{
  "apiVersion": "v1",
  "resource": "roadmap",
  "total": 256,
  "data": [
    {
      "name": "Vault",
      "category": "Secrets & identity",
      "license": "BUSL-1.1",
      "licenseClean": "caution",
      "priority": "planned",
      "note": "HashiCorp Vault. Source-available, not OSI.",
      "cleanAlternative": "OpenBao (MPL-2.0) — the open fork, already shipped."
    },
    {
      "name": "Kong Gateway",
      "category": "Gateways & proxies",
      "license": "Apache-2.0",
      "licenseClean": "clean",
      "priority": "planned",
      "note": "API gateway on nginx/OpenResty. Open-core (the OSS gateway is Apache-2.0; many features are gated behind the enterprise tier) and it depends on PostgreSQL. APISIX and Tyk are lighter, fully-open alternatives."
    },
    {
      "name": "Apache APISIX",
      "category": "Gateways & proxies",
      "license": "Apache-2.0",
      "licenseClean": "clean",
      "priority": "planned",
      "note": "Dynamic API gateway on Nginx + LuaJIT: hot-reloads plugins and config from etcd, with no relational-database dependency. A high-performance Kong alternative."
    },
    {
      "name": "Gloo Edge",
      "category": "Gateways & proxies",
      "license": "Apache-2.0",
      "licenseClean": "clean",
      "priority": "planned",
      "note": "Envoy-based gateway for microservices, monoliths, and serverless, with strong multi-protocol support: HTTP, gRPC, WebSockets, and FaaS."
    },
    {
      "name": "Envoy Gateway",
      "category": "Gateways & proxies",
      "license": "Apache-2.0",
      "licenseClean": "clean",
      "priority": "planned",
      "note": "CNCF implementation of the Kubernetes Gateway API on Envoy: standard K8s resources instead of vendor CRDs. The Kubernetes-first Kong alternative."
    },
    {
      "name": "Bifrost",
      "category": "AI gateway",
      "license": "Apache-2.0",
      "licenseClean": "clean",
      "priority": "planned",
      "note": "High-performance Go AI gateway: unified access, load balancing, and failover across 20+ LLM providers with near-zero overhead. An open alternative to bolt-on AI-gateway plugins."
    },
    {
      "name": "LiteLLM",
      "category": "AI gateway",
      "license": "MIT",
      "licenseClean": "clean",
      "priority": "planned",
      "note": "Lightweight Python proxy exposing one OpenAI-compatible API to call, monitor, and cost-map 100+ LLM providers."
    },
    {
      "name": "Apache SkyWalking",
      "category": "Observability",
      "license": "Apache-2.0",
      "licenseClean": "clean",
      "priority": "planned",
      "note": "APM: distributed tracing, metrics, and service-topology analysis. [blocked: upstream CVEs / ES9 unsupported]",
      "blocked": true,
      "blockedReason": "Built and 0-CVE, but the chart is held on its storage backend: SkyWalking OAP 10.4.0's bundled Elasticsearch client drives ES 6/7/8 and OpenSearch only and throws `UnsupportedOperationException` on ES major 9, so OAP crashes on boot against QuenchWorks' Elasticsearch 9.x. Held until a compatible backend ships (an ES 8 image, or SkyWalking's native BanyanDB — the OAP image already bundles the BanyanDB client)."
    },
    {
      "name": "Milvus",
      "category": "Search & vector",
      "license": "Apache-2.0",
      "licenseClean": "clean",
      "priority": "planned",
      "note": "Scalable vector database for AI workloads."
    },
    {
      "name": "Apache Flink",
      "category": "Workflow & data",
      "license": "Apache-2.0",
      "licenseClean": "clean",
      "priority": "planned",
      "note": "Stateful stream processing."
    },
    {
      "name": "Apache Spark",
      "category": "Workflow & data",
      "license": "Apache-2.0",
      "licenseClean": "clean",
      "priority": "planned",
      "note": "Unified batch and stream analytics engine."
    },
    {
      "name": "Dagster",
      "category": "Workflow & data",
      "license": "Apache-2.0",
      "licenseClean": "clean",
      "priority": "planned",
      "note": "Data orchestrator for ML and analytics pipelines."
    },
    {
      "name": "n8n",
      "category": "Workflow & data",
      "license": "Sustainable Use License",
      "licenseClean": "caution",
      "priority": "planned",
      "note": "Fair-code workflow automation with native AI. Source-available, not OSI.",
      "cleanAlternative": "No drop-in clean equivalent; Temporal (MIT) for code-first orchestration.",
      "blocked": true,
      "blockedReason": "n8n's pinned npm dependency tree carries fixable CVEs that upstream has not moved past, so the image cannot reach 0 fixable CVEs without diverging from n8n's own lockfile. Built and tested; held until the dependencies are updated. (n8n is also source-available under the Sustainable Use License, not OSI.)"
    },
    {
      "name": "Redpanda",
      "category": "Messaging & streaming",
      "license": "BSL-1.1",
      "licenseClean": "caution",
      "priority": "planned",
      "note": "Kafka-compatible streaming. Source-available, not OSI.",
      "cleanAlternative": "Kafka or Pulsar (Apache-2.0), both already shipped."
    },
    {
      "name": "Istio",
      "category": "Coordination & mesh",
      "license": "Apache-2.0",
      "licenseClean": "clean",
      "priority": "planned",
      "note": "Service mesh built on Envoy: traffic management, mTLS, and observability. Platform-scale, a multi-image wave (istiod control plane plus Envoy sidecars and gateways) rather than a single image."
    },
    {
      "name": "Linkerd",
      "category": "Coordination & mesh",
      "license": "Apache-2.0",
      "licenseClean": "clean",
      "priority": "planned",
      "note": "Lightweight service mesh."
    },
    {
      "name": "Consul",
      "category": "Coordination & mesh",
      "license": "BUSL-1.1",
      "licenseClean": "caution",
      "priority": "planned",
      "note": "Service discovery and mesh. Source-available, not OSI.",
      "cleanAlternative": "etcd (Apache-2.0) for KV/coordination, already shipped."
    },
    {
      "name": "Nomad",
      "category": "Coordination & mesh",
      "license": "BUSL-1.1",
      "licenseClean": "caution",
      "priority": "planned",
      "note": "Workload scheduler. Source-available, not OSI."
    },
    {
      "name": "Vitess",
      "category": "Databases & engines",
      "license": "Apache-2.0",
      "licenseClean": "clean",
      "priority": "planned",
      "note": "Horizontal sharding for MySQL."
    },
    {
      "name": "ProxySQL",
      "category": "Databases & engines",
      "license": "GPL-3.0",
      "licenseClean": "agpl",
      "priority": "planned",
      "note": "High-performance proxy for MySQL/MariaDB."
    },
    {
      "name": "SurrealDB",
      "category": "Databases & engines",
      "license": "BUSL-1.1",
      "licenseClean": "caution",
      "priority": "planned",
      "note": "Multi-model database. Source-available, not OSI."
    },
    {
      "name": "Apache Ozone",
      "category": "Storage & platform",
      "license": "Apache-2.0",
      "licenseClean": "clean",
      "priority": "planned",
      "note": "Scalable distributed object store (S3 + HDFS)."
    },
    {
      "name": "Woodpecker CI",
      "category": "Storage & platform",
      "license": "Apache-2.0",
      "licenseClean": "clean",
      "priority": "planned",
      "note": "Simple container-native CI engine."
    },
    {
      "name": "SonarQube",
      "category": "Storage & platform",
      "license": "LGPL-3.0",
      "licenseClean": "clean",
      "priority": "planned",
      "note": "Continuous code-quality and security inspection."
    },
    {
      "name": "Dokploy",
      "category": "Storage & platform",
      "license": "Apache-2.0 + DSAL-1.0",
      "licenseClean": "caution",
      "priority": "planned",
      "note": "Self-hostable PaaS on Docker Swarm. Open-core: most is Apache-2.0, the /proprietary parts are source-available (DSAL-1.0). Not a fit for the hardened catalog: it requires root, the Docker socket, and an initialized Swarm, so it cannot run nonroot or read-only.",
      "cleanAlternative": "Coolify (Apache-2.0), already shipped."
    },
    {
      "name": "Joomla",
      "category": "Apps & productivity",
      "license": "GPL-2.0-or-later",
      "licenseClean": "agpl",
      "priority": "planned",
      "note": "PHP CMS backed by MySQL or MariaDB."
    },
    {
      "name": "Matomo",
      "category": "Apps & productivity",
      "license": "GPL-3.0-only",
      "licenseClean": "agpl",
      "priority": "planned",
      "note": "Privacy-respecting web analytics platform on PHP backed by MySQL or MariaDB.",
      "blocked": true,
      "blockedReason": "Matomo's vendored PHP dependencies pin Twig below the version that fixes current CVEs, so the image cannot reach 0 fixable CVEs without diverging from Matomo's own constraints. Built and tested; held until upstream bumps the pin."
    },
    {
      "name": "Mastodon",
      "category": "Apps & productivity",
      "license": "AGPL-3.0-only",
      "licenseClean": "agpl",
      "priority": "planned",
      "note": "Federated social network server (Ruby plus Node) backed by PostgreSQL and Redis."
    },
    {
      "name": "Discourse",
      "category": "Apps & productivity",
      "license": "GPL-2.0-or-later",
      "licenseClean": "agpl",
      "priority": "planned",
      "note": "Ruby discussion and forum platform backed by PostgreSQL and Redis."
    },
    {
      "name": "Moodle",
      "category": "Apps & productivity",
      "license": "GPL-3.0-or-later",
      "licenseClean": "agpl",
      "priority": "planned",
      "note": "PHP learning management system backed by MySQL, MariaDB, or PostgreSQL."
    },
    {
      "name": "Redmine",
      "category": "Apps & productivity",
      "license": "GPL-2.0-or-later",
      "licenseClean": "agpl",
      "priority": "planned",
      "note": "Ruby on Rails project management and issue tracker backed by a relational database."
