KubeCon Amsterdam is happening now, Ingress NGINX has reached end of life, and a new fund launched to keep open source maintainers funded. Here is this week’s open source roundup.
Open Source News This Week
Ingress NGINX is officially retired
The Kubernetes SIG Network team halted all maintenance this month, meaning no further releases, bug fixes, or security patches for one of the most widely deployed ingress controllers in the ecosystem. If you are still running it in production, migration is now urgent. Ingress2Gateway 1.0 shipped this week as a stable migration tool supporting over 30 common Ingress NGINX annotations to help teams move to Gateway API.
KubeCon + CloudNativeCon Europe 2026 is happening in Amsterdam this week
March 23-26. The CNCF’s flagship conference is bringing together cloud native maintainers, end users, and contributors for sessions covering observability, platform engineering, AI integration, and more. Two announcements worth noting from the conference so far: Kyverno, the Kubernetes-native policy engine, graduated to CNCF’s highest maturity level, and Dapr Agents v1.0 reached general availability, bringing production-grade state management and failure recovery to AI agent frameworks. Recordings will be available after the event.
Java 26 shipped on March 17
The first non-LTS release since Java 25, it delivers 10 JEPs including G1 GC performance improvements, HTTP/3 support for the HTTP Client API, a new PEM encryption API, and removal of the Applet API. Not a required upgrade for most teams running on Java 25, but worth reviewing if you are tracking the roadmap.
cURL ended its bug bounty program
After its security team was overwhelmed by AI-generated vulnerability reports, the confirmed vulnerability rate dropped from above 15% to below 5%. Maintainer Daniel Stenberg described the toll on the team as unsustainable. A concrete example of how AI slop is affecting open source projects beyond just code quality.
The Open Source Endowment launched in late February
Backed by over 60 founding donors including the founders of HashiCorp, Supabase, cURL, Vue.js, and NGINX, the nonprofit invests donations and distributes only the investment income as grants, targeting critical and independent open source projects. The first grant round is planned for Q2 2026. Worth sharing with every open source maintainer you know.
The open source maintainer gap is growing
GitHub’s 2026 outlook highlights that while more developers are joining projects, the number taking on maintainer roles has stayed flat, creating a bottleneck that threatens project health even as contributor counts climb.
Open Source Tools Worth Checking Out
obra/superpowers
Built by Jesse Vincent (creator of Request Tracker), endorsed by Simon Willison as “one of the most creative users of coding agents” he knows. Enforces a mandatory workflow on AI coding agents: spec, plan, TDD, review. Over 90,000 GitHub stars and the most installed plugin in the Claude Code marketplace. Better Stack: Superpowers framework walkthrough.
bytedance/deer-flow
ByteDance’s open source SuperAgent harness. Gives an agent its own persistent Docker container, decomposes tasks across parallel sub-agents, and maintains memory across sessions. Hit number one on GitHub Trending on February 28, 2026. Security analyst Edward Kiledjian recommends running it containerized with restricted privileges in enterprise settings. Edward Kiledjian: DeerFlow security and deployment assessment is worth reading before production use.
llm
Built by Simon Willison (Django co-creator, PSF board member). A CLI tool for running prompts against any large language model via a plugin system covering OpenAI, Anthropic, Gemini, Ollama, and more. The Unix philosophy applied to LLMs: pipe data in, pipe results out. Over 11,000 GitHub stars. Simon Willison: LLMs on the command line (Mastering LLMs) shows it best.
Ghostty
Built by Mitchell Hashimoto (HashiCorp co-founder, Terraform and Vagrant creator). GPU-accelerated, native UI terminal written in Zig. No Electron. In early 2026 moved under non-profit sponsorship via Hack Club, rejecting VC funding. Mitchell Hashimoto: Ghostty design and architecture explains the decisions. Also worth knowing: cmux is a native macOS app built on Ghostty’s rendering engine that adds vertical tabs, agent notification rings, and a built-in browser. Hashimoto called it “exactly the product I’ve been looking for” and your existing Ghostty config carries over.
Devbox
From Jetify. Declare packages in a devbox.json, commit it, and the whole team gets the same isolated Nix-powered environment. No Docker, no Nix language required. Over 400,000 package versions available. Devbox quickstart guide is fast, and the Devbox Hacker News launch thread shows how developers received it.
Tetragon
A CNCF project from the Cilium team, championed by Liz Rice (former CNCF Technical Oversight Committee chair). eBPF-based runtime security for Kubernetes that filters and enforces policy directly in the kernel rather than passing events to user space first, closing the window traditional tools leave open. Timely with cloud native security front and center at KubeCon Amsterdam this week. Tetragon getting started documentation or iximiuz Labs: Introduction to Tetragon hands-on tutorial to get started.
From the Community
My Thoughts on Vibe Coding Have Evolved
Adriana Villela posted a thoughtful piece on how her views on vibe coding have shifted. She built an OTel news summarizer app with no prior frontend experience and writes about what worked, what surprised her, and the broader question of responsibility when AI generates your code.
Challenge Update
We are taking a short break from challenges this month while we work on making them even better, with more technologies, better automation, and more challenge builders involved. In the meantime, our existing challenges are a solid way to learn by doing.
Question of the Week: Share Your Best Open Source Find
What open source tool or project would you recommend to everyone in this community? Tell us how you discovered it, what it replaced or enabled in your workflow, and what makes it worth using. Whether it is a battle-tested tool, an underrated gem, or something you recently stumbled across, we would love to hear about it.