Simon Willison has launched datasette-apps, a new Datasette plugin that embeds sandboxed HTML+JavaScript applications directly inside a Datasette instance, giving each app live read-only SQL access to the underlying SQLite data. Apps run inside tightly restricted iframes using a combination of the sandbox attribute and injected Content Security Policy headers, preventing untrusted code from accessing cookies, localStorage, or external hosts. The concept originated from Willison's effort to replicate a Claude Artifacts-style experience inside Datasette Agent, before being promoted to a standalone top-level plugin.
datasette-acl 0.6a0 is an alpha release that broadens the plugin's scope from table-level access control to a general resource-sharing system for Datasette. Alex Garcia led most of the development, enabling multi-user Datasette instances to apply fine-grained permissions across a wider range of platform resources. As an alpha, it signals architectural direction rather than a stable feature set, but matters for teams building access-controlled, collaborative Datasette deployments.
GitHub has launched pull request limits, a repository-level control that lets open-source maintainers cap the volume of incoming pull requests. The feature targets a growing pain point as automated tools and AI coding assistants drive up PR counts in popular repositories. GitHub also outlines what is coming next on the roadmap for this feature.
A security researcher published findings identifying approximately 10,000 GitHub repositories that distribute Trojan malware. The scale of the campaign suggests an organized, systematic effort to abuse GitHub's trusted platform for malware distribution. Developers and open-source consumers who clone or run code from unvetted repositories are at direct risk.
Mistral AI has introduced Leanstral, an open-source research project aimed at bringing formal trustworthiness to vibe-coding — the increasingly popular practice of generating software through natural-language AI prompts with minimal manual oversight. The initiative frames itself as a foundational layer, suggesting it is designed to underpin other tools or workflows rather than serve as a standalone end-user product. By releasing it as open-source, Mistral directly addresses one of vibe-coding's sharpest criticisms: that speed and accessibility come at the cost of correctness and verifiability.
Mistral AI and NVIDIA have formed a strategic partnership aimed at accelerating the development of open frontier AI models. The collaboration brings together Mistral's expertise in building high-performance open-weight models with NVIDIA's leading GPU hardware and AI infrastructure. This deal signals growing industry momentum around open-model development backed by major hardware players.
Glojure is an open-source project that hosts the Clojure language on Go, similar to how ClojureScript targets JavaScript or ClojureCLR targets .NET. It allows developers to write Clojure code that compiles and runs within Go's ecosystem. The project surfaces on Hacker News under AI keywords, likely due to Clojure's popularity in data-processing and functional-programming workflows.
Adam, a Y Combinator Winter 2025-backed company, has announced its open-source AI CAD tool via a Hacker News Launch post. The project is hosted on GitHub under Adam-CAD/CADAM and targets the computer-aided design space with AI capabilities. As a YC-pedigreed open-source entry, it signals growing momentum toward AI-native design tooling for engineers and hardware builders.
MicroUI is a compact immediate-mode UI library written in ANSI C, requiring no external dependencies and no specific rendering backend. It generates a per-frame command list that the host application submits to any renderer it chooses. Ideal for debug overlays, tool UIs, and embedded or resource-constrained environments where heavier frameworks are impractical.
A Hugging Face blog post co-authored with Amazon demonstrates how to take AI models from the Hugging Face Hub all the way to running on physical robots. The integration combines Amazon's open-source Strands Agents agentic framework with Hugging Face's LeRobot robotics library to create an end-to-end pipeline. The result is a practical path for developers to deploy Hub-trained policies and models onto real robot hardware using agent-based orchestration.
A researcher has shared an open project — cells2pixels — showcasing high-resolution neural cellular automata (NCA), a technique where neural networks encode local update rules that cells apply iteratively to produce emergent, self-organizing images. The work extends prior NCA research by targeting higher output resolutions. Shared as a 'Show HN' post, it invites community feedback on the approach and implementation.
Zhipu AI has released GLM-5.2, an open-source large language model that has claimed the top position in AI coding benchmarks among all models except Anthropic's Fable-5. The result marks a significant milestone for the open-source community, showing that the gap between proprietary frontier models and open-source alternatives in code generation continues to shrink. For developers seeking capable, self-hostable coding models, GLM-5.2 now represents the strongest open-source option available.
Brent Simmons, creator of NetNewsWire, retired roughly a year ago and has chosen the veteran RSS reader as his sole retirement project. Free from any commercial obligation, he is focused on making the software as good as it can possibly be. Simon Willison calls this approach inspiring, noting he relies on NetNewsWire daily across Mac and iPhone.
Vercel has announced eve, an open-source agent framework aimed at developers building AI-driven applications. The release marks Vercel's expansion from its core deployment and frontend infrastructure role into the agentic AI tooling space. As an open-source project, eve invites community contribution and aims to lower the barrier for constructing, orchestrating, and deploying autonomous AI agents.
Datasette 1.0a34 ships native CRUD operations in the browser interface, letting users insert, edit, and delete rows directly from table and row pages. The feature was prompted by Datasette Agent, which recently gained SQL write support, creating an awkward asymmetry where the AI chat interface could modify data but the standard UI could not. The release moves Datasette meaningfully closer to a lightweight data-management tool rather than a read-only data publishing layer.