    },
    {
      "name": "Odoo",
      "category": "Apps & productivity",
      "license": "LGPL-3.0-only",
      "licenseClean": "clean",
      "priority": "planned",
      "note": "Python ERP and business apps suite (Community Edition) backed by PostgreSQL."
    },
    {
      "name": "SuiteCRM",
      "category": "Apps & productivity",
      "license": "AGPL-3.0-only",
      "licenseClean": "agpl",
      "priority": "planned",
      "note": "PHP customer relationship management application backed by MySQL or MariaDB."
    },
    {
      "name": "Appsmith",
      "category": "Apps & productivity",
      "license": "Apache-2.0",
      "licenseClean": "clean",
      "priority": "planned",
      "note": "Low-code internal-tools and admin-panel builder backed by PostgreSQL and Redis."
    },
    {
      "name": "Homepage",
      "category": "Apps & productivity",
      "license": "GPL-3.0-only",
      "licenseClean": "agpl",
      "priority": "planned",
      "note": "Self-hosted services and bookmarks dashboard with widget integrations."
    },
    {
      "name": "Gotenberg",
      "category": "Apps & productivity",
      "license": "MIT",
      "licenseClean": "clean",
      "priority": "planned",
      "note": "Stateless HTML and Office to PDF conversion API."
    },
    {
      "name": "phpMyAdmin",
      "category": "Apps & productivity",
      "license": "GPL-2.0-only",
      "licenseClean": "agpl",
      "priority": "planned",
      "note": "PHP web administration UI for MySQL and MariaDB."
    },
    {
      "name": "pgAdmin",
      "category": "Apps & productivity",
      "license": "PostgreSQL",
      "licenseClean": "clean",
      "priority": "planned",
      "note": "Web administration and management UI for PostgreSQL."
    },
    {
      "name": "Apache Superset",
      "category": "Apps & productivity",
      "license": "Apache-2.0",
      "licenseClean": "clean",
      "priority": "planned",
      "note": "Data exploration and business-intelligence dashboard platform backed by a metadata database and Redis.",
      "blocked": true,
      "blockedReason": "Superset pins `cryptography <47`, `msgpack <1.1`, and `pyarrow <19`, all below the versions that fix current HIGH CVEs, so it cannot reach 0 fixable CVEs without diverging from upstream's own dependency constraints. Built and tested; held until upstream relaxes the pins or backports the fixes."
    },
    {
      "name": "Jellyfin",
      "category": "Media & streaming",
      "license": "GPL-2.0-only",
      "licenseClean": "agpl",
      "priority": "planned",
      "note": "Self-hosted media server for movies, music, and live TV."
    },
    {
      "name": "Apache Guacamole",
      "category": "Media & streaming",
      "license": "Apache-2.0",
      "licenseClean": "clean",
      "priority": "planned",
      "note": "Clientless remote desktop gateway for RDP, VNC, and SSH over the browser."
    },
    {
      "name": "Argo CD",
      "category": "CI/CD & registry",
      "license": "Apache-2.0",
      "licenseClean": "clean",
      "priority": "planned",
      "note": "Declarative GitOps continuous delivery for Kubernetes."
    },
    {
      "name": "Concourse",
      "category": "CI/CD & registry",
      "license": "Apache-2.0",
      "licenseClean": "clean",
      "priority": "planned",
      "note": "Pipeline-based continuous integration system backed by PostgreSQL."
    },
    {
      "name": "Gitness",
      "category": "CI/CD & registry",
      "license": "Apache-2.0",
      "licenseClean": "clean",
      "priority": "planned",
      "note": "Self-hosted Git hosting with built-in pipelines from Harness.",
      "blocked": true,
      "blockedReason": "Built, but pulls `github.com/docker/docker` v28.x (CVE-2026-34040 HIGH) across its gitspace/pipeline code; the fix is only in the renamed `moby/moby` v29 module, an API-breaking migration that would fork upstream. Held until Gitness moves to moby v29."
    },
    {
      "name": "Apache NiFi",
      "category": "Workflow & data",
      "license": "Apache-2.0",
      "licenseClean": "clean",
      "priority": "planned",
      "note": "Visual dataflow automation for routing, transforming, and mediating data."
    },
    {
      "name": "Prefect",
      "category": "Workflow & data",
      "license": "Apache-2.0",
      "licenseClean": "clean",
      "priority": "planned",
      "note": "Python-native workflow orchestration server for data pipelines."
    },
    {
      "name": "Trino",
      "category": "Workflow & data",
      "license": "Apache-2.0",
      "licenseClean": "clean",
      "priority": "planned",
      "note": "Distributed SQL query engine for federated analytics across data sources."
    },
    {
      "name": "Apache Druid",
      "category": "Workflow & data",
      "license": "Apache-2.0",
      "licenseClean": "clean",
      "priority": "planned",
      "note": "Real-time analytics database for high-concurrency OLAP queries."
    },
    {
      "name": "Apache Pinot",
      "category": "Workflow & data",
      "license": "Apache-2.0",
      "licenseClean": "clean",
      "priority": "planned",
      "note": "Real-time distributed OLAP datastore for low-latency analytics."
    },
    {
      "name": "KubeRay",
      "category": "Machine learning",
      "license": "Apache-2.0",
      "licenseClean": "clean",
      "priority": "planned",
      "note": "Operator for running Ray distributed-compute clusters on Kubernetes."
    },
    {
      "name": "Open WebUI",
      "category": "Machine learning",
      "license": "BSD-3-Clause",
      "licenseClean": "clean",
      "priority": "planned",
      "note": "Self-hosted web UI for chatting with local and remote LLMs."
    },
    {
      "name": "Langflow",
      "category": "Machine learning",
      "license": "MIT",
      "licenseClean": "clean",
      "priority": "planned",
      "note": "Visual builder for LLM applications and agent workflows."
    },
    {
      "name": "Langfuse",
      "category": "Machine learning",
      "license": "MIT",
      "licenseClean": "clean",
      "priority": "planned",
      "note": "LLM observability and tracing platform backed by PostgreSQL."
    },
    {
      "name": "Label Studio",
      "category": "Machine learning",
      "license": "Apache-2.0",
      "licenseClean": "clean",
      "priority": "planned",
      "note": "Data-labeling and annotation tool for ML datasets."
    },
    {
      "name": "JupyterHub",
      "category": "Machine learning",
      "license": "BSD-3-Clause",
      "licenseClean": "clean",
      "priority": "planned",
      "note": "Multi-user Jupyter notebook server for teams and classrooms."
    },
    {
      "name": "Kibana",
      "category": "Observability",
      "license": "Elastic-2.0",
      "licenseClean": "caution",
      "priority": "planned",
      "note": "Visualization and dashboards for Elasticsearch. Default distribution is Elastic-2.0, not OSI.",
      "cleanAlternative": "OpenSearch Dashboards (Apache-2.0) over OpenSearch, both open."
    },
    {
      "name": "OpenSearch Dashboards",
      "category": "Observability",
      "license": "Apache-2.0",
      "licenseClean": "clean",
      "priority": "planned",
      "note": "Visualization and dashboards UI for OpenSearch.",
      "blocked": true,
      "blockedReason": "OpenSearch Dashboards bundles Node dependencies pinned below their CVE fixes, so the image cannot reach 0 fixable CVEs without diverging from the upstream bundle. Built and tested; held until upstream updates them."
    },
    {
      "name": "Zipkin",
      "category": "Observability",
      "license": "Apache-2.0",
      "licenseClean": "clean",
      "priority": "planned",
      "note": "Distributed tracing system for collecting and querying timing data."
    },
    {
      "name": "Grafana Alloy",
      "category": "Observability",
      "license": "Apache-2.0",
      "licenseClean": "clean",
      "priority": "planned",
      "note": "OpenTelemetry-based collector distribution for metrics, logs, traces, and profiles.",
      "blocked": true,
      "blockedReason": "Built and otherwise 0-CVE, but a transitive `github.com/docker/docker` v28.x (CVE-2026-34040 HIGH) pulled by Alloy's docker discovery has its fix only in the renamed `moby/moby` v29 module, so it can't be bumped without forking. Held until Alloy migrates to moby v29."
    },
    {
      "name": "Telegraf",
      "category": "Observability",
      "license": "MIT",
      "licenseClean": "clean",
      "priority": "planned",
      "note": "Plugin-driven metrics collection agent from the InfluxData ecosystem.",
      "blocked": true,
      "blockedReason": "Built, but a transitive `github.com/rclone/rclone` carries a CRITICAL RCE (CVE-2026-49980); the fix (rclone 1.74.3) drops an API Telegraf's remotefile plugin depends on, so bumping breaks the build. Held until Telegraf updates its rclone pin."
    },
    {
      "name": "Fluentd",
      "category": "Observability",
      "license": "Apache-2.0",
      "licenseClean": "clean",
      "priority": "planned",
      "note": "Unified logging layer for collecting, parsing, and routing logs."
    },
    {
      "name": "Logstash",
      "category": "Observability",
      "license": "Elastic-2.0",
      "licenseClean": "caution",
      "priority": "planned",
      "note": "Server-side log and event processing pipeline. Default distribution is Elastic-2.0, not OSI.",
      "cleanAlternative": "Vector (MPL-2.0) or Fluentd (Apache-2.0), both open pipelines."
    },
    {
      "name": "Zabbix",
      "category": "Observability",
      "license": "AGPL-3.0-only",
      "licenseClean": "agpl",
      "priority": "planned",
      "note": "Infrastructure and network monitoring platform; version 7 and later is AGPL-3.0."
