks I had five stages of YAML that described a quality bar and enforced none of it. That is worse than having no pipeline, because it reads like one. I would also have protected master before the first workflow landed. The pull request that added the pipeline merged with its own checks red, because nothing required them to pass. A required status check is one setting. The other thing is smaller and more annoying. docs/lessons-learnt.md and docs/security.md both say every AWS resource carries a DataClass=patient-identifiable tag through Terraform's provider-level default_tags, and describe the audit query that tag makes possible. The default_tags block in versions.tf is commented out. The documentation is describing a feature of the system I meant to build. Fixing that properly belongs with Part 5, on security and compliance, and it is going to be the theme of that article. Sources - HashiCorp: Dependency lock file - HashiCorp: terraform validate - HashiCorp: terraform fmt - Gitleaks - Trivy: misconfiguration scanning - Trivy AVD-AWS-0104: unrestricted egress - Trivy AVD-AWS-0040: public EKS endpoint - Trivy: filtering and .trivyignore.yaml - GitHub advisory for CVE-2024-47874 in Starlette - GitHub: about protected branches - Semgrep CLI reference - Anchore Syft - GitHub Actions: workflow syntax - The code for this article, tag part-2 Next Part 3, on 28 October, is about the mapping itself: HL7 v2 ADT messages to FHIR R4, and the places it goes quietly wrong, several of them found by readers of Part 1. What does your pipeline check that you have never watched fail? --- This is a personal project. It is not affiliated with or endorsed by NHS England or any NHS organisation. It uses the public PDS FHIR sandbox and, earlier in the project, the PDS integration test environment, with synthetic test data only. Views are my own.
Live SBOM & Security Fixes: Anchore Devs Improve Syft & Grype (October 15th) Join our weekly *Open Source Security* live stream! Watch Anchore's Developer Relations and Engineering teams collaborate in real-time on crucial *Software Supply Chain Security* tools. This session focuses on improving *Syft* (for *SBOM* generation) and *Grype* (for *vulnerability scanning*), addressing community-raised issues and pull requests. Every Thursday, "Open Source Gardening" offers a transparent look into maintaining popular *open source security* projects. We'll dive into items marked 'needs discussion' and, time permitting, tackle other interesting contributions. Learn development best practices, understand the challenges of *SBOM* accuracy, and see how *vulnerability scanning* tools evolve. Whether you're a contributor, user, or just curious about *open source security*, tune in to learn and engage with the minds behind Anchore's OSS tools. *Agenda:* - Discuss and resolve issues/PRs tagged 'needs discussion'. - Tackle other high-priority or interesting community contributions for Syft, Grype, and related projects. *Resources & Learn More:* - Learn about SBOMs: [Link to Anchore's SBOM pillar page/guide if available] - Dive into Software Supply Chain Security: [Link to relevant Anchore pillar page/blog if available] - Syft on GitHub: anchore/syft - Grype on GitHub: anchore/grype - Join the Community Discussion: anchore.com - All Anchore Open Source Projects: github.com/anchore - Sign-up for the OSS Newsletter: get.anchore.com #OpenSourceSecurity #SBOM #SoftwareSupplyChainSecurity [ko] 실시간 SBOM 및 보안 수정: Anchore 개발자들이 개선한 Syft 및 Grype (10월 15일) 매주 목요일 진행되는 *오픈 소스 보안* 라이브 스트림에 참여하세요! Anchore의 개발자 관계 및 엔지니어링 팀이 중요한 *소프트웨어 공급망 보안* 도구를 위해 실시간으로 협업하는 모습을 지켜보세요. 이번 세션에서는 *SBOM* 생성 도구인 *Syft*와 *취약점 스캔 도구*인 *Grype* 개선에 초점을 맞추고, 커뮤니티에서 제기된 문제와 풀 리퀘스트를 해결합니다. 매주 목요일, "오픈 소스 가드닝"에서는 인기 있는 *오픈 소스 보안* 프로젝트를 유지 관리하는 과정을 투명하게 공개합니다. '토론 필요'로 표시된 항목을 심층적으로 다루고, 시간이 허락한다면 다른 흥미로운 기여 사항들도 해결합니다. 개발 모범 사례를 배우고, *SBOM* 정확도의 어려움을 이해하고, *취약점 스캔* 도구의 발전 과정을 살펴보세요. 기여자, 사용자, 또는 *오픈 소스 보안*에 관심 있는 분이라면 누구나 참여하여 Anchore의 오픈 소스 도구를 만든 사람들과 소통하고 배울 수 있는 기회를 놓치지 마세요. *아젠다:* - '토론 필요' 태그가 있는 문제/풀 리퀘스트 논의 및 해결 *토론 필요' 태그가 있는 문제/풀 리퀘스트 논의 및 해결* - Syft, Grype 및 관련 프로젝트에 대한 우선순위가 높거나 흥미로운 커뮤니티 기여 활동을 진행합니다. *자료 및 자세히 알아보기:* - SBOM에 대해 알아보기: [Anchore의 SBOM 핵심 페이지/가이드 링크(있는 경우)] - 소프트웨어 공급망 보안 심층 분석: [관련 Anchore 핵심 페이지/블로그 링크(있는 경우)] - Syft GitHub: anchore/syft - Grype GitHub: anchore/grype - 커뮤니티 토론 참여: anchore.com - 모든 Anchore 오픈 소스 프로젝트: github.com/anchore - OSS 뉴스레터 신청: get.anchore.com #오픈소스보안 #SBOM #소프트웨어공급망보안 [nl-NL] Live SBOM & beveiligingsoplossingen: Anchore-ontwikkelaars verbeteren Syft & Grype (15 oktober) Neem deel aan onze wekelijkse livestream over *Open Source Security*! Kijk hoe de teams Developer Relations en Engineering van Anchore in realtime samenwerken aan cruciale tools voor *Software Supply Chain Security*. Deze sessie richt zich op het verbeteren