Topic
How open-source projects are financed: foundations, corporate sponsorship, grants, paid support and maintenance fees, and free-riding by non-paying users.
FFmpeg 8.1.2 fixes CVE-2026-8461, a CVSS 8.8 heap out-of-bounds write in the libavcodec MagicYUV decoder that JFrog found. A dev.to post-mortem says a crafted .avi thumbnailed by a file manager reaches it, so anything linking libavcodec needs a version check.
Reality
Pennyforge's audit of the two confirmed Open Source Maintenance Fee packages on NuGet found the fee in registry metadata for neither of them. The companies above the fee thresholds are the ones that run automated license scans, and they have to read each project's terms by hand.
Reality
Home Assistant is renaming its $6.50-a-month Cloud subscription to Link while keeping its features the same. The steep learning curve that stands between it and mainstream buyers is left to tools the company has not shipped yet.
Reality
EDG put the C++ front end it licensed to compiler makers for 30 years on GitHub under Apache 2.0, with the C++ Alliance as its non-profit home. Toolchain teams that bought it as a closed part can now patch it in public and pay jointly for new features.
Reality
Six authors writing for the ACM's Technology Policy Council say AI has made code and vulnerability reports cheap to produce while the people who decide what ships are volunteers at projects like Apache, whose 2024 revenue was $2,379,402.
Reality