    },
    {
      "name": "Ory Hydra",
      "category": "Secrets & identity",
      "license": "Apache-2.0",
      "licenseClean": "clean",
      "priority": "planned",
      "note": "OAuth 2.0 and OpenID Connect provider backed by a relational database.",
      "blocked": true,
      "blockedReason": "Built, but pulls `github.com/docker/docker` v28.x (CVE-2026-34040 HIGH) via ory/x's vendored dockertest helper; the fix lives only in `moby/moby` v29 and ory/x is embedded via a local replace, so it can't be bumped without forking. Held until Ory migrates ory/x to moby v29."
    },
    {
      "name": "Ory Kratos",
      "category": "Secrets & identity",
      "license": "Apache-2.0",
      "licenseClean": "clean",
      "priority": "planned",
      "note": "Identity and user-management server for login, registration, and MFA.",
      "blocked": true,
      "blockedReason": "Built, but pulls `github.com/docker/docker` v28.x (CVE-2026-34040 HIGH) via ory/x's vendored dockertest helper; the fix lives only in `moby/moby` v29 and ory/x is embedded via a local replace, so it can't be bumped without forking. Held until Ory migrates ory/x to moby v29."
    },
    {
      "name": "Sealed Secrets",
      "category": "Secrets & identity",
      "license": "Apache-2.0",
      "licenseClean": "clean",
      "priority": "planned",
      "note": "Encrypts Kubernetes Secrets so they can be stored safely in Git."
    },
    {
      "name": "SPIRE",
      "category": "Secrets & identity",
      "license": "Apache-2.0",
      "licenseClean": "clean",
      "priority": "planned",
      "note": "SPIFFE runtime for issuing workload identities across a fleet."
    },
    {
      "name": "OpenLDAP",
      "category": "Secrets & identity",
      "license": "OLDAP-2.8",
      "licenseClean": "clean",
      "priority": "planned",
      "note": "LDAP directory server for centralized authentication and user data."
    },
    {
      "name": "EJBCA",
      "category": "Secrets & identity",
      "license": "LGPL-2.1-or-later",
      "licenseClean": "clean",
      "priority": "planned",
      "note": "Enterprise PKI certificate authority (Community Edition) backed by a relational database."
    },
    {
      "name": "Pinniped",
      "category": "Secrets & identity",
      "license": "Apache-2.0",
      "licenseClean": "clean",
      "priority": "planned",
      "note": "Authentication for Kubernetes clusters federating external identity providers."
    },
    {
      "name": "Dependency-Track",
      "category": "Secrets & identity",
      "license": "Apache-2.0",
      "licenseClean": "clean",
      "priority": "planned",
      "note": "SBOM and component-vulnerability analysis platform backed by a relational database."
    },
    {
      "name": "Teleport",
      "category": "Secrets & identity",
      "license": "AGPL-3.0-only",
      "licenseClean": "agpl",
      "priority": "planned",
      "note": "Access plane providing identity-based SSH, Kubernetes, and database access. Community edition is AGPL-3.0."
    },
    {
      "name": "Contour",
      "category": "Gateways & proxies",
      "license": "Apache-2.0",
      "licenseClean": "clean",
      "priority": "planned",
      "note": "Envoy-based Kubernetes ingress controller."
    },
    {
      "name": "Varnish",
      "category": "Gateways & proxies",
      "license": "BSD-2-Clause",
      "licenseClean": "clean",
      "priority": "planned",
      "note": "HTTP caching reverse proxy and web accelerator."
    },
    {
      "name": "Squid",
      "category": "Gateways & proxies",
      "license": "GPL-2.0-or-later",
      "licenseClean": "agpl",
      "priority": "planned",
      "note": "Caching and forwarding HTTP proxy."
    },
    {
      "name": "PowerDNS",
      "category": "Coordination & mesh",
      "license": "GPL-2.0-only",
      "licenseClean": "agpl",
      "priority": "planned",
      "note": "Authoritative DNS server and recursor with database backends."
    },
    {
      "name": "Unbound",
      "category": "Coordination & mesh",
      "license": "BSD-3-Clause",
      "licenseClean": "clean",
      "priority": "planned",
      "note": "Validating, recursive, caching DNS resolver."
    },
    {
      "name": "MetalLB",
      "category": "Coordination & mesh",
      "license": "Apache-2.0",
      "licenseClean": "clean",
      "priority": "planned",
      "note": "Load-balancer implementation for bare-metal Kubernetes clusters."
    },
    {
      "name": "Cilium",
      "category": "Coordination & mesh",
      "license": "Apache-2.0",
      "licenseClean": "clean",
      "priority": "planned",
      "note": "eBPF-based networking, security, and observability for Kubernetes."
    },
    {
      "name": "Karapace",
      "category": "Messaging & streaming",
      "license": "Apache-2.0",
      "licenseClean": "clean",
      "priority": "planned",
      "note": "Open schema registry and REST proxy for Kafka; an Apache-licensed alternative to the Confluent Community schema-registry."
    },
    {
      "name": "Apache ActiveMQ",
      "category": "Messaging & streaming",
      "license": "Apache-2.0",
      "licenseClean": "clean",
      "priority": "planned",
      "note": "Java JMS message broker, including the Artemis next-generation engine."
    },
    {
      "name": "KeyDB",
      "category": "Databases & engines",
      "license": "BSD-3-Clause",
      "licenseClean": "clean",
      "priority": "planned",
      "note": "Multi-threaded Redis fork; BSD-licensed and Redis-protocol compatible."
    },
    {
      "name": "ArangoDB",
      "category": "Databases & engines",
      "license": "Apache-2.0",
      "licenseClean": "clean",
      "priority": "planned",
      "note": "Multi-model database for documents, graphs, and key-value (Community Edition)."
    },
    {
      "name": "JanusGraph",
      "category": "Databases & engines",
      "license": "Apache-2.0",
      "licenseClean": "clean",
      "priority": "planned",
      "note": "Distributed graph database over pluggable storage backends."
    },
    {
      "name": "Hasura GraphQL Engine",
      "category": "Databases & engines",
      "license": "Apache-2.0",
      "licenseClean": "clean",
      "priority": "planned",
      "note": "Instant GraphQL API over PostgreSQL and other databases."
    },
    {
      "name": "Pgpool-II",
      "category": "Databases & engines",
      "license": "BSD-3-Clause",
      "licenseClean": "clean",
      "priority": "planned",
      "note": "Connection pooling, load balancing, and replication middleware for PostgreSQL."
    },
    {
      "name": "Apache Kvrocks",
      "category": "Databases & engines",
      "license": "Apache-2.0",
      "licenseClean": "clean",
      "priority": "planned",
      "note": "Redis-protocol key-value database persisted on RocksDB."
    },
    {
      "name": "Apache Nessie",
      "category": "Databases & engines",
      "license": "Apache-2.0",
      "licenseClean": "clean",
      "priority": "planned",
      "note": "Transactional catalog and versioning for data lakehouse tables."
    },
    {
      "name": "Longhorn",
      "category": "Storage & platform",
      "license": "Apache-2.0",
      "licenseClean": "clean",
      "priority": "planned",
      "note": "Distributed block storage for Kubernetes with snapshots and backups."
    },
    {
      "name": "Kubo",
      "category": "Storage & platform",
      "license": "MIT",
      "licenseClean": "clean",
      "priority": "planned",
      "note": "Reference IPFS implementation for distributed content-addressed storage."
    },
    {
      "name": "Sigstore",
      "category": "Security & supply chain",
      "license": "Apache-2.0",
      "licenseClean": "clean",
      "priority": "planned",
      "note": "Keyless signing infrastructure including Fulcio CA and the Rekor transparency log."
    },
    {
      "name": "Falco",
      "category": "Security & supply chain",
      "license": "Apache-2.0",
      "licenseClean": "clean",
      "priority": "planned",
      "note": "Runtime security and threat detection using kernel and eBPF events."
    },
    {
      "name": "Tetragon",
      "category": "Security & supply chain",
      "license": "Apache-2.0",
      "licenseClean": "clean",
      "priority": "planned",
      "note": "eBPF-based runtime security observability and enforcement."
    },
    {
      "name": "ClamAV",
      "category": "Security & supply chain",
      "license": "GPL-2.0-only",
      "licenseClean": "agpl",
      "priority": "planned",
      "note": "Open-source antivirus engine for scanning files and mail."
    },
    {
      "name": "Wazuh",
      "category": "Security & supply chain",
      "license": "GPL-2.0-only",
      "licenseClean": "agpl",
      "priority": "planned",
      "note": "SIEM and XDR platform with manager, indexer, and dashboard components."
    },
    {
      "name": "Crossplane",
      "category": "CI/CD & registry",
      "license": "Apache-2.0",
      "licenseClean": "clean",
      "priority": "planned",
      "note": "Control-plane framework for managing cloud infrastructure via Kubernetes APIs."
    },
    {
      "name": "Flux",
      "category": "CI/CD & registry",
      "license": "Apache-2.0",
      "licenseClean": "clean",
      "priority": "planned",
      "note": "GitOps toolkit of controllers for continuous delivery on Kubernetes."
    },
    {
      "name": "Dapr",
      "category": "CI/CD & registry",
      "license": "Apache-2.0",
      "licenseClean": "clean",
      "priority": "planned",
      "note": "Distributed application runtime providing building-block APIs for microservices."
    },
    {
      "name": "Camunda",
      "category": "Workflow & data",
      "license": "Apache-2.0",
      "licenseClean": "clean",
      "priority": "planned",
      "note": "Process automation and BPMN orchestration including the Zeebe engine."
    },
    {
      "name": "Unleash",
      "category": "Workflow & data",
      "license": "Apache-2.0",
      "licenseClean": "clean",
      "priority": "planned",
      "note": "Feature-flag and toggle management server backed by PostgreSQL."
    },
    {
      "name": "secrets-stack",
      "category": "Stacks",
      "license": "Apache-2.0",
      "licenseClean": "clean",
      "priority": "planned",
      "note": "Umbrella: OpenBao + Keycloak — SSO in front of secrets management. All components built; ready to build."