van *Syft* (voor het genereren van *SBOM*-bestanden) en *Grype* (voor *kwetsbaarheidsscans*), het aanpakken van door de community aangekaarte problemen en pull requests. Elke donderdag biedt "Open Source Gardening" een transparante blik op het onderhoud van populaire *open source security*-projecten. We duiken in items die gemarkeerd zijn als 'moet besproken worden' en, indien de tijd het toelaat, behandelen we andere interessante bijdragen. Leer over best practices voor ontwikkeling, begrijp de uitdagingen van *SBOM*-nauwkeurigheid en zie hoe tools voor *kwetsbaarheidsscans* evolueren. Of je nu een bijdrager, gebruiker bent of gewoon nieuwsgierig naar *open source security*, kijk mee om te leren en in gesprek te gaan met de mensen achter de OSS-tools van Anchore. *Agenda:* - Bespreken en oplossen van problemen/pull requests met de tag 'moet besproken worden'. - Pak andere prioritaire of interessante communitybijdragen aan voor Syft, Grype en gerelateerde projecten. *Bronnen & Meer informatie:* - Leer meer over SBOM's: [Link naar de pagina/handleiding van Anchore over SBOM's indien beschikbaar] - Duik in Software Supply Chain Security: [Link naar de relevante pagina/blog van Anchore over SBOM's indien beschikbaar] - Syft op GitHub: anchore/syft - Grype op GitHub: anchore/grype - Doe mee aan de communitydiscussie: anchore.com - Alle open source-projecten van Anchore: github.com/anchore - Meld je aan voor de OSS-nieuwsbrief: get.anchore.com #OpenSourceSecurity #SBOM #SoftwareSupplyChainSecurity
Coding Agents Pass Up to 91% of Tasks in a New Benchmark. At Most 25% Are Also Secure - Book: Ship It — the pragmatic startup tech stack - Also by me: Thinking in Go (2-book series) — Complete Guide to Go Programming + Hexagonal Architecture in Go - My project: Hermes IDE | GitHub — an IDE for developers who ship with Claude Code and other AI coding tools - Me: xgabriel.com | GitHub --- A coding agent rewrote the missing file at the heart of a Java configuration importer. All 14 hidden functional tests passed. All four security tests failed, because the default SnakeYAML constructor it used "honors every !!class tag" in the uploaded YAML (the paper, Section 5.4 and Appendix F.2). The agent was Kimi-K3. Claude Fable 5 and GPT-5.6-Sol parsed the same input with SnakeYAML's SafeConstructor and passed both suites. Qwen3.8-Max and GLM-5.3 made Kimi-K3's mistake. That case comes from the Last Secure Code Benchmark (LSCBench), submitted to arXiv on October 10, 2026 by researchers from the National University of Singapore and Alibaba Group, including the Qwen team (author list). The headline: six frontier agents pass 73.6% to 91.3% of tasks functionally, and the best of them writes code that is both working and secure on 25.1% (project page). What LSCBench actually tests The benchmark has 450 tasks built from 150 real vulnerabilities, across seven languages and 24 CWE categories (arXiv). Of those 150 scenarios, 115 come from public CVEs and 35 are Java applications written by security experts (project page). The trick is in the prompt. In the authors' words, "Every task asks only for functionality, through a specification that never mentions security" (arXiv). That is how most people prompt a coding agent. You ask for the import feature, not for a deserialization-safe import feature. Each task runs at one of three sizes: fill in a masked function, write a removed file, or rebuild an emptied source tree from a spec. A task scores only if two hidden suites both pass, functional tests and security tests that replay the original attack. No partial credit, no judge model (project page). The leaderboard All six models ran at their highest reasoning effort. Five ran inside Claude Code v2.1.143 and GPT-5.6-Sol ran inside Codex v0.154.0 (README). Numbers from the project page: | Model | Harness | Works | Works and secure | |---|---|---|---| | Claude Fable 5 | Claude Code | 91.1% | 25.1% | | GPT-5.6-Sol | Codex | 89.1% | 24.7% | | Qwen3.8-Max | Claude Code | 89.3% | 22.0% | | GLM-5.3 | Claude Code | 87.1% | 21.3% | | DeepSeek-V4-Pro | Claude Code | 73.6% | 18.0% | | Kimi-K3 | Claude Code | 91.3% | 16.4% | Look at the last row. Kimi-K3 has the highest functional pass rate and the lowest secure one. A green test suite told you nothing about which agent was safer. Across all 2,700 runs, 66% ended with code that works and is still vulnerable (project page). Of the 150 scenarios, 57 were never secured by any model. !Editorial illustration of a house whose front door is triple-locked and glowing orange while a back window stands wide open Working code, open window: the shape of most LSCBench runs. Where the code breaks The project page breaks down how often runs ended both working and secure, all six models combined. By language: C and Python 30%, JavaScript 27%, C++ 