Top Tools from Aug 24–30, 2026

Carson Gross's hypermedia library reaches 4.0 with three breaking changes aimed at the surprises that bit people in 2.x. Attributes no longer inherit down the DOM unless you append an :inherited suffix, which is the bulk of the migration work and ships with a CLI tool that finds the places you need to mark. Events are renamed onto a consistent htmx:phase:action scheme, replacing names like htmx:beforeRequest with htmx:before:request, and history handling drops the localStorage page cache in favour of re-fetching on back navigation so third-party JavaScript stops fighting it. The team is explicit that htmx 2 will continue to be supported indefinitely, so nobody is being pushed off it. Zero-Clause BSD, which is about as permissive as licences get, funded through GitHub Sponsors. 49.2k stars as of 31 August 2026

A 25 cm, 800 g biped robot from Pollen Robotics, the French company that is now part of Hugging Face, carrying 15 motors, a camera, LiDAR, two IMUs and a grasping beak, with an onboard policy loop running at 50 Hz. It arrives playable with seven pre-trained behaviours, and the interesting part is that all seven policies are published rather than baked in, so you can retrain them in MuJoCo simulation on your own machine and push them back to the hardware. The SDK, the simulator and the full reinforcement-learning training stack are Apache-2.0 at pollen-robotics/microduck. Pre-orders opened 27 August 2026 at an introductory 399 US dollars for the robot before tax and shipping, with a dev pack of spare motors, cables, batteries, charger, NFC tags and tools at 119, a charger pack at 39 and an accessory pack at 39. 3.5k stars as of 31 August 2026

Tailscale's own remix of its open-source pieces into something that behaves like netcat but runs over Tailscale's data plane without its control plane, described in the repo as Tailscale without Tailscale, by Tailscale. One side runs a listener and gets back a short connection token, the other side passes that token in, and the two ends get a WireGuard-encrypted tunnel that bootstraps through a DERP relay and then upgrades to direct peer-to-peer UDP once NAT traversal succeeds. Connection metadata is exchanged out of band however you like, so there is no account, no root or admin access needed, and no changes to your routing tables or DNS - it is a userspace Go library and CLI. BSD-3-Clause. 4.4k stars as of 31 August 2026

MIT-licensed C++ daemon from Zack Bartel that brings Apple Continuity to Linux, covering iMessage and SMS, iPhone notifications mirrored to the desktop and contact sync, so a Linux machine sits in a group chat the way a Mac does. It reimplements the interoperability protocols rather than wrapping a Mac, and the licence choice was argued over on Hacker News, where commenters pressed the case that an interoperability implementation belongs under something permissive rather than copyleft. Free, with funding through GitHub Sponsors. 953 stars as of 31 August 2026

The brand typeface commissioned by Nebula, the creator-owned streaming service, released for anyone to use under the SIL Open Font License. It is a humanist sans built on Adobe's Source Sans by Paul D. Hunt, and the explicit design goal was a drop-in alternative to Whitney ScreenSmart, the Hoefler face that a lot of media brands licence expensively. Two styles across six weights, from Light through Black with matching italics, aimed at interfaces and print alike. Version 1.010 is a free zip download with no account, and Nebula also published a short documentary about how it was made. Free and openly licensed, funded by the streaming service that uses it

Embedded property-graph database written in Zig by Jeff Hajewski, pitched as SQLite for graphs - the whole database is one portable file with no server and no configuration. What makes it unusual is that graph traversal, HNSW vector similarity and BM25 full-text search all live in the same query layer, so a single Cypher-style query can filter by relationship, semantics and text together instead of stitching three engines. It also carries durable named event streams and a graph changefeed through the same write-ahead log as graph writes. The author publishes 0.13 microsecond node lookups and 0.83 ms vector search over 1M vectors at full recall. MIT, installable through a shell script or as an embedded library. 607 stars as of 31 August 2026