    },
    {
      "name": "postgres-ha-stack",
      "category": "Stacks",
      "license": "Apache-2.0",
      "licenseClean": "clean",
      "priority": "planned",
      "note": "Umbrella: PostgreSQL + PgBouncer + postgres-exporter — pooled SQL with metrics. All components built; ready to build."
    },
    {
      "name": "cache-stack",
      "category": "Stacks",
      "license": "Apache-2.0",
      "licenseClean": "clean",
      "priority": "planned",
      "note": "Umbrella: Valkey + redis-exporter + Grafana dashboards — cache with metrics. All components built; ready to build."
    },
    {
      "name": "gitops-stack",
      "category": "Stacks",
      "license": "Apache-2.0",
      "licenseClean": "clean",
      "priority": "exploring",
      "note": "Umbrella: a pluggable Git backend + Atlantis + Terralist for Terraform/OpenTofu GitOps with a private module/provider registry. Pick your forge: Gitea (default, built) or Forgejo / Gogs (lightweight, clean) / OneDev (all-in-one) / GitLab CE (heavy, mixed license). Atlantis + Gitea charts built; needs a Terralist image, the chosen forge's image, and a runner — GitHub Actions Runner or GitLab Runner, both now on the roadmap (or run runner-less)."
    },
    {
      "name": "messaging-stack",
      "category": "Stacks",
      "license": "Apache-2.0",
      "licenseClean": "clean",
      "priority": "exploring",
      "note": "Umbrella: Kafka + ZooKeeper (or NATS) + a console UI — event backbone. Needs a Kafka UI image first — AKHQ (Apache-2.0) is now on the roadmap for exactly this."
    },
    {
      "name": "search-stack",
      "category": "Stacks",
      "license": "Apache-2.0",
      "licenseClean": "clean",
      "priority": "exploring",
      "note": "Umbrella: OpenSearch + OpenSearch Dashboards — search with a UI. Needs an opensearch-dashboards image first."
    },
    {
      "name": "Percona PMM",
      "category": "Observability",
      "license": "AGPL-3.0",
      "licenseClean": "clean",
      "priority": "planned",
      "note": "Percona Monitoring and Management — deep MySQL/PostgreSQL/MongoDB observability (query analytics) built on Prometheus, Grafana and VictoriaMetrics. AGPL, OSI-approved."
    },
    {
      "name": "temporal-stack",
      "category": "Stacks",
      "license": "Apache-2.0",
      "licenseClean": "clean",
      "priority": "exploring",
      "note": "Umbrella: Temporal + Elasticsearch for advanced visibility. Marginal — the Temporal chart already bundles its own PostgreSQL, so a stack only adds optional ES visibility search."
    },
    {
      "name": "Terralist",
      "category": "CI/CD & registry",
      "license": "MPL-2.0",
      "licenseClean": "clean",
      "priority": "planned",
      "note": "Private Terraform/OpenTofu registry for modules and providers (Go). Hardenable as a normal nonroot server image; unlocks the gitops-stack and registry-stack."
    },
    {
      "name": "Tiny RDM",
      "category": "Databases & engines",
      "license": "GPL-3.0",
      "licenseClean": "agpl",
      "priority": "exploring",
      "note": "Modern Redis/Valkey desktop GUI (Wails/Go+Vue). A desktop client, not a deployable server, so it falls outside the hardened in-cluster image model — a web Redis UI (e.g. redis-commander) would be the cache-stack UI instead."
    },
    {
      "name": "registry-stack",
      "category": "Stacks",
      "license": "Apache-2.0",
      "licenseClean": "clean",
      "priority": "exploring",
      "note": "Umbrella: Harbor (container images + OCI Helm charts + Trivy scanning) + Terralist (Terraform/OpenTofu modules & providers) — one self-hosted artifact registry for every kind of artifact. Harbor chart built; needs a Terralist image+chart."
    },
    {
      "name": "GitLab CE",
      "category": "CI/CD & registry",
      "license": "MIT",
      "licenseClean": "caution",
      "priority": "exploring",
      "note": "Full DevOps platform (Git forge + CI/CD + registry). Heavy fit: a large Ruby monolith that bundles PostgreSQL, Redis, Gitaly, Sidekiq and Workhorse, and the gitlab-org/gitlab repo is mostly EE-proprietary — only the CE-flagged code is MIT. Far from the minimal one-purpose hardened model.",
      "cleanAlternative": "Gitea or Forgejo — lightweight, fully-open Git forges that drop straight into the gitops-stack."
    },
    {
      "name": "Gogs",
      "category": "CI/CD & registry",
      "license": "MIT",
      "licenseClean": "clean",
      "priority": "planned",
      "note": "The original minimal Go Git service that Gitea forked from. Very small single-binary forge; an even lighter gitops-stack backend option."
    },
    {
      "name": "OneDev",
      "category": "CI/CD & registry",
      "license": "MIT",
      "licenseClean": "clean",
      "priority": "exploring",
      "note": "Self-hosted Git server with built-in CI/CD, issues and kanban (Java). Heavier than Gitea/Gogs but far lighter than GitLab; an all-in-one gitops-stack backend option."
    },
    {
      "name": "CloudNativePG",
      "category": "Databases & engines",
      "license": "Apache-2.0",
      "licenseClean": "clean",
      "priority": "planned",
      "note": "Kubernetes operator for PostgreSQL HA: streaming replication, automated failover, and backups/PITR to object storage, all via CRDs. CNCF project; the modern operator behind the pg-ha-stack."
    },
    {
      "name": "MariaDB Operator",
      "category": "Databases & engines",
      "license": "MIT",
      "licenseClean": "clean",
      "priority": "planned",
      "note": "Kubernetes operator for MariaDB/MySQL: provisioning, Galera multi-primary HA, replication, backups, and user/grant management via CRDs."
    },
    {
      "name": "Percona XtraDB Cluster Operator",
      "category": "Databases & engines",
      "license": "Apache-2.0",
      "licenseClean": "clean",
      "priority": "planned",
      "note": "Operator for Percona XtraDB Cluster (MySQL): synchronous multi-primary HA via Galera, with automated backups and point-in-time recovery."
    },
    {
      "name": "MongoDB Community Operator",
      "category": "Databases & engines",
      "license": "Apache-2.0",
      "licenseClean": "clean",
      "priority": "planned",
      "note": "MongoDB Community Kubernetes Operator: replica-set HA, automated failover, and TLS via CRDs. The operator is Apache-2.0; note the MongoDB server it deploys is SSPL (not OSI)."
    },
    {
      "name": "pg-ha-stack",
      "category": "Stacks",
      "license": "Apache-2.0",
      "licenseClean": "clean",
      "priority": "exploring",
      "note": "Operator-based HA PostgreSQL: CloudNativePG + PgBouncer + postgres-exporter — streaming replication, automated failover, and backups/PITR to object storage. NOTE: unlike the operator-free observability stacks, this is CRD-driven (it installs the CloudNativePG operator). Needs a CloudNativePG image first."
    },
    {
      "name": "mysql-ha-stack",
      "category": "Stacks",
      "license": "Apache-2.0",
      "licenseClean": "clean",
      "priority": "exploring",
      "note": "Operator-based HA MySQL: a MySQL operator (Percona XtraDB Cluster, or MariaDB Operator with Galera) + a metrics exporter — synchronous multi-primary replication and backups. CRD-driven. Needs the chosen operator image first."
    },
    {
      "name": "mongodb-ha-stack",
      "category": "Stacks",
      "license": "SSPL-1.0",
      "licenseClean": "caution",
      "priority": "exploring",
      "note": "Operator-based HA MongoDB: MongoDB Community Operator + a metrics exporter — replica-set failover. CRD-driven. The operator is Apache-2.0, but MongoDB itself is SSPL (not OSI), so the stack inherits that caution.",
      "cleanAlternative": "FerretDB (Apache-2.0) on the pg-ha-stack — a MongoDB-compatible, fully-open document database over PostgreSQL."
    },
    {
      "name": "MinIO",
      "category": "Storage & platform",
      "license": "AGPL-3.0",
      "licenseClean": "agpl",
      "priority": "planned",
      "note": "S3-compatible object storage; relicensed to AGPL-3.0.",
      "cleanAlternative": "SeaweedFS / Garage / RustFS (Apache-2.0), all already shipped."
    },
    {
      "name": "Versity Gateway",
      "category": "Storage & platform",
      "license": "Apache-2.0",
      "licenseClean": "clean",
      "priority": "exploring",
      "note": "S3-compatible gateway fronting any storage backend."
    },
    {
      "name": "Rook",
      "category": "Storage & platform",
      "license": "Apache-2.0",
      "licenseClean": "clean",
      "priority": "exploring",
      "note": "Ceph storage orchestrator for Kubernetes (block/object/file)."
    },
    {
      "name": "Jetty",
      "category": "Gateways & proxies",
      "license": "Apache-2.0",
      "licenseClean": "clean",
      "priority": "planned",
      "note": "Lightweight Eclipse Jetty servlet server."
    },
    {
      "name": "WildFly",
      "category": "Gateways & proxies",
      "license": "LGPL-2.1",
      "licenseClean": "clean",
      "priority": "planned",
      "note": "JBoss Jakarta EE application server."
    },
    {
      "name": "Apache TomEE",
      "category": "Gateways & proxies",
      "license": "Apache-2.0",
      "licenseClean": "clean",
      "priority": "exploring",
      "note": "Tomcat plus the Jakarta EE stack."
    },
    {
      "name": "NGINX Unit",
      "category": "Gateways & proxies",
      "license": "Apache-2.0",
      "licenseClean": "clean",
      "priority": "planned",
      "note": "Polyglot application server from the nginx team."
    },
    {
      "name": "OpenResty",
      "category": "Gateways & proxies",
      "license": "BSD-2-Clause",
      "licenseClean": "clean",
      "priority": "planned",
      "note": "nginx + LuaJIT platform for scriptable web apps and gateways."
