Jackett
Jackett ships daily, and every release is tracker definitions chasing sites that moved
Comparison · Infra & APIs
Dashy vs mod_auth_openidc
A side-by-side editorial comparison of Dashy and mod_auth_openidc — release velocity, themes, recent moves, and the top alternatives to consider.
Dashy vs mod_auth_openidc: at a glance
What is Dashy?
After the 4.5.0 drag-and-drop release, Dashy has settled into translations and dependency patches
Dashy's 4.5.0 release was the substantive one — drag-and-drop editing of sections, items and widgets, a rebuilt GitHub stats widget on the official API, and richer number formatting in the custom-api widget. Everything since has been a single-PR patch release: two community translation contributions, three dependency bump batches, an out-of-memory fix from unclosed connection listeners, and OIDC post-logout redirect support. The tail is quiet by design rather than stalled.
What is mod_auth_openidc?
mod_auth_openidc audited itself, found eight holes, and broke every session on the way out
The Apache OIDC module is in the middle of the most consequential ten days in this window: 2.4.20 on August 1 rebuilt session and cookie encryption around PBKDF2-HMAC-SHA256 key stretching and invalidated every existing session, 2.4.20.1 on August 9 disclosed eight security issues found in an internal audit, and 2.4.20.2 the next morning walked back part of the fallout. The audit findings are not peripheral — the most serious lets a client inject headers that a protected backend trusts as authenticated identity claims on paths the module answers without authenticating. The 2.4.19.x line before it had already shipped an out-of-bounds read and write in the state-cookie parser.
Dashy vs mod_auth_openidc: editorial side-by-side
Dashy
6.3INFRA · APIS
After the 4.5.0 drag-and-drop release, Dashy has settled into translations and dependency patches
◆ Current state
Dashy's 4.5.0 release was the substantive one — drag-and-drop editing of sections, items and widgets, a rebuilt GitHub stats widget on the official API, and richer number formatting in the custom-api widget. Everything since has been a single-PR patch release: two community translation contributions, three dependency bump batches, an out-of-memory fix from unclosed connection listeners, and OIDC post-logout redirect support. The tail is quiet by design rather than stalled.
◆ Where it's heading
The project is in the consolidation phase that follows a feature release, shipping one PR per version at a steady clip. Two threads still show forward motion: authentication is being rounded out, with OIDC post-logout redirects following the logout redirect option added in 4.5.0, and translation coverage is being filled in by contributors rather than maintainers. The widget system remains where the feature energy goes when it returns.
◆ Prediction
Expect the single-PR patch cadence to continue until enough widget or editing work accumulates for a 4.6 line. The OIDC additions suggest self-hosted single sign-on is the area most likely to see the next real feature.
mod_auth_openidc
6.3INFRA · APIS
mod_auth_openidc audited itself, found eight holes, and broke every session on the way out
◆ Current state
The Apache OIDC module is in the middle of the most consequential ten days in this window: 2.4.20 on August 1 rebuilt session and cookie encryption around PBKDF2-HMAC-SHA256 key stretching and invalidated every existing session, 2.4.20.1 on August 9 disclosed eight security issues found in an internal audit, and 2.4.20.2 the next morning walked back part of the fallout. The audit findings are not peripheral — the most serious lets a client inject headers that a protected backend trusts as authenticated identity claims on paths the module answers without authenticating. The 2.4.19.x line before it had already shipped an out-of-bounds read and write in the state-cookie parser.
◆ Where it's heading
The project has shifted from feature work to hardening its own attack surface, and it is doing so on its own initiative rather than in response to external reports. That posture has a cost operators are absorbing directly: two backwards-incompatible session format changes in six months, both of which log every user out on upgrade. The 2.4.20.2 release also shows the hardening overshooting and being corrected — unconditional secret masking made debugging impossible, so an opt-in escape hatch was added with a startup warning attached, and a derived-object cache tier added only weeks earlier was removed outright.
◆ Prediction
Expect the 2.4.20.x line to keep absorbing follow-up fixes from the same audit, and any further hardening to arrive with an explicit opt-out after the masking reversal showed operators cannot troubleshoot a protocol exchange they cannot read.
Alternatives to Dashy and mod_auth_openidc
Other Infra & APIs products tracked by Sparkpulse, ranked by recent ship velocity. Each card links to a full editorial trajectory and lets you pivot into a head-to