This Week in Open Source for November 13, 2026

by Daryl Ducharme and Remigiusz Samborski, Open Source Programs Office

A look around the world of open source

Open source communities are navigating a structural tension: automated tools are accelerating code generation and security probing faster than human maintainers can review pull requests, build consensus, or fund shared infrastructure. Across this edition, we look at how maintainers, foundations, and protocol builders are responding—from neutral governance for agent sandboxes and empirical supply-chain security to inspectable agent protocols, independent code forges, and permissioned spaces on the AT Protocol.

Upcoming events

🗓️ December 2026

• Yocto Project Virtual Summit 2026.12 (December 1–3, 2026) – Virtual. Community summit for embedded Linux engineers and maintainers building custom, reproducible Linux distributions across edge and Internet of Things (IoT) hardware.
• Open Source Summit Japan 2026 (December 7–9, 2026) – Tokyo, Japan. The Linux Foundation's premier Asia-Pacific conference connecting open source developers, kernel maintainers, and enterprise leaders across cloud, embedded Linux, and open AI—featuring a keynote by Google's Kaz Sato on building agents on open standards alongside sessions from Googlers Tanya Sharma, Tarun Sahu, and Anurag Sinha.
• Open Compliance Summit 2026 (December 10–11, 2026) – Tokyo, Japan. Specialized gathering uniting legal, security, and Open Source Programs Office (OSPO) practitioners around OpenChain, Software Package Data Exchange (SPDX), software bills of materials (SBOMs), and global open source supply-chain compliance.

🗓️ January 2027

• Free and Open Source Software Developers' European Meeting (FOSDEM) 2027 (January 30–31, 2027) – Brussels, Belgium. Europe's largest free, volunteer-organized gathering for free and open source software developers at the Université libre de Bruxelles—with calls for participation now open across 77 community developer rooms and main-track proposals open through November 16.

Open calls for proposals (CFPs)

• Free and Open Source Software Developers' European Meeting (FOSDEM) 2027 (Event: January 30–31, 2027 – Brussels, Belgium) – Main-track CFP deadline: November 16, 2026 (individual community developer room CFPs run on rolling deadlines from November 20 through December 3, with full devroom schedules published by December 7, 2026).
• AtmosphereConf 2027 (Event: April 29 – May 2, 2027 – Amsterdam, The Netherlands) – Round 1 CFP deadline: November 30, 2026 (Round 2: January 11 – February 14, 2027). Community conference uniting developers, researchers, and creators building on the Authenticated Transfer Protocol (AT Protocol), open social web standards, and decentralized agent substrates across Build, Create, Inform, and Govern tracks.
• NeoCloudCon Europe 2027 (KubeCon + CloudNativeCon Europe Co-Located Event) (Event: March 15, 2027 – Barcelona, Spain) – CFP deadline: November 30, 2026 (23:59 CET). Co-located CNCF summit bringing cloud-native infrastructure builders together around emerging AI cloud platforms, GPU orchestration, and open distributed infrastructure.
• CNCF Maintainer Summit Europe 2027 (Event: March 14, 2027 – Barcelona, Spain) – CFP deadline: December 1, 2026 (23:59 CET). Exclusive co-located gathering for CNCF Technical Oversight Committee (TOC) representatives, Technical Advisory Group (TAG) leads, and Graduated or Incubating project maintainers to collaborate on governance, API design, and project health.

We've already submitted talks to FOSDEM and AtmosphereConf—consider submitting a proposal to one of these open calls too, as we'd love to see your work on the schedule!