    },
    {
      "name": "KrakenD",
      "category": "Gateways & proxies",
      "license": "Apache-2.0",
      "licenseClean": "clean",
      "priority": "planned",
      "note": "Stateless high-performance API gateway."
    },
    {
      "name": "Emissary-ingress",
      "category": "Gateways & proxies",
      "license": "Apache-2.0",
      "licenseClean": "clean",
      "priority": "exploring",
      "note": "Envoy-based Kubernetes API gateway / ingress."
    },
    {
      "name": "Kaniko",
      "category": "Security & supply chain",
      "license": "Apache-2.0",
      "licenseClean": "clean",
      "priority": "planned",
      "note": "Build container images inside Kubernetes without a daemon."
    },
    {
      "name": "BuildKit",
      "category": "Security & supply chain",
      "license": "Apache-2.0",
      "licenseClean": "clean",
      "priority": "planned",
      "note": "Concurrent container image build engine."
    },
    {
      "name": "Buildah",
      "category": "Security & supply chain",
      "license": "Apache-2.0",
      "licenseClean": "clean",
      "priority": "planned",
      "note": "Daemonless OCI image builder."
    },
    {
      "name": "Podman",
      "category": "Security & supply chain",
      "license": "Apache-2.0",
      "licenseClean": "clean",
      "priority": "planned",
      "note": "Daemonless container engine and Docker CLI replacement."
    },
    {
      "name": "Skopeo",
      "category": "Security & supply chain",
      "license": "Apache-2.0",
      "licenseClean": "clean",
      "priority": "planned",
      "note": "Inspect and copy container images between registries."
    },
    {
      "name": "Crane",
      "category": "Security & supply chain",
      "license": "Apache-2.0",
      "licenseClean": "clean",
      "priority": "planned",
      "note": "go-containerregistry CLI for registry interaction."
    },
    {
      "name": "ORAS",
      "category": "Security & supply chain",
      "license": "Apache-2.0",
      "licenseClean": "clean",
      "priority": "planned",
      "note": "Push and pull arbitrary artifacts to OCI registries."
    },
    {
      "name": "ko",
      "category": "Security & supply chain",
      "license": "Apache-2.0",
      "licenseClean": "clean",
      "priority": "exploring",
      "note": "Build and deploy Go container images with no Dockerfile."
    },
    {
      "name": "Dagger",
      "category": "Security & supply chain",
      "license": "Apache-2.0",
      "licenseClean": "clean",
      "priority": "planned",
      "note": "Programmable CI/CD engine that runs pipelines in containers."
    },
    {
      "name": "Notation",
      "category": "Security & supply chain",
      "license": "Apache-2.0",
      "licenseClean": "clean",
      "priority": "planned",
      "note": "Notary v2 OCI artifact signing and verification."
    },
    {
      "name": "Hadolint",
      "category": "Security & supply chain",
      "license": "GPL-3.0",
      "licenseClean": "agpl",
      "priority": "planned",
      "note": "Dockerfile linter."
    },
    {
      "name": "ShellCheck",
      "category": "Security & supply chain",
      "license": "GPL-3.0",
      "licenseClean": "agpl",
      "priority": "planned",
      "note": "Shell script static analysis linter."
    },
    {
      "name": "Checkov",
      "category": "Security & supply chain",
      "license": "Apache-2.0",
      "licenseClean": "clean",
      "priority": "planned",
      "note": "Static security scanning for Terraform, Kubernetes, and more."
    },
    {
      "name": "Gitleaks",
      "category": "Security & supply chain",
      "license": "MIT",
      "licenseClean": "clean",
      "priority": "planned",
      "note": "Secret scanner for git repos and files."
    },
    {
      "name": "TruffleHog",
      "category": "Security & supply chain",
      "license": "AGPL-3.0",
      "licenseClean": "agpl",
      "priority": "exploring",
      "note": "Deep secret scanner across repos and filesystems."
    },
    {
      "name": "Kubescape",
      "category": "Security & supply chain",
      "license": "Apache-2.0",
      "licenseClean": "clean",
      "priority": "planned",
      "note": "Kubernetes security, posture, and compliance scanner."
    },
    {
      "name": "Trivy Operator",
      "category": "Security & supply chain",
      "license": "Apache-2.0",
      "licenseClean": "clean",
      "priority": "planned",
      "note": "In-cluster continuous Trivy scanning via CRDs."
    },
    {
      "name": "OpenSCAP",
      "category": "Security & supply chain",
      "license": "LGPL-2.1",
      "licenseClean": "clean",
      "priority": "exploring",
      "note": "SCAP compliance and vulnerability scanning."
    },
    {
      "name": "Connaisseur",
      "category": "Security & supply chain",
      "license": "Apache-2.0",
      "licenseClean": "clean",
      "priority": "exploring",
      "note": "Admission controller enforcing image signature verification."
    },
    {
      "name": "Dive",
      "category": "Security & supply chain",
      "license": "MIT",
      "licenseClean": "clean",
      "priority": "exploring",
      "note": "Explore container image layers and wasted space."
    },
    {
      "name": "OPA Gatekeeper",
      "category": "Secrets & identity",
      "license": "Apache-2.0",
      "licenseClean": "clean",
      "priority": "planned",
      "note": "OPA policy admission controller for Kubernetes."
    },
    {
      "name": "Polaris (Fairwinds)",
      "category": "Secrets & identity",
      "license": "Apache-2.0",
      "licenseClean": "clean",
      "priority": "exploring",
      "note": "Kubernetes configuration best-practice validation."
    },
    {
      "name": "metrics-server",
      "category": "Observability",
      "license": "Apache-2.0",
      "licenseClean": "clean",
      "priority": "planned",
      "note": "Kubernetes resource-metrics API for HPA and kubectl top.",
      "blocked": true,
      "blockedReason": "Built, but a transitive `github.com/prometheus/prometheus` carries fixable CVEs whose fix (0.311.3) forces k8s v0.35 (breaking metrics-server's v0.33 apiserver lockstep) plus a textparse API change — unfixable without forking. Held until an upstream release bumps prometheus."
    },
    {
      "name": "Cluster Autoscaler",
      "category": "CI/CD & registry",
      "license": "Apache-2.0",
      "licenseClean": "clean",
      "priority": "exploring",
      "note": "Scales Kubernetes node pools to match pending workloads."
    },
    {
      "name": "Vertical Pod Autoscaler",
      "category": "CI/CD & registry",
      "license": "Apache-2.0",
      "licenseClean": "clean",
      "priority": "exploring",
      "note": "Recommends and applies pod CPU/memory requests."
    },
    {
      "name": "KubeVirt",
      "category": "CI/CD & registry",
      "license": "Apache-2.0",
      "licenseClean": "clean",
      "priority": "exploring",
      "note": "Run virtual machines as Kubernetes workloads."
    },
    {
      "name": "vcluster",
      "category": "CI/CD & registry",
      "license": "Apache-2.0",
      "licenseClean": "clean",
      "priority": "planned",
      "note": "Virtual Kubernetes clusters inside a namespace."
    },
    {
      "name": "kube-vip",
      "category": "Coordination & mesh",
      "license": "Apache-2.0",
      "licenseClean": "clean",
      "priority": "exploring",
      "note": "Virtual IP and load balancer for the control plane and services."
    },
    {
      "name": "Reloader",
      "category": "CI/CD & registry",
      "license": "Apache-2.0",
      "licenseClean": "clean",
      "priority": "exploring",
      "note": "Rolls workloads when their ConfigMaps or Secrets change."
    },
    {
      "name": "kured",
      "category": "CI/CD & registry",
      "license": "Apache-2.0",
      "licenseClean": "clean",
      "priority": "exploring",
      "note": "Safe automated node reboots for Kubernetes."
    },
    {
      "name": "OpenCost",
      "category": "Observability",
      "license": "Apache-2.0",
      "licenseClean": "clean",
      "priority": "planned",
      "note": "Kubernetes cost monitoring and allocation (CNCF)."
    },
    {
      "name": "Calico",
      "category": "Coordination & mesh",
      "license": "Apache-2.0",
      "licenseClean": "clean",
      "priority": "planned",
      "note": "eBPF/iptables CNI for networking and network policy."
    },
    {
      "name": "BIND 9",
      "category": "Coordination & mesh",
      "license": "MPL-2.0",
      "licenseClean": "clean",
      "priority": "exploring",
      "note": "Authoritative and recursive DNS server."
    },
    {
      "name": "Tailscale",
      "category": "Coordination & mesh",
      "license": "BSD-3-Clause",
      "licenseClean": "clean",
      "priority": "exploring",
      "note": "WireGuard-based mesh VPN with a Kubernetes operator."
    },
    {
      "name": "FRRouting",
      "category": "Coordination & mesh",
      "license": "GPL-2.0",
      "licenseClean": "clean",
      "priority": "exploring",
      "note": "Internet routing protocol suite (BGP, OSPF, etc.)."
    },
    {
      "name": "AKHQ",
      "category": "Messaging & streaming",
      "license": "Apache-2.0",
      "licenseClean": "clean",
      "priority": "planned",
      "note": "Web UI to manage and browse Kafka — the console the messaging-stack needs."
    },
    {
      "name": "Strimzi",
      "category": "Messaging & streaming",
      "license": "Apache-2.0",
      "licenseClean": "clean",
      "priority": "planned",
      "note": "Kubernetes operator for running and managing Kafka."
    },
    {
      "name": "Apicurio Registry",
      "category": "Messaging & streaming",
      "license": "Apache-2.0",
      "licenseClean": "clean",
      "priority": "planned",
      "note": "API and schema registry for Kafka, Avro, and Protobuf."
    },
    {
      "name": "Apache Storm",
      "category": "Messaging & streaming",
      "license": "Apache-2.0",
      "licenseClean": "clean",
      "priority": "exploring",
      "note": "Distributed real-time stream processing."
