Duplicati
Duplicati turns Hyper-V and MSSQL backups into restorable, named sources.
A side-by-side editorial comparison of Caddy and GitHub — release velocity, themes, recent moves, and the top alternatives to consider.
Caddy 2.11's betas add ECH key rotation and a release process without its founder.
Caddy's tracked entries are the two 2.11 betas from December 2025 and January 2026. Beta 1 was the first release cut by the maintainer team's automated process without the original author, and brought time-based log rolling, argon2id basic auth and named socket activation. Beta 2 added ECH key rotation, multiple intermediates in PKI signing chains and a fix for the ZeroSSL issuer.
GitHub's code scanning now finds and fixes flaws with AI, both generally available.
GitHub shipped two security GAs on October 15: agentic autofix, which explores the codebase and proposes fixes for code scanning alerts, and AI Scan for pull requests, which finds vulnerabilities in languages and frameworks CodeQL doesn't cover. They land a day after Actions workflow lockfiles entered public preview. Around them sit housekeeping moves: a Copilot model deprecation round set for November 16, a CSV export of Code Quality license usage, and the retirement of push-event email notifications.
Caddy's tracked entries are the two 2.11 betas from December 2025 and January 2026. Beta 1 was the first release cut by the maintainer team's automated process without the original author, and brought time-based log rolling, argon2id basic auth and named socket activation. Beta 2 added ECH key rotation, multiple intermediates in PKI signing chains and a fix for the ZeroSSL issuer.
Caddy is investing in privacy-preserving TLS through Encrypted ClientHello, and in project continuity through a team-run release pipeline. The rest of the betas are edge-case fixes, consistent with a mature server polishing details.
The beta notes point to a 2.11 stable release; no newer entries are tracked, so its timing isn't visible here.
GitHub shipped two security GAs on October 15: agentic autofix, which explores the codebase and proposes fixes for code scanning alerts, and AI Scan for pull requests, which finds vulnerabilities in languages and frameworks CodeQL doesn't cover. They land a day after Actions workflow lockfiles entered public preview. Around them sit housekeeping moves: a Copilot model deprecation round set for November 16, a CSV export of Code Quality license usage, and the retirement of push-event email notifications.
GitHub is turning its security stack from rule-based detection into an AI loop that both finds and repairs issues, while closing supply-chain gaps in Actions and credentials. Copilot's model roster keeps rotating, with new frontier models added within days and older ones retired on a fixed schedule. Code Quality is maturing into a separately licensed product with its own audit and billing tooling.
Expect AI Scan and autofix to appear as policies orgs can enforce, and lockfiles to move toward GA. The entries don't show how AI Scan or autofix usage is priced or metered.
Other Infra & APIs products tracked by Sparkpulse, ranked by recent ship velocity. Tap any card for the full editorial trajectory or compare directly with Caddy.
Duplicati turns Hyper-V and MSSQL backups into restorable, named sources.
Payload v4 enters beta: redesigned admin, TanStack Start support and agent instructions.
Tolgee adds task-aware filters as editor gains and billing plumbing alternate.
Cloudflare Tunnel keeps a steady release cadence, but its notes list checksums, not changes.
Skipper patches a cache() filter security advisory amid routine maintenance tags.
ToolJet's latest tags are maintenance; the AI Builder features still wait on beta.
Other Infra & APIs products tracked by Sparkpulse, ranked by recent ship velocity. Tap any card for the full editorial trajectory or compare directly with GitHub.
Weaviate pairs filtered-search research with a second security fix in two weeks.
Scalingo adds an IP-allowlist Application Firewall in front of apps.
Kubernetes turns its memory and scheduling primitives into operator playbooks.
Arrow Rust 59.3.1 ships a dozen correctness fixes to the line 60.0.0 replaced.
WeWeb redesigns its dashboard and makes AI-imported HTML editable.
CodeRabbit renames Autopilot to Autofix, staking the name on finishing PRs, not patching comments.
Latest ship moves from both products, interleaved chronologically. ⚡ = editorial spark.
They serve adjacent needs but don't currently overlap on shipped themes. GitHub is currently shipping more aggressively (velocity 10.0 vs 0.0), with 1 editorial sparks in the last 30 days against 0. See the at-a-glance table above for a side-by-side breakdown of velocity, recent sparks, and editorial themes.
Sparkpulse doesn't pick a winner — we score release velocity, not feature parity. GitHub is currently shipping more aggressively (velocity 10.0 vs 0.0), with 1 editorial sparks in the last 30 days against 0. For your specific use case, the alternatives sections above list other Infra & APIs products to evaluate alongside.
Top Caddy alternatives in Infra & APIs are ranked by recent ship velocity. Browse the "Caddy alternatives" section above for the current picks, or visit /alternatives/caddy for the full list with editorial commentary on each.
Top GitHub alternatives in Infra & APIs are ranked by recent ship velocity. Browse the "GitHub alternatives" section above for the current picks, or visit /alternatives/github for the full list with editorial commentary on each.