In a brief post on X, legendary programmer John Carmack expressed deep admiration for Fabrice Bellard, stating Bellard is almost certainly a better overall programmer. The tribute is striking given Carmack's own towering reputation in software engineering. No further body text was available from the source, but the remark alone carries significant weight in the developer community.
The 0.1a3 alpha release of datasette-apps patches two access-control bugs in the Datasette plugin ecosystem. First, a bypass that let users lacking the create-app permission create apps anyway has been closed. Second, it was previously impossible to grant edit or delete rights to non-owner users; the fix aligns those permissions with the existing view model — private apps remain owner-only, while non-private apps follow Datasette's standard permission system.
The datasette-apps 0.1a2 alpha tightens security by introducing an `apps-set-csp` permission that gates custom Content Security Policy origins, with an optional allow-list for non-privileged users. The Datasette Agent app-creation tool enforces the same rules. Usability improvements include keyboard navigation in the stored query picker, plus fixes for fragment link interception and full-screen mode rendering.
Gribouille 0.3.0 is a new release of a data-visualization package for Typst, the modern markup-based typesetting system. It adopts the Grammar of Graphics paradigm — the same layered compositional model that underpins ggplot2 in R — enabling expressive, declarative chart construction inside Typst documents. The release is relevant to researchers and developers who author technical documents in Typst and need native, reproducible figures.
Noiz AI has partnered with Hong Kong University of Science and Technology (HKUST) and Tsinghua University to open-source a large audio generation model. The model's standout claims are efficiency: just four sampling steps to produce audio, with inference completing in 0.24 seconds on a single GPU. The open-source release brings research-grade, low-latency audio synthesis within reach of developers and researchers globally.
Linux 7.1 has been announced on the Linux Kernel Mailing List, marking continued progression of the open-source kernel's major version series. No article body was provided, so specific features, changelog highlights, and driver updates cannot be confirmed from this source. Developers building AI infrastructure, edge devices, or Linux-based toolchains should monitor the official release notes for relevant changes.
Capacitor Alarm Clock is a community-published GitHub project offering a native alarm scheduling plugin for Ionic Capacitor apps. It allows developers to set, manage, and cancel device alarms from within cross-platform mobile applications built on web technologies. The project targets mobile developers who need reliable alarm or notification scheduling without writing platform-specific native code.
Inkwash is a watercolor sketching application shared on Hacker News by its creator, johnowhitaker, and hosted on GitHub Pages. The project pairs an interactive drawing tool with an accompanying explanation of how the watercolor effect is implemented. The Show HN format signals the creator is seeking direct community feedback on both the experience and the underlying technique.
Simon Willison has published luau-wasm 0.1a0, an early alpha release that packages the Luau scripting language (Roblox's typed Lua fork) compiled to WebAssembly as a Python wheel installable in Pyodide environments. The release accompanies a companion post detailing the process of publishing WASM wheels to PyPI for browser-based Python runtimes. This enables developers to embed a Luau interpreter inside Pyodide-powered, browser-native Python applications without leaving the WebAssembly sandbox.
A Hacker News item reports that TensorZero, an open-source AI tooling project, had its GitHub repository archived overnight after raising a $7.3 million seed round. With no article body provided, the only supported facts are the project name, the GitHub URL, the archive claim, and the funding amount. The item is most relevant to developers, ML engineers, founders, and investors watching open-source AI infrastructure governance.
Paca is a new open-source project management tool positioning itself as a lightweight Jira alternative designed around human-AI collaboration. Submitted to Hacker News by its creators as a Show HN post, the project is hosted on GitHub under the Paca-AI organization. It targets developers and small teams seeking leaner task-tracking infrastructure that accommodates AI agents as first-class contributors alongside human team members.
An open-source project has introduced a desktop GUI for Claude Code CLI, aiming to make terminal-based coding sessions easier to manage visually. Built with Tauri 2, the app adds multi-tab sessions, history, and visual configuration controls around the existing command-line experience. The project is positioned as a companion to Claude Code rather than a replacement for developers who prefer direct CLI use.
Simon Willison announced Datasette 1.0a33, an alpha release that extends the existing ?_extra= JSON API pattern beyond tables to cover queries and rows. The feature is now documented and presented as a significant step toward Datasette 1.0. Willison also used Claude Fable 5 in Claude Code and GPT-5.5 xhigh in Codex Desktop to build a custom extras API explorer demonstrating the new capability.
FreeOberon is an open-source, cross-platform implementation of the Oberon programming language, designed to feel familiar to developers who grew up with Free Pascal or Turbo Pascal environments. The project is hosted on GitHub and targets portability across operating systems. It revives a structured, minimalist language lineage largely absent from modern tooling ecosystems.
Macaroni is described only as “a single HTML file messenger,” suggesting a compact messaging tool packaged as one HTML document. The provided source does not include implementation details, supported protocols, privacy properties, hosting requirements, or intended use cases. Based on the title alone, it appears most relevant to developers and technically curious users interested in lightweight, portable web tools.