Open Source Signal, Week 1: What Held Up, What We Corrected, What We Left Out

The week the license fine print became the headline

You spent part of this week clicking "merge" on dependency bot PRs before coffee, the way you do every week. Nothing unusual there. What was unusual was how much of the actual conversation in your feeds had nothing to do with releases and everything to do with license text — AppFlowy-Cloud getting archived, AFFiNE's split-license repo raised questions, Outline's BSL status coming up once someone read the LICENSE file.

And then there was OpenMAIC, a repository that landed in the team's adoption discussion by midweek. Here's the honest answer about it: GitHub's own file detection classifies OpenMAIC's LICENSE file as MIT. That's the whole claim. If you saw someone describe a license swap with specific dates attached, ask them for a dated source.

None of this is dramatic on its own. But a week where three separate projects raised license questions, in three different ways, is worth noticing as a pattern rather than three coincidences.

A signal system is judged by its corrections, not its hits

Anyone can publish a list of releases. Copy the changelog, add a sentence, done. That's not a signal system, that's a mirror. What makes a roundup worth trusting isn't how many items it names — it's whether it tells you when it was wrong, what it left out, and why.

So the corrections log below isn't a footnote you can skip. It's the part of this post doing the most work. If AppFlowy-Cloud shows up on last month's shortlist you saved, that shortlist is stale as of September 1. If someone told you AFFiNE is "just MIT," that's incomplete, and the incompleteness matters if you're planning a production deployment. Reports come from the worker. Verdicts come from a judge. The correction is where the judging shows up in public.

How items earned inclusion

Nothing here is new research. Everything in this roundup was checked during Days 1 through 6 of the week, then re-verified against primary sources before publication — because facts about licenses, security advisories, and release notes move, sometimes within days.

Three filters decided what made the cut. First, primary sources checked the same morning as the claim — a GitHub release page, a raw LICENSE file, a security advisory, not a summary of one. Second, a claim gate: every sentence in this post that could change a decision you make has to trace back to something in the verification packet, or it doesn't get written. Third, no item made it in for recency alone. A release with no listed changes doesn't count as a highlight just because it's this week's.

Proof — what held up

Re-verified against primary sources on September 2, 2026; volatile facts re-checked again before Sunday publication.

A note on scope: the links below point to posts published earlier this week, and each of those carries its own checked-at date — trust that date for its facts, not this one.

Verified highlights

• AppFlowy-Cloud was archived September 1, 2026. Its README now calls it legacy and unmaintained, and states that production self-hosting has moved to a closed-source commercial fork. The shortlists that still name AppFlowy Cloud are stale as of September 1. AppFlowy-Cloud repository
• AFFiNE's license is split, not uniform. The repository tree describes itself as MIT for the community edition, but packages/backend and packages/common/native sit under a separate license whose server file requires a valid AFFiNE Enterprise Edition subscription for production use. Root LICENSE · Backend server LICENSE
• SiYuan v3.8.2 (August 30) fixed a critical stored-XSS advisory. GHSA-7h8j-qw37-w46g, CVSS 9.0, affects 3.8.1 and earlier. The advisory has no CVE ID assigned yet and may be revised — treat the severity number as current, not final. Security advisory
• Gitea v1.27.3 (August 29) shipped a SECURITY-led release. Package token scopes, attachment path enforcement, Actions artifact signatures, fork-PR trust boundaries, and hook permissions all changed. If you're self-hosting below 1.27.3, this is the release you're behind on. Release notes
• Keycloak 26.7.3 (August 31) closed a CVE batch. Three worth naming are CVE-2026-35563 (LDAP hostname verification), CVE-2026-16093 (signed-JWT assertion policy bypass), and CVE-2026-16089 (authorization code retargeting). Release notes

Corrections log

1. Shortlists still calling AppFlowy Cloud "the open-source Notion answer" are stale as of September 1 — it's archived.
2. Outline v1.10.0 is Business Source License 1.1. Its own LICENSE file states plainly that it "is not an Open Source license," with a Change Date of 2030-09-01 before it converts to Apache-2.0. Outline LICENSE
3. "AFFiNE is just MIT" is incomplete — the Enterprise Edition server file requires a paid subscription for production use.
4. NocoDB's Sustainable Use License is not OSI-approved, by NocoDB's own documentation, and the LICENSE file itself never claims to be open source. NocoDB license docs · LICENSE.md
5. The Day 2 worked example's repository numbers — commits, issues, pull requests — were re-checked and updated before this publication because they'd already moved within days. A snapshot without a date stamp is a snapshot that rots.

Watchlist, and what we left out

• Kubernetes 1.37 missed our UTC release window by hours — published 2026-08-26T16:29Z, already August 27 in Manila. It stays a watchlist note, not a highlight; we're not treating it as material-impact this week. Release notes
• Wiki.js 3.x is beta, marked "Not for production use," while v2.5.314 remains the production Latest release.
• n8n@2.37.7 published with no listed features, fixes, or security notes attached — recency without documented impact, so it doesn't earn a highlight slot. Release
• Three items carry date-bound caveats worth repeating: the SiYuan advisory has no CVE ID yet and advisories get revised; the Day 6 GitHub CLI responsiveness numbers were a September 2 hand sample of the nine newest issues, bot median around 3.5 minutes, human maintainers visible on two of nine; Uptime Kuma's v2 removal of JSON backup was checked on Day 5 only. None of these are permanent facts — they're facts as of a specific day.
• Wiki.js install docs never loaded for verification because the page is JavaScript-rendered, so they stay unverified rather than assumed.
• Excluded outright: Outline (BSL, not open source), AppFlowy-Cloud (archived), and anything that wasn't verified during Days 1 through 6.

This week's watchlist is shorter than some weeks. That's not an oversight — a quiet section stays short, and length here isn't padded to look thorough.

Which check will you adopt next week?

You don't need to run every check in this series at once. Pick the one that matches whatever you're actually doing right now — evaluating a new dependency, self-hosting something, or just trying to figure out if a tool is still maintained — and run that one this week.

• If you're pasting AI answers into decisions, start with proving which source your AI cited.
• Before adopting anything new, run six checks before adopting a new repository.
• If you're choosing between knowledge-workspace tools, read comparing open-source knowledge-workspace alternatives — it's the piece that surfaces the AppFlowy and AFFiNE license details in full.
• For a rundown of the week's release changes, that post has the day-by-day detail this roundup compresses.
• Planning to self-host anything from this list, work through the five-part self-hosting checklist.
• And if you're looking to give back rather than just consume, finding a project worth your first contribution is the practical starting point.

All six live under the open-source field notes hub if you want the full week in order.

FAQ

Will you do this every week?

That's the intent — a Sunday roundup, built from what got verified Monday through Saturday, with corrections logged in the open. Whether it continues depends on whether it stays useful to you and whether the verification process holds up under a weekly cadence without cutting corners. If it starts feeling padded or rushed, that's a sign to slow down or stop, not to keep shipping anyway.

What does corrections mean here?

It means a specific, dated log of claims that changed, were previously incomplete, or turned out wrong once checked against a primary source — not a vague "we try to be accurate" disclaimer. This week's log has five entries above. Some weeks will have more, some fewer. The number isn't the point; the willingness to publish it is.

Disclosures: ranex.dev is Anthony Garces's site, and Leitir — the tool used in Day 1's provenance walkthrough — is his tool. That post is a methodology walkthrough, not a ranking or an independent endorsement. Research and drafting for this series were AI-assisted; human review is required before anything here gets published.