Apache-2.0 streaming server in Rust that puts durable, real-time streams over plain HTTP on top of S3-compatible object storage, with no disks to provision and no broker-local state to lose. The design bet is that streams should be cheap enough to create one per use case rather than packing every record of a kind into a shared topic, so each stream is independently addressable and scales from idle to high throughput on its own. It speaks the Kafka protocol alongside its own HTTP API and ships a Rust client, deployment guides for Docker, Fly and AWS, and an admin API and dashboard. Free and open source with no paid tier published, developed in the open with a Discord and a documented design. 306 stars as of 31 August 2026

AGPL-3.0-or-later password, 2FA and recovery vault for Windows and Linux, built around a writable local vault that needs no account and no server to create, edit, import, back up or export. The Rust vault core sits in the desktop app, imports read 15 formats from other managers, and there is a vault-blind Go server you can self-host if you want the optional account portal. Four repositories are public - desktop, server, website and browser extension. Shipping today are the local vault, 2FA codes, PIN and Windows Hello unlock, backup and export; sync, mobile apps, passkeys, sharing and browser-store distribution are not. The local app is free and the maker says a paid hosted plan is intended to cover managed sync once that ships. The site is direct that this is public beta at v0.2.0 with an independent security review still unfinished, and asks people to use test data rather than real secrets

Closed-source billing platform from Diego Vidal built on the premise that your payment processor can be taken away from you. It vaults card credentials as network tokens under the merchant's control rather than the processor's, so switching processors does not mean asking every customer to re-enter a card, and it routes each transaction to whichever of Stripe, Adyen, PayPal, Checkout, Authorize.net, Paysafe, Airwallex, Pockyt or Anrok is likeliest to approve it, cascading soft declines to a backup rather than losing the sale. On top of the routing layer sits ordinary subscription billing - recurring invoices, trials, metered and tiered pricing, dunning, hosted checkout and revenue analytics. One published tier at 99 US dollars a month plus 0.65 percent of processed volume, with no setup fee or minimum, and a custom tier for high-risk industries and advanced orchestration. Free trial with no card required

Hosted document question-answering from Vectify AI, built on the company's own MIT-licensed retrieval engine, which skips vector embeddings entirely in favour of building a table-of-contents tree over each document and reasoning its way down it the way a person flipping through a report would. You point it at a folder of long professional documents, ask across all of them at once, and every answer carries citations that jump to the exact highlighted source line, with OCR for scanned PDFs and handling for tables and cross-references. The engine at VectifyAI/PageIndex is MIT and self-hostable with 35.4k stars as of 31 August 2026; the hosted service is a credits-and-pages subscription - a free trial with 200 credits and 200 active pages, then Standard at 30 US dollars a month or 300 a year, Pro at 50 a month or 500 a year, and Max at 100 a month or 1,000 a year, scaling to 500,000 active pages, with top-up credits at 1 cent each that do not expire

GPL-3.0 desktop photo manager and image editor for Linux and Windows with experimental ARM64 and macOS builds, written in VB.NET on Avalonia UI and .NET 10, which the author cheerfully admits is a rare choice. It covers the whole path in one application - folder browsing with fast thumbnails, ratings, keywords and saved searches, a fullscreen viewer with side-by-side compare and histogram, then RAW development with measured lens corrections for around 1,300 lenses, layers, masks, curves and retouching. Ratings and keywords are read from the sidecars Lightroom, darktable and digiKam write, so a collection tagged elsewhere arrives intact, and face and location search run entirely on your own machine. It can also act as a client for a self-hosted Immich or Nextcloud server. Free with no paid tier, sixteen interface languages. 373 stars as of 31 August 2026

AGPL-3.0 self-hosted location tracker from Daniel Graf that turns a phone's GPS trail into visited places, trips and movement patterns, the name being Finnish for route. The v5.3.0 line adds custom map styles, multi-segment trips and H3 spatial coverage, and this patch fixes a performance problem that hit exactly the hardware most of its users run on - importing large GPX files onto a mini PC, NAS or Raspberry Pi used to trigger a recalculation across a fixed 24-hour window every 1,000 points, which on modest hardware took longer than the interval and piled up a backlog that clogged the database. It now recalculates over a sliding window of 50 points instead. French translation is back to complete. Free and self-hosted, funded through Ko-fi. 2.5k stars as of 31 August 2026