Flame
Self-hosted dashboard that finished its feature arc and stopped shipping in 2023.
A side-by-side editorial comparison of AFFiNE and CommaFeed — release velocity, themes, recent moves, and the top alternatives to consider.
Behind a wall of bot-authored dependency bumps, AFFiNE quietly built bring-your-own-key AI.
The public release train is dominated by automated Renovate commits — CI action upgrades, and security bumps to Electron and mermaid patching a spoofable code-sign check and a chart denial-of-service. The substantive work is intermittent and lands on canary builds: workspace-level BYOK profiles with provider and model catalogs, capability validation, connection probing and credential rotation, alongside Copilot routing options, selectable targets and managed tiers. Storage work has also landed, standardizing presigned URLs across S3 and Cloudflare R2.
A self-hosted RSS reader that now spends most of its release notes on security.
CommaFeed is a self-hosted Google Reader replacement that has spent the 6.x-to-7.x stretch rebuilding its trust boundaries rather than its feature list. SSRF protection has been tightened in four consecutive releases, feed parsing now strips javascript: URLs before they reach the database, and OPML imports are filtered against import-time abuse. The 7.x line pairs that with client interop: Fever API, ReadKit compatibility, and now the Google Reader API.
The public release train is dominated by automated Renovate commits — CI action upgrades, and security bumps to Electron and mermaid patching a spoofable code-sign check and a chart denial-of-service. The substantive work is intermittent and lands on canary builds: workspace-level BYOK profiles with provider and model catalogs, capability validation, connection probing and credential rotation, alongside Copilot routing options, selectable targets and managed tiers. Storage work has also landed, standardizing presigned URLs across S3 and Cloudflare R2.
AFFiNE is making its AI layer a customer-configured component rather than a bundled service. BYOK profiles with rotation, leases and capability checks are the plumbing a self-hosted or privacy-sensitive deployment needs to point the editor at its own models, and the removal of legacy provider-specific configuration says the older bundled path is being retired rather than extended. The parallel storage work points the same way: make every external dependency the operator's choice.
Expect the BYOK and Copilot routing surface to graduate off canary into a stable release with configuration documentation, and further consolidation of the legacy provider paths now being converged. The dependency-bump noise will continue to obscure it — read the feat commits, not the version numbers.
CommaFeed is a self-hosted Google Reader replacement that has spent the 6.x-to-7.x stretch rebuilding its trust boundaries rather than its feature list. SSRF protection has been tightened in four consecutive releases, feed parsing now strips javascript: URLs before they reach the database, and OPML imports are filtered against import-time abuse. The 7.x line pairs that with client interop: Fever API, ReadKit compatibility, and now the Google Reader API.
The project is positioning itself as a sync backend other people's apps talk to, not just a web reader. Each release adds another protocol or client fix while hardening the assumption that an instance may be publicly exposed with untrusted users on it. The 7.0.0 swap from JEXL to sandboxed CEL and the 7.3.0 flip of blockLocalAddresses to a secure default both trade self-hoster convenience for a safer out-of-the-box posture.
Expect continued client-protocol coverage and further SSRF narrowing; the recurring pattern in these entries is that every new fetch path gets a follow-up hardening release.
Other Collab products tracked by Sparkpulse, ranked by recent ship velocity. Each card links to a full editorial trajectory and lets you pivot into a head-to-head comparison with either AFFiNE or CommaFeed.
Self-hosted dashboard that finished its feature arc and stopped shipping in 2023.
SiYuan's v3.8.0 train restates one AI feature set across seven consecutive builds.
Jellyfin renumbers to 12.0 and spends the whole cycle paying down its backend rewrite.
Teable is spending its release budget making bring-your-own-database failures survivable.
NetNewsWire rebuilt Feedly sync to stop getting its own users rate-limited.
Happeo's feed is a buyer-education funnel, not a changelog — no shipped work is visible.
See all AFFiNE alternatives → · See all CommaFeed alternatives →
Latest ship moves from both products, interleaved chronologically. ⚡ = editorial spark.
They serve adjacent needs but don't currently overlap on shipped themes. AFFiNE is currently shipping more aggressively (velocity 7.5 vs 5.0), with 1 editorial sparks in the last 30 days against 0. See the at-a-glance table above for a side-by-side breakdown of velocity, recent sparks, and editorial themes.
Sparkpulse doesn't pick a winner — we score release velocity, not feature parity. AFFiNE is currently shipping more aggressively (velocity 7.5 vs 5.0), with 1 editorial sparks in the last 30 days against 0. For your specific use case, the alternatives sections above list other Collab products to evaluate alongside.
Top AFFiNE alternatives in Collab are ranked by recent ship velocity. Browse the "AFFiNE alternatives" section above for the current picks, or visit /alternatives/affine for the full list with editorial commentary on each.
Top CommaFeed alternatives in Collab are ranked by recent ship velocity. Browse the "CommaFeed alternatives" section above for the current picks, or visit /alternatives/commafeed for the full list with editorial commentary on each.