    },
    {
      "name": "RethinkDB",
      "category": "Databases & engines",
      "license": "Apache-2.0",
      "licenseClean": "clean",
      "priority": "planned",
      "note": "Realtime document database with live queries."
    },
    {
      "name": "CrateDB",
      "category": "Databases & engines",
      "license": "Apache-2.0",
      "licenseClean": "clean",
      "priority": "planned",
      "note": "Distributed SQL database for time-series and search."
    },
    {
      "name": "OrientDB",
      "category": "Databases & engines",
      "license": "Apache-2.0",
      "licenseClean": "clean",
      "priority": "exploring",
      "note": "Multi-model graph and document database."
    },
    {
      "name": "pgvector",
      "category": "Databases & engines",
      "license": "PostgreSQL",
      "licenseClean": "clean",
      "priority": "planned",
      "note": "PostgreSQL with the pgvector extension for vector similarity search."
    },
    {
      "name": "Couchbase",
      "category": "Databases & engines",
      "license": "BSL-1.1",
      "licenseClean": "caution",
      "priority": "exploring",
      "note": "Distributed document database. Source-available, not OSI.",
      "cleanAlternative": "CouchDB (Apache-2.0), already shipped."
    },
    {
      "name": "Aerospike",
      "category": "Databases & engines",
      "license": "AGPL-3.0",
      "licenseClean": "agpl",
      "priority": "exploring",
      "note": "Real-time key-value database; community edition is AGPL."
    },
    {
      "name": "Liquibase",
      "category": "Databases & engines",
      "license": "Apache-2.0",
      "licenseClean": "clean",
      "priority": "planned",
      "note": "Database schema change and migration management."
    },
    {
      "name": "Flyway",
      "category": "Databases & engines",
      "license": "Apache-2.0",
      "licenseClean": "clean",
      "priority": "planned",
      "note": "Versioned SQL database migrations."
    },
    {
      "name": "mysqld-exporter",
      "category": "Observability",
      "license": "Apache-2.0",
      "licenseClean": "clean",
      "priority": "planned",
      "note": "Prometheus exporter for MySQL/MariaDB metrics."
    },
    {
      "name": "mongodb-exporter",
      "category": "Observability",
      "license": "Apache-2.0",
      "licenseClean": "clean",
      "priority": "planned",
      "note": "Prometheus exporter for MongoDB metrics."
    },
    {
      "name": "kafka-exporter",
      "category": "Observability",
      "license": "Apache-2.0",
      "licenseClean": "clean",
      "priority": "exploring",
      "note": "Prometheus exporter for Kafka lag and topic metrics."
    },
    {
      "name": "Promtail",
      "category": "Observability",
      "license": "Apache-2.0",
      "licenseClean": "clean",
      "priority": "planned",
      "note": "Loki's agent for shipping pod and file logs."
    },
    {
      "name": "Cortex",
      "category": "Observability",
      "license": "Apache-2.0",
      "licenseClean": "clean",
      "priority": "exploring",
      "note": "Horizontally scalable, multi-tenant Prometheus storage."
    },
    {
      "name": "Netdata",
      "category": "Observability",
      "license": "GPL-3.0",
      "licenseClean": "agpl",
      "priority": "planned",
      "note": "Real-time per-second infrastructure monitoring agent."
    },
    {
      "name": "Uptime Kuma",
      "category": "Observability",
      "license": "MIT",
      "licenseClean": "clean",
      "priority": "planned",
      "note": "Self-hosted uptime and status-page monitor."
    },
    {
      "name": "KServe",
      "category": "Machine learning",
      "license": "Apache-2.0",
      "licenseClean": "clean",
      "priority": "planned",
      "note": "Kubernetes model inference serving with autoscaling."
    },
    {
      "name": "Kubeflow Pipelines",
      "category": "Machine learning",
      "license": "Apache-2.0",
      "licenseClean": "clean",
      "priority": "exploring",
      "note": "ML pipeline orchestration on Kubernetes."
    },
    {
      "name": "TensorFlow Serving",
      "category": "Machine learning",
      "license": "Apache-2.0",
      "licenseClean": "clean",
      "priority": "exploring",
      "note": "High-performance serving system for TensorFlow models."
    },
    {
      "name": "AnythingLLM",
      "category": "Machine learning",
      "license": "MIT",
      "licenseClean": "clean",
      "priority": "exploring",
      "note": "Self-hosted chat-with-your-documents LLM application."
    },
    {
      "name": "DataHub",
      "category": "Machine learning",
      "license": "Apache-2.0",
      "licenseClean": "clean",
      "priority": "exploring",
      "note": "Metadata platform and data catalog."
    },
    {
      "name": "GitLab Runner",
      "category": "CI/CD & registry",
      "license": "MIT",
      "licenseClean": "clean",
      "priority": "planned",
      "note": "CI job executor for GitLab pipelines; also a gitops-stack runner option."
    },
    {
      "name": "GitHub Actions Runner",
      "category": "CI/CD & registry",
      "license": "MIT",
      "licenseClean": "clean",
      "priority": "planned",
      "note": "Self-hosted Actions runner — the runner the gitops-stack needs for a Gitea/Forgejo backend."
    },
    {
      "name": "Argo Rollouts",
      "category": "CI/CD & registry",
      "license": "Apache-2.0",
      "licenseClean": "clean",
      "priority": "planned",
      "note": "Progressive delivery (canary, blue-green) for Kubernetes."
    },
    {
      "name": "Argo Events",
      "category": "CI/CD & registry",
      "license": "Apache-2.0",
      "licenseClean": "clean",
      "priority": "planned",
      "note": "Event-driven workflow automation for Kubernetes."
    },
    {
      "name": "MediaWiki",
      "category": "Apps & productivity",
      "license": "GPL-2.0-or-later",
      "licenseClean": "clean",
      "priority": "planned",
      "note": "The wiki engine behind Wikipedia, backed by MySQL or MariaDB."
    },
    {
      "name": "XWiki",
      "category": "Apps & productivity",
      "license": "LGPL-2.1",
      "licenseClean": "clean",
      "priority": "exploring",
      "note": "Enterprise wiki and structured collaboration platform."
    },
    {
      "name": "Rocket.Chat",
      "category": "Apps & productivity",
      "license": "MIT",
      "licenseClean": "clean",
      "priority": "planned",
      "note": "Self-hosted team chat platform backed by MongoDB."
    },
    {
      "name": "Metabase",
      "category": "Apps & productivity",
      "license": "AGPL-3.0",
      "licenseClean": "agpl",
      "priority": "planned",
      "note": "Friendly self-service BI and analytics dashboards."
    },
    {
      "name": "Grist",
      "category": "Apps & productivity",
      "license": "Apache-2.0",
      "licenseClean": "clean",
      "priority": "planned",
      "note": "Self-hosted spreadsheet-database hybrid, an Airtable alternative."
    },
    {
      "name": "Plone",
      "category": "Apps & productivity",
      "license": "GPL-2.0-or-later",
      "licenseClean": "clean",
      "priority": "exploring",
      "note": "Python enterprise CMS on Zope."
    },
    {
      "name": "Backdrop CMS",
      "category": "Apps & productivity",
      "license": "GPL-2.0-or-later",
      "licenseClean": "clean",
      "priority": "exploring",
      "note": "Drupal fork focused on simplicity, backed by MySQL."
    },
    {
      "name": "Friendica",
      "category": "Apps & productivity",
      "license": "AGPL-3.0",
      "licenseClean": "agpl",
      "priority": "exploring",
      "note": "Federated social network server."
    },
    {
      "name": "YOURLS",
      "category": "Apps & productivity",
      "license": "MIT",
      "licenseClean": "clean",
      "priority": "exploring",
      "note": "Self-hosted URL shortener."
    },
    {
      "name": "Mongo Express",
      "category": "Apps & productivity",
      "license": "MIT",
      "licenseClean": "clean",
      "priority": "exploring",
      "note": "Web administration UI for MongoDB."
    },
    {
      "name": "Apache Polaris",
      "category": "Workflow & data",
      "license": "Apache-2.0",
      "licenseClean": "clean",
      "priority": "exploring",
      "note": "Open REST catalog for Apache Iceberg tables."
    },
    {
      "name": "Apache Tika",
      "category": "Workflow & data",
      "license": "Apache-2.0",
      "licenseClean": "clean",
      "priority": "exploring",
      "note": "Content and metadata extraction toolkit."
    },
    {
      "name": "Apache Camel K",
      "category": "Workflow & data",
      "license": "Apache-2.0",
      "licenseClean": "clean",
      "priority": "exploring",
      "note": "Kubernetes-native integration framework."
    },
    {
      "name": "Cube",
      "category": "Workflow & data",
      "license": "Apache-2.0",
      "licenseClean": "clean",
      "priority": "exploring",
      "note": "Semantic layer and analytics API over your data."
    },
    {
      "name": "Ansible",
      "category": "Workflow & data",
      "license": "GPL-3.0",
      "licenseClean": "agpl",
      "priority": "planned",
      "note": "Agentless IT automation and configuration management."
    },
    {
      "name": "Terragrunt",
      "category": "CI/CD & registry",
      "license": "MIT",
      "licenseClean": "clean",
      "priority": "exploring",
      "note": "Thin Terraform/OpenTofu wrapper for DRY configurations."
    },
    {
      "name": "WireMock",
      "category": "Workflow & data",
      "license": "Apache-2.0",
      "licenseClean": "clean",
      "priority": "planned",
      "note": "HTTP API mock server for testing."
    },
    {
      "name": "Selenium Grid",
      "category": "Apps & productivity",
      "license": "Apache-2.0",
      "licenseClean": "clean",
      "priority": "exploring",
      "note": "Distributed browser automation and testing grid."
    },
    {
      "name": "Chromium",
      "category": "Apps & productivity",
      "license": "BSD-3-Clause",
      "licenseClean": "clean",
      "priority": "exploring",
      "note": "Headless browser for rendering, scraping, and PDF export."
    },
    {
      "name": "SATOSA",
      "category": "Secrets & identity",
      "license": "Apache-2.0",
      "licenseClean": "clean",
      "priority": "exploring",
      "note": "Proxy that translates between SAML and OIDC."
    },
    {
      "name": "Hyperledger Fabric",
      "category": "Workflow & data",
      "license": "Apache-2.0",
      "licenseClean": "clean",
      "priority": "exploring",
      "note": "Permissioned enterprise blockchain platform."
    },
    {
      "name": "profiling-stack",
      "category": "Stacks",
      "license": "Apache-2.0",
      "licenseClean": "clean",
      "priority": "exploring",
      "note": "Grafana Pyroscope + Grafana — continuous CPU/memory profiling; the missing 'P' that completes LGTM(P) alongside the observability/logging/tracing stacks. Needs a Pyroscope image."
    },
    {
      "name": "ai-stack",
      "category": "Stacks",
      "license": "Apache-2.0",
      "licenseClean": "clean",
      "priority": "exploring",
      "note": "Ollama (or vLLM) + Open WebUI + Qdrant — self-hosted LLM serving, a chat UI, and a vector DB for retrieval-augmented generation. Qdrant is built; needs Ollama/vLLM + Open WebUI images."
    },
    {
      "name": "pki-stack",
      "category": "Stacks",
      "license": "Apache-2.0",
      "licenseClean": "clean",
      "priority": "exploring",
      "note": "step-ca + cert-manager + trust-manager — an internal certificate authority with automated issuance and cluster-wide trust-bundle distribution. Needs those images."
    },
    {
      "name": "policy-stack",
      "category": "Stacks",
      "license": "Apache-2.0",
      "licenseClean": "clean",
      "priority": "exploring",
      "note": "Kyverno + Policy Reporter + Polaris (Fairwinds) — Kubernetes policy enforcement, violation reporting, and configuration best-practice validation. Operator-light (admission webhooks). Needs those images."
    },
    {
      "name": "backup-stack",
      "category": "Stacks",
      "license": "Apache-2.0",
      "licenseClean": "clean",
      "priority": "exploring",
      "note": "Velero + MinIO — scheduled cluster backup/restore and PV snapshots to an in-cluster S3 target. Needs Velero + MinIO images.",
      "cleanAlternative": "Use any external S3 (SeaweedFS/Garage, already shipped) instead of MinIO to keep it fully Apache-2.0."
    },
    {
      "name": "ingress-stack",
      "category": "Stacks",
      "license": "Apache-2.0",
      "licenseClean": "clean",
      "priority": "exploring",
      "note": "Traefik (or ingress-nginx) + cert-manager + external-dns — production ingress with automatic TLS and DNS records. Traefik + external-dns are built; needs cert-manager."
    },
    {
      "name": "analytics-stack",
      "category": "Stacks",
      "license": "Apache-2.0",
      "licenseClean": "clean",
      "priority": "exploring",
      "note": "Apache Superset + Trino + PostgreSQL — federated SQL analytics with self-service BI dashboards. PostgreSQL is built; needs Superset + Trino."
    },
    {
      "name": "lakehouse-stack",
      "category": "Stacks",
      "license": "Apache-2.0",
      "licenseClean": "clean",
      "priority": "exploring",
      "note": "Trino + Apache Nessie (or Polaris) + MinIO — an Iceberg data lakehouse: query engine, versioned table catalog, and object store. Needs those images."
    },
    {
      "name": "streaming-stack",
      "category": "Stacks",
      "license": "Apache-2.0",
      "licenseClean": "clean",
      "priority": "exploring",
      "note": "Kafka + Apache Flink + Apicurio Registry — end-to-end stream processing with schema governance. Kafka is built; needs Flink + Apicurio."
    },
    {
      "name": "orchestration-stack",
      "category": "Stacks",
      "license": "Apache-2.0",
      "licenseClean": "clean",
      "priority": "exploring",
      "note": "Apache Airflow + PostgreSQL + Valkey — data-pipeline scheduling (Airflow needs a metadata DB and a broker). PostgreSQL + Valkey are built; needs Airflow."
    },
    {
      "name": "runtime-security-stack",
      "category": "Stacks",
      "license": "Apache-2.0",
      "licenseClean": "clean",
      "priority": "exploring",
      "note": "Falco + Tetragon — eBPF-based runtime threat detection and enforcement. Privileged host/kernel access by design (like node-exporter). Needs those images."
    },
    {
      "name": "supply-chain-stack",
      "category": "Stacks",
      "license": "Apache-2.0",
      "licenseClean": "clean",
      "priority": "exploring",
      "note": "Trivy Operator + Kubescape + Dependency-Track — continuous image, cluster-posture, and SBOM vulnerability scanning in one place. Needs those images."
    },
    {
      "name": "cost-stack",
      "category": "Stacks",
      "license": "Apache-2.0",
      "licenseClean": "clean",
      "priority": "exploring",
      "note": "OpenCost + Prometheus + Grafana — Kubernetes cost monitoring and allocation dashboards; an add-on to the observability stack. Prometheus + Grafana are built; needs OpenCost."
    },
    {
      "name": "OpenTelemetry Operator",
      "category": "Observability",
      "license": "Apache-2.0",
      "licenseClean": "clean",
      "priority": "planned",
      "note": "Operator that manages OpenTelemetry Collector instances and auto-instrumentation."
    },
    {
      "name": "Secrets Store CSI Driver",
      "category": "Secrets & identity",
      "license": "Apache-2.0",
      "licenseClean": "clean",
      "priority": "planned",
      "note": "CSI driver that mounts secrets from external stores (Vault, cloud KMS) as volumes."
    },
    {
      "name": "Kubescape Operator",
      "category": "Security & supply chain",
      "license": "Apache-2.0",
      "licenseClean": "clean",
      "priority": "planned",
      "note": "In-cluster Kubescape components (operator, scanner, kubevuln) for continuous posture and vulnerability scanning. Distinct from the Kubescape CLI."
    },
    {
      "name": "Jenkins Inbound Agent",
      "category": "CI/CD & registry",
      "license": "MIT",
      "licenseClean": "clean",
      "priority": "planned",
      "note": "Jenkins JNLP inbound build agent. Image only, no chart. Build held: jenkins-docker-agent carries a CRITICAL jetty CVE (fix 2.560-r0 not yet in Wolfi)."
    },
    {
      "name": "OpenSearch",
      "category": "Search",
      "license": "Apache-2.0",
      "licenseClean": "clean",
      "priority": "planned",
      "note": "Search and analytics suite with a Kibana-style dashboards UI.",
      "blocked": true,
      "blockedReason": "OpenSearch 3.7.0 (newest) shades jackson-databind 2.21.3 inside the security plugin's `opensaml-3.7.0.0-all.jar` uber-jar — CVE-2026-54512..54518. Fixed jackson can't be swapped into a shaded jar; no released OpenSearch bundles it yet."
    },
    {
      "name": "Elasticsearch",
      "category": "Search",
      "license": "SSPL-1.0",
      "licenseClean": "caution",
      "priority": "planned",
      "note": "Distributed search and analytics engine.",
      "blocked": true,
      "blockedReason": "Elasticsearch 9.4.3 (newest) shades jackson inside its own `elasticsearch-x-content` core jar and `parquet-hadoop-bundle` (CVE-2026-54512..515) — 48 fixable jar CVEs, none swappable without an upstream jar rebuild."
    },
    {
      "name": "Apache Solr",
      "category": "Search",
      "license": "Apache-2.0",
      "licenseClean": "clean",
      "priority": "planned",
      "note": "Enterprise search platform built on Apache Lucene, offering full-text search, faceting, and indexing over large document collections.",
      "blocked": true,
      "blockedReason": "Solr 10.0.0 pins standalone jackson-databind 2.20.0 whose fix is only 2.21.4 (minor) / 3.x (major) — no same-major patch exists — plus CVE-2025-55163 shaded in `grpc-netty-shaded`."
    },
    {
      "name": "Neo4j",
      "category": "Graph",
      "license": "GPL-3.0-only",
      "licenseClean": "agpl",
      "priority": "planned",
      "note": "Graph database for highly connected data, queried with Cypher for traversals and relationship-heavy workloads.",
      "blocked": true,
      "blockedReason": "Neo4j 2026.05.0 (newest) shades jackson 2.21.3 inside `parquet-jackson-1.17.1.jar` (CVE-2026-54512..518); the shaded copy can't be swapped and no fixed release exists."
    },
    {
      "name": "Keycloak",
      "category": "Identity",
      "license": "Apache-2.0",
      "licenseClean": "clean",
      "priority": "planned",
      "note": "Open-source identity and access management server providing SSO, user federation, and OAuth2/OIDC and SAML for apps and APIs.",
      "blocked": true,
      "blockedReason": "Keycloak 26.6.4 pins opentelemetry-api 1.57.0 via `quarkus-opentelemetry` (CVE-2026-45292). OTel's versioning contract forbids bumping the api jar alone, and moving the whole OTel stack breaks the Quarkus platform."
    },
    {
      "name": "Graylog",
      "category": "Observability",
      "license": "SSPL-1.0",
      "licenseClean": "caution",
      "priority": "planned",
      "note": "Graylog, the log-management and analysis server (search, dashboards, alerting, GELF/Beats inputs).",
      "blocked": true,
      "blockedReason": "Graylog 7.1.4 (newest) shades jackson 2.21.2 inside its 299MB `graylog.jar` uber-jar and the opensearch storage plugin (CVE-2026-54512..518) — no standalone jar to swap."
    },
    {
      "name": "Apache Pulsar",
      "category": "Messaging",
      "license": "Apache-2.0",
      "licenseClean": "clean",
      "priority": "planned",
      "note": "Cloud-native distributed messaging and streaming platform with multi-tenancy, geo-replication, and tiered storage that separates compute from storage.",
      "blocked": true,
      "blockedReason": "Pulsar 4.2.2 shades jackson 2.18.6 inside `java-instance.jar` (CVE-2026-54512..515) and bundles jline 3.21 which needs a JLine 4 major bump."
