The 100 open-source projects that matter in 2026

The hundred open-source projects we consider most significant this year, across eight categories: AI, cloud, data, observability, security, developer tools, web platforms and self-hosted software. For each one we give its stars, its licence and its activity, followed by what the list as a whole says about where developer attention and money are going.

How to read this

The selection is editorial. We weighed adoption, maturity, activity and influence on the rest of the ecosystem, not stars alone, and grouped the result into eight categories. For each repository we recorded its star count, its licence as the LICENSE file actually states it, and the date of its last push. Every project on the list was pushed to within the last eight weeks, most of them on the day we checked.

Stars measure how many developers noticed a project. They say little about how many systems run it. runc has 13,464 stars and executes containers on nearly every Kubernetes node in existence; one agent-skills repository has more than twenty times that. PostgreSQL, SQLite and Git develop outside GitHub, so their read-only mirrors undercount them badly. OpenTelemetry is spread across dozens of repositories, and we counted only the Collector.

One caveat on growth figures in general. OSSInsight, the usual source for star-growth rankings, says itself that star, PR and issue events since mid-2025 were badly under-captured after GitHub changed how its public events feed paginates, and it paused the rankings that depend on them. Repository totals, the kind used here, were not affected. Month-on-month growth rankings from that period should be read with care.

1. Where the attention goes

Star totals by category across the hundred, with the number of projects in each:

Twenty-two AI projects draw almost twice as many stars as the 46 projects in cloud, databases, observability and security put together: 2.83M against 1.57M. Yet those 46 run nearly all the production infrastructure the AI projects are deployed on. For anyone building a business around open source, that gap is the useful signal. Developer attention and operational dependency have separated. The companies that pay for support, hosting and compliance sit on the dependency side. Packaging those projects for cloud marketplaces is the most visible version of that business, and our note on marketplace listings shows how little most of it earns.

2. The newcomers

Twenty-two of the hundred repositories were created in 2023 or later. Nine date from 2024 onwards, and the newest of them is the most-starred repository on the list:

A second group grew even faster, and we left it out on purpose. These are agent-skill collections: prompts and workflows rather than software that other systems run on.

A year-old collection of coding-agent skills has more stars than React, which has 250,822 after thirteen years. OpenClaw has more than both. This is the clearest sign that stars now measure something other than what they measured in 2020.

3. Not everything here is plain open source

For anyone looking at business opportunities around open source, the licence boundary matters more than the star count. Several projects on the list are not under a single OSI-approved licence, and they are marked with an asterisk in the tables:

• Dify is licensed under "a modified version of the Apache License 2.0", which forbids operating a multi-tenant environment without written permission and forbids removing the logo from the console. That is precisely the restriction that matters to anyone who wants to host it.
• Redis has been under RSALv2 / SSPL / AGPL-3.0 since Redis 8. The AGPL option makes it OSI-compliant again, but the licence that made Valkey necessary is still one of the three.
• Elasticsearch is AGPL-3.0 / SSPL / Elastic License 2.0. The same reasoning applies.
• LiteLLM, SigNoz and Infisical are open core. Everything under enterprise/ or ee/ is under a separate commercial licence, and those directories hold the features a company actually pays for. Weaviate does the same with a wl/ directory.
• n8n is under the Sustainable Use License, and Open WebUI's licence forbids removing its branding above a small deployment size.

We kept them because they matter, and leaving them out would only hide the issue. Separately, Grafana, Loki, Immich, Nextcloud, Mastodon, RustDesk and AppFlowy are AGPL-3.0. That is fully open source, but it decides what a hosting business can keep proprietary.

4. Repositories move, and some go quiet

Four projects on the list have moved since most links to them were written. ComfyUI is now under Comfy-Org, OpenHands has its own organisation, Podman is under podman-container-tools and React under react/react. opencode has moved from sst to anomalyco, and goose has left Block for aaif-goose, under the Agentic AI Foundation.

A few well-known projects did not make the list for reasons worth stating:

• Aider has not been pushed to since 22 May 2026.
• AutoGen is officially in maintenance mode, and Microsoft's work has moved to microsoft/agent-framework. Its last push was on 15 April 2026.
• Synapse is split across two repositories. Element forked it into element-hq/synapse (4,659 stars) when it relicensed under AGPL, and the archived matrix-org/synapse still holds 12,097.
• Joplin is AGPL, but Joplin Server ships under a "Personal Use License".

Near misses that would fit on another day: Excalidraw (133k), Tailwind CSS (98k), Uptime Kuma (92k), RAGFlow (91k), Syncthing (89k), Unsloth (77k), Traefik (65k), Ghostty (62k), Coolify (62k), PocketBase (61k). Meilisearch (59k) is partly under BSL.

5. Rust keeps spreading

Zed, uv, Ruff, ripgrep, Biome, Qdrant and RustDesk are all Rust-primary repositories. The strongest example is newer. Bun, built in Zig, is being ported to Rust. Rust already makes up most of its main branch by bytes, although the stable 1.3.x releases still ship from the Zig codebase.

The hundred

Numbering is by category, not by rank. * marks a repository whose licence is not a single OSI-approved licence covering all of the code (see section 3). Star counts are as of 29 September 2026.

AI, LLM and agents — 22

Cloud and containers — 13

Databases, search and streaming — 15

Observability — 9

Security and identity — 9

Developer tools and runtimes — 13

Web and application platforms — 11

Self-hosted and local-first — 8

What we would watch

This part is opinion, not data. Five structural shifts seem more significant than any single repository:

• AI inference is becoming an infrastructure layer of its own. Models, inference servers, gateways, memory and agents are each a separate market now: Transformers, then vLLM or SGLang, then LiteLLM, then Mem0, then OpenHands or Browser Use.
• Agent tooling is separating from the models. Section 2 is the evidence.
• Postgres is becoming a platform more than a database. Vector search, change data capture, queues, branching and serverless are all being built on it, and Supabase is the proof that a Firebase-shaped product can be assembled from those pieces.
• OpenTelemetry is becoming the API of observability. Value is moving away from the collector and towards what comes after it: storing, correlating, diagnosing and fixing.
• Rust keeps winning in tooling, and now in runtimes too.

Twenty ecosystems where we expect new picks-and-shovels businesses to form around the project itself: hosting, gateways, control planes, backup, migration, security and cost tooling.

vLLM · SGLang · LiteLLM · OpenTelemetry · Kubernetes · Cilium · Crossplane · OpenTofu · Argo CD · Valkey · DuckDB · ClickHouse · FoundationDB · Qdrant · Supabase · uv · Bun · Infisical · Browser Use · Mem0

Two of the twenty, LiteLLM and Infisical, are open core. The paid features sit in the same repository under a different licence, and that decides which of those businesses are actually open to a third party.