19%, Java 18%, Go 14%, PHP 10% (project page). The weakness-family chart uses a different base, the share of working code that was also secure, and the spread there is wider. Memory safety comes out best at 44%. Injection sits at 28%. Server-side request forgery is at 3% and information exposure at 1% (project page). The paper's case studies show what that looks like (Appendix F): - Command injection, Java: four of the six models passed mount arguments to ProcessBuilder as a list. Qwen3.8-Max and Kimi-K3 built a string for sh -c. - SSRF, Go: in a LocalAI task, GPT-5.6-Sol's GetURI read any path it was handed, file:// URLs included. The reference fix confines reads to the models directory. No model did that. - Information exposure, Go: in a syft task, GLM-5.3 followed the tag convention of neighbouring structs, so an attestation password showed up in config dumps and SBOM output. All six models made the same choice. None of these are exotic. A reviewer who goes looking for them can catch all three. !Editorial illustration of a magnifying glass over a stack of code sheets, with one sheet showing an orange crack running through it SSRF and information exposure: 3% and 1% of working code was also secure. One sentence helped. It didn't fix it The authors reran four of the six models with one sentence appended to every task, asking for an implementation that meets the functional requirements "while also being secure" (Section 5.5). Works-and-secure scores went up: - GPT-5.6-Sol: 24.7% to 46.2% - GLM-5.3: 21.3% to 38.2% - Qwen3.8-Max: 22.0% to 37.6% - DeepSeek-V4-Pro: 18.0% to 19.1% Functional pass rates moved by a few points either way. The paper's verdict: "most tasks stay insecure even with the reminder", and SSRF and information exposure stay near the bottom (Section 5.5). Claude Fable 5 and Kimi-K3 weren't in that rerun. What to do with this on Monday Add the reminder anyway. The paper appended it to the task. A line in your AGENTS.md or CLAUDE.md is the nearest everyday equivalent, though the paper didn't test that placement. For three of the four models it added about 16 to 22 points. Then write the test the benchmark writes: replay the attack. If an agent builds a loader that takes a model name, check that it refuses a URL and a path that climbs out of the directory. from pathlib import Path import pytest MODELS = Path("models").resolve() def resolve_model(uri: str) -> Path: if "://" in uri: raise ValueError("plain model names only") p = (MODELS / uri).resolve() if not p.is_relative_to(MODELS): raise ValueError("outside the models dir") return p @pytest.mark.parametrize("uri", [ "ftp://example.com/model.bin", "../secrets.txt", ]) def test_rejects_escape(uri): with pytest.raises(ValueError): resolve_model(uri) Review agent work for security on purpose, in small pieces. I build Hermes IDE, so weigh this with that in mind. Its Review Desk (⌘G, Ctrl+Shift+G on Windows and Linux) shows an agent's changes by turn or by file and sends a line comment back to the agent that wrote it (README). It won't spot an SSRF on its own, but it splits a 40-file change into turns you can actually read. !The Hermes IDE Review Desk in By turn view for a Claude Code task, with two turns listed, a diff of one file and a drafted commit message The Review Desk (⌘G) in By turn view for a Claude Code task in orders-api: two turns, turn 1's diff of src/db.ts, the changed-files list, and a commit message drafted from the turns. You can also run the benchmark against your own agent setup. It ships as a Harbor dataset (LSCBench itself is Apache 2.0), and needs Harbor 0.24+, Docker, Python 3.12+ and about 58 GB of task images. The projects contain exploitable vulnerabilities, so the README says to run it in an isolated environment (README). The sanity check first, where reference solutions should score 1: pip install harbor harbor run \ -d last-secure-code-benchmark/last-secure-code-benchmark@v1.0 \ -a oracle I haven't run it myself. Read the fine print before you quote it The leaderboard tests the model versions available when the paper was written; newer releases may score differently. Every number is pass@1, one attempt per task. Qwen3.8-Max, one of the six models scored, was also the construction agent that wrote the tests and specifications; the authors argue its mid-field result shows no advantage (arXiv). The paper is an arXiv preprint, so treat it as one until someone replicates it. --- If this was useful Vibe-coding a side project is the easy half. Ship It covers the rest of the road from localhost to production for a small team: hosting, payments, auth, CI/CD and monitoring, the places where "it works" and "it's safe to put online" stop being the same thing. If you run several coding agents on that work, Hermes IDE is free, source-available and on GitHub. 