    },
    {
      "name": "Authelia",
      "category": "Identity",
      "license": "Apache-2.0",
      "licenseClean": "clean",
      "priority": "planned",
      "note": "Open-source authentication and authorization server providing single sign-on and two-factor authentication via a web portal, designed as a companion for reverse proxies.",
      "blocked": true,
      "blockedReason": "Ships upstream's prebuilt Go binary with stale baked-in Go stdlib/deps; there is no from-source build to bump them. Unblocks when upstream ships a release rebuilt on patched toolchain/deps."
    },
    {
      "name": "CockroachDB",
      "category": "Relational",
      "license": "BUSL-1.1",
      "licenseClean": "caution",
      "priority": "planned",
      "note": "Distributed SQL database with PostgreSQL wire compatibility and automatic horizontal scaling and survivability.",
      "blocked": true,
      "blockedReason": "Prebuilt binary baked on Go stdlib 1.25.5 (24 CVEs incl. CVE-2025-68121). A go-1.25.11 rebuild would clear all of them, but CockroachDB 26.x is a Bazel-only build (custom fork + C submodules + a Node UI) that can't run in the build sandbox."
    },
    {
      "name": "Coolify Helper",
      "category": "PaaS",
      "license": "Apache-2.0 AND AGPL-3.0-or-later",
      "licenseClean": "agpl",
      "priority": "planned",
      "note": "Coolify helper image carrying the build and deploy toolchain (buildpacks, git, ssh) that runs on target hosts to execute deployments. [blocked: upstream CVEs / ES9 unsupported]",
      "blocked": true,
      "blockedReason": "Bundled Wolfi apks `docker-compose`/`docker-cli-buildx` carry CVE-2026-34040, whose fix is the `github.com/docker/docker` v28 -> `moby/moby` v29 module rename (not yet in Wolfi), plus `mc`'s x/net. Clears when Wolfi publishes the moby-v29 apks."
    },
    {
      "name": "FerretDB",
      "category": "Document",
      "license": "Apache-2.0",
      "licenseClean": "clean",
      "priority": "planned",
      "note": "MongoDB-compatible document database that translates the MongoDB wire protocol onto PostgreSQL via the DocumentDB extension.",
      "blocked": true,
      "blockedReason": "FerretDB 2.7.0 directly depends on `modelcontextprotocol/go-sdk` v0.2.0 (4 HIGH CVEs); the fix is only in v1.x (a major bump), and v1 removes the API types FerretDB's own source imports — needs an upstream migration."
    },
    {
      "name": "Floci",
      "category": "Apps & productivity",
      "license": "MIT",
      "licenseClean": "clean",
      "priority": "planned",
      "note": "Local AWS cloud emulator and LocalStack Community successor, built from source into a Quarkus fast-jar on a hardened Wolfi JRE.",
      "blocked": true,
      "blockedReason": "The Quarkus fast-jar bundles `com.squareup.wire:wire-runtime` 4.9.11 (CVE-2026-45799, HIGH), fixed only in Wire 6.x — a major bump of a transitive runtime dependency."
    },
    {
      "name": "Floci (full)",
      "category": "Apps & productivity",
      "license": "MIT",
      "licenseClean": "clean",
      "priority": "planned",
      "note": "Opt-in, NON-hardened companion to the floci image: it runs as root and expects the host Docker socket mounted, which lets it emulate all 65 of Floci's AWS services including the 10 Docker-backed ones (Lambda, RDS, ElastiCache, MSK, ECS, EKS, OpenSearch, ECR, DocumentDB, Neptune).",
      "blocked": true,
      "blockedReason": "Same blocker as floci: bundled `wire-runtime` 4.9.11 (CVE-2026-45799, HIGH) is fixed only in Wire 6.x (a major bump)."
    },
    {
      "name": "Ghost",
      "category": "Apps & productivity",
      "license": "MIT",
      "licenseClean": "clean",
      "priority": "planned",
      "note": "Open-source Node.js publishing platform for blogs, newsletters, and membership sites.",
      "blocked": true,
      "blockedReason": "Ghost 6.51.0 (newest) pins production npm deps below their CVE fixes that require MAJOR bumps (jsonwebtoken 8->9, nodemailer 8->9, `babel-traverse` package rename, knex->2, validator->13); patching them would break Ghost's own declared constraints."
    },
    {
      "name": "Grafana",
      "category": "Observability",
      "license": "AGPL-3.0-only",
      "licenseClean": "agpl",
      "priority": "planned",
      "note": "Dashboards and visualization for metrics, logs, and traces across many data sources.",
      "blocked": true,
      "blockedReason": "Ships upstream's prebuilt OSS binary (the frontend build is infeasible on a hosted runner), which bakes openfga 1.14.2 and a grafana/tempo module with fixable CVEs; 13.1.0 (newest) still carries them and there is no from-source path to bump them."
    },
    {
      "name": "Grype",
      "category": "Security & supply chain",
      "license": "Apache-2.0",
      "licenseClean": "clean",
      "priority": "planned",
      "note": "Anchore's vulnerability scanner for container images and filesystems, driven by the same SBOM engine as Syft.",
      "blocked": true,
      "blockedReason": "grype 0.115.0 directly depends on `github.com/docker/docker` v28.5.2 (CVE-2026-34040); the fix requires migrating to the renamed `moby/moby` v29 (`/v2`) import path in grype's own source.",
      "deliverable": "image"
    },
    {
      "name": "Jenkins",
      "category": "CI/CD & registry",
      "license": "MIT",
      "licenseClean": "clean",
      "priority": "planned",
      "note": "The leading open-source automation server for building, testing, and deploying software, with thousands of plugins.",
      "blocked": true,
      "blockedReason": "Jenkins LTS 2.555.3 (newest LTS) core carries CVE-2026-53441 (HIGH); the fix (2.568) ships only on the weekly channel, and `jenkins-core` is the coupled core of the war, not an independently swappable jar."
    },
    {
      "name": "Apache JMeter",
      "category": "Observability",
      "license": "Apache-2.0",
      "licenseClean": "clean",
      "priority": "planned",
      "note": "Apache JMeter load-testing and performance-measurement tool, the official binary distribution running on a hardened Wolfi JRE.",
      "blocked": true,
      "blockedReason": "JMeter 5.6.3 (newest) shades netty inside `neo4j-java-driver` and needs Apache Tika 1->2/3 (CVE-2025-66516 CRITICAL) and dnsjava 2->3 — both major bumps."
    },
    {
      "name": "Apache Kafka",
      "category": "Messaging",
      "license": "Apache-2.0",
      "licenseClean": "clean",
      "priority": "planned",
      "note": "Distributed event-streaming platform for high-throughput, durable, replayable publish-subscribe pipelines and stream processing.",
      "blocked": true,
      "blockedReason": "Apache Kafka bundles JLine 3.x; the CVE fix requires a JLine 3->4 major jar bump the release does not adopt."
    },
    {
      "name": "Mattermost",
      "category": "Messaging",
      "license": "AGPL-3.0-only",
      "licenseClean": "agpl",
      "priority": "planned",
      "note": "Open-source, self-hosted team messaging and collaboration platform (a Slack alternative) with channels, direct messages, file sharing, and integrations.",
      "blocked": true,
      "blockedReason": "Ships upstream's prebuilt Go binary (the webapp build is infeasible on a hosted runner) with stale baked-in Go stdlib/deps (x/net, x/crypto, x/image); no from-source path to bump them."
    },
    {
      "name": "Nextcloud",
      "category": "Apps & productivity",
      "license": "AGPL-3.0-only",
      "licenseClean": "agpl",
      "priority": "planned",
      "note": "Nextcloud, the self-hosted file-sync and content-collaboration platform.",
      "blocked": true,
      "blockedReason": "Nextcloud 34.0.1 (newest) ships guzzle/psr7/phpseclib/symfony/web-token inside its code-integrity-signed `3rdparty/` tree; swapping them trips Nextcloud's signature check, and the newest release still pins the vulnerable versions."
    },
    {
      "name": "Thanos",
      "category": "Observability",
      "license": "Apache-2.0",
      "licenseClean": "clean",
      "priority": "planned",
      "note": "Highly-available Prometheus setup with unlimited metric retention via object storage, adding a global query view, downsampling, and compaction across Prometheus servers.",
      "blocked": true,
      "blockedReason": "Thanos 0.41.0 (newest) vendors prometheus 0.308 (CVE-2026-42151 cluster, HIGH); the fix needs prometheus 0.311.3, which forces k8s apimachinery v0.35 and a breaking `textparse` API change."
    },
    {
      "name": "ZITADEL",
      "category": "Identity",
      "license": "AGPL-3.0-only",
      "licenseClean": "agpl",
      "priority": "planned",
      "note": "Cloud-native identity and access management (IAM) with OIDC/OAuth2/SAML, multi-tenancy, and a built-in admin console.",
      "blocked": true,
      "blockedReason": "Ships upstream's prebuilt Go binary (the Angular console build is infeasible on a hosted runner) baking gorilla/csrf, x/crypto, x/net and Go stdlib 1.25.8 — 37 CVEs; 4.15.3 (newest) still carries them."
    },
    {
      "name": "Apache ZooKeeper",
      "category": "Coordination",
      "license": "Apache-2.0",
      "licenseClean": "clean",
      "priority": "planned",
      "note": "Centralized coordination service for distributed systems, providing configuration, naming, leader election, and synchronization primitives.",
      "blocked": true,
      "blockedReason": "ZooKeeper 3.9.5 (newest 3.9 line) pins jetty-http 9.4 (needs a Jetty 12 major bump) and jline 3.25 (needs a JLine 4 major bump)."
    }
  ]
}