Open source reads and links

• [Article] Are good intentions hurting open source? - Code generation is no longer the bottleneck when Ingress NGINX runs across half of Kubernetes clusters on two maintainers flooded with AI pull requests. In this summary and keynote, Akamai Cloud's Ruckus Voxi highlights documentation, triage, and stewardship as the real gaps—raising an honest question: how do we recruit contributors beyond code when open source still feels like a "coding club"?
• [Article] Kubernetes, mark II? Why Google's giving away gVisor, a code sandbox used by Anthropic and OpenAI - Anthropic and OpenAI already use gVisor to isolate untrusted code, yet upstream Linux kernel maintainers resisted performance patches while Google kept sole control. Paired with the Cloud Native Computing Foundation (CNCF) donation of Agent Substrate and OpenRL (Google Cloud blog), can neutral governance turn agent sandboxes into shared cloud infrastructure the way Kubernetes did for containers?
• [Recap] OpenSSF Community Day Europe 2026: Driving Systemic Security and Operational Resilience in Open Source - Drawing 200+ practitioners in Prague—with session recordings now online and a Google-sponsored academic security track—speakers unveiled Model Context Protocol (MCP) audit tools like SandScope, skill-registry attack detection, empirical Software Bill of Materials (SBOM) studies, and European Cyber Resilience Act due diligence. As "cheap trust signals" collapse under automated noise, what empirical verification belongs in release pipelines?
• [Article] GitHub is experiencing an open-source exodus. Here’s where the developers are going instead - "Exodus" might be too strong of a word, but continuous integration (CI) outages and opt-out AI training have pushed projects like Zig and Ghostty off GitHub toward Codeberg, self-hosted Forgejo, and SourceHut—though as an AT Protocol watcher, decentralized forge Tangled should likely have earned a mention too. When communities weigh contributor network effects against hosting independence, could protocol-level identity help smaller forges bridge that gap?
• [Report] Navigating Open Source Software Development in the Generative AI Era - Surveying 234 contributors and maintainers (companion blog post), Linux Foundation Research finds generative AI cuts task time by up to 52%, yet maintainers estimate 25% of incoming pull requests are low-quality "AI slop"—with 64% reporting slower reviews, 63% citing burnout, and only 35% of projects holding a formal AI policy. Rather than blanket bans or unchecked noise, what lightweight verification norms actually scale across smaller maintainer teams?
• [Article] Munich dumps proprietary for open source (again) - As Munich renews its open-source push beneath the desktop layer, Matrix.org co-founder Amandine Le Pape highlights the other half of European public-sector sustainability: while civil servants across Europe now rely on Matrix, only one government agency funds the underlying specification. Can new bodies like the Digital Commons European Digital Infrastructure Consortium (EDIC) align government procurement with upstream maintenance?
• [Article] Why science keeps choosing open source - Enterprise IT expects software upgrades every few years, but research labs often pair modern Graphics Processing Unit (GPU) clusters with 15-year-old instruments and validated scripts that cannot change without breaking reproducible results. Highlighting how Linux, containers, and open source outlive commercial vendor roadmaps, how else does source access protect long-term knowledge from planned obsolescence?
• [Blog] Fast, reliable A2UI, with swappable inference formats - Pairing Google’s open Agent-to-User Interface (A2UI) protocol with Genkit for Go, Daniela Petruzalek demonstrates how agents can stream rich generative user interfaces over compact, swappable wire formats without locking frontend layouts to a single model provider. As agent workflows move beyond plain-text chat boxes, how can open UI protocols keep human interfaces fast and inspectable across runtimes?
• [Blog] Testing and Serving A2A Agents from the Terminal with A2A CLI - In a hands-on terminal walkthrough, Mete Atamel shows how the open source Agent2Agent (A2A) command-line interface (CLI) lets developers inspect agent cards, stream multi-turn tasks, and serve local A2A endpoints directly from the command line without spinning up a full web UI. Just as curl made HTTP debugging universal, what terminal primitives do builders need to make multi-agent interoperability easy to test locally?
• [Blog] Behind the scenes, two months later: How we ship Google Agent Skills like products - Treating natural-language SKILL.md packages on GitHub as living software releases rather than static docs, maintainers on Google’s open-source skills repository enforce strict semantic versioning, pre-review CI schema linters, and continuous evaluation suites against a no-skill baseline. When open-source repositories distribute natural-language instructions instead of deterministic code, how must release engineering evolve to prevent silent behavioral regressions?

Spotlight: ATProto Spaces and permissioned data

With a release specification and beta for permissioned spaces on the Authenticated Transfer Protocol (AT Protocol) targeted for late November, what should we be building with shared spaces in mind:

• [Video] FediForum Talk: Introduction to Atproto Spaces & Reintroducing Spaces - Bluesky’s Daniel Holmgren introduces ATProto Spaces as lightweight "mini AT proto networks" built around locality rather than per-record Google+-style Circles (it still lives in our hearts)—proving via "Daniel’s Circles Postulate" why binding each space to one owner and one modality keeps OAuth consent screens legible in two sentences while preserving cross-app remixability for private groups, newsletters, and 100,000-member forums.
• [Blog] Modeling communities on permissioned data & Permissioned Data Diary 5: What’s in a Name? - Rather than cramming forums, chat, and events into one "universal space" that over-grants OAuth read permissions, Holmgren models a community as a single transferable Decentralized Identifier (DID) owning separate modality-specific spaces (at://<space_owner_did>/space/<space_type>/<space_key>/<author_did>/<collection>/<rkey>) so community ownership can change hands without breaking URI backlinks.
• [Blog] Permissioned Data Diary 6: Boring Auth & Permissioned Data Diary 7: Off the Record - Explaining why Spaces passed on User Controlled Authorization Networks (UCAN) capability chains in favor of a "narrow waist" OAuth Space Credential with reader-enforced writes, Holmgren details how space repositories replace Merkle Search Trees (MSTs), asymmetric signatures, and global Relays with LtHash (an ~80-line quantum-resistant lattice multiset hash), deniable Hash-based Message Authentication Code (HMAC) signatures, and direct HTTP/2 pull sync.
• [Forum] STAR format stabilization (space repo archives!) & STAR: settling the details - Because space repositories use order-independent LtHash sets rather than Merkle trees, ATProto Spaces is adopting STreaming ARchives (STAR on Tangled) instead of Content Addressable aRchives (CARs) for repository exports—sparking an active community design discussion around canonical varint strictness, $type Namespace Identifier (NSID) collisions, and truncation checks.
• [Blog] Building on ATProto - Offering a local-first developer counterpoint, Puppet founder Luke Kanies examines the friction of promoting records between private spaces and public broadcast repositories and explains why offline-capable applications still need local working copies alongside remote Personal Data Servers (PDSes). Once open protocols support private and group spaces natively, what kinds of community tools would you want to build first?

Which of these stories will you be chatting about at your next meetup or conference? Let us know! Share with us on our @GoogleOSS X account or our @opensource.google Bluesky account.