Tag
12 posts tagged.
Three React image croppers whose received wisdom is three months out of date. Read from the npm registry, the published tarballs and the GitHub API on 1 October 2026: the library everyone calls selection-only now writes the canvas code for you, the most downloaded one still ships zero canvas code, and the package npm reports as smallest is actually the heaviest.
Motion ships 67 files carrying a use client directive, GSAP ships zero across 117, and the rename everyone tells you to migrate for turns out to be a 35 byte alias. Measured from the npm registry and the published tarballs.
Three React drag and drop libraries, three different stages of life. Read from the npm registry, the published tarballs and the GitHub API on 16 September 2026: one is archived, one is quietly split in two, and one is not a React library at all.
All three are MIT and all three shipped stable releases this month, so maintenance is not the deciding question. Who holds the copyright and what renders on the server is. Measured from the npm registry and the published tarballs.
Two MIT frameworks and one source-available platform. The licence split is the half everyone writes about; the release log is the half that decides more projects.
Three self-hosted observability backends that all claim to be open source. We read the licence files, opened the enterprise directories and measured every container image on September 8, 2026, and the licence, the visibility and the footprint each land in the opposite place to the reputation.
Metabase, Apache Superset and Lightdash all call themselves open-source BI, but they disagree about where a metric definition is allowed to live. We read the licence files, the dockerfiles and the driver lists directly to find out what that costs you.
Three self-hosted identity providers that all call themselves open source. The licence boundary sits in a different place in each one, and where it sits decides which you can actually use. Measured from the licence files, the container registries and the shipped config defaults.
Three self-hosted S3-compatible object stores, compared on the things the listicles miss: what MinIO's archive actually retired, why Garage's star count is unmeasurable, and what a 36-release year means for your upgrade discipline.
Three open-source status pages, compared on the things features lists never cover: whether you can pin a version, what the compose file actually does, and how fast each project is really moving.
Vault's licence file now names IBM, and the Additional Use Grant inside it probably does not restrict you at all. We read the licence text, the npm registry and all three pricing pages: the meters count different nouns, and that inverts which tool is cheaper.
Eight of the nine results for this question are written by a company selling one of the answers, and the licensing argument they all lead with barely applies to you. We read the license files, the security advisories and the release branches instead. The real difference is what happens when a CVE lands.
