Curator notes on stacks worth shipping, each one picked, tested and documented.
70 posts
Three React drag and drop libraries, three different stages of life. Read from the npm registry, the published tarballs and the GitHub API on 16 September 2026: one is archived, one is quietly split in two, and one is not a React library at all.
All three are MIT and all three shipped stable releases this month, so maintenance is not the deciding question. Who holds the copyright and what renders on the server is. Measured from the npm registry and the published tarballs.
Two MIT frameworks and one source-available platform. The licence split is the half everyone writes about; the release log is the half that decides more projects.
Three self-hosted observability backends that all claim to be open source. We read the licence files, opened the enterprise directories and measured every container image on September 8, 2026, and the licence, the visibility and the footprint each land in the opposite place to the reputation.
Metabase, Apache Superset and Lightdash all call themselves open-source BI, but they disagree about where a metric definition is allowed to live. We read the licence files, the dockerfiles and the driver lists directly to find out what that costs you.
Three self-hosted identity providers that all call themselves open source. The licence boundary sits in a different place in each one, and where it sits decides which you can actually use. Measured from the licence files, the container registries and the shipped config defaults.
Three ways to make a PDF from a Next.js app, compared on the thing the listicles skip: where the Chromium binary lives, and who is responsible for keeping its version aligned. One of the three currently asks you to bridge a three-major-version gap.
Three self-hosted S3-compatible object stores, compared on the things the listicles miss: what MinIO's archive actually retired, why Garage's star count is unmeasurable, and what a 36-release year means for your upgrade discipline.
Three founding stack guides carried publication dates from before shipgarden.com was registered. A date audit on August 23, 2026 caught it and all three are corrected. Here is what changed, why it happened, and the two public lookups you can run to check us.
Three open-source status pages, compared on the things features lists never cover: whether you can pin a version, what the compose file actually does, and how fast each project is really moving.
Vault's licence file now names IBM, and the Additional Use Grant inside it probably does not restrict you at all. We read the licence text, the npm registry and all three pricing pages: the meters count different nouns, and that inverts which tool is cheaper.
Eight of the nine results for this question are written by a company selling one of the answers, and the licensing argument they all lead with barely applies to you. We read the license files, the security advisories and the release branches instead. The real difference is what happens when a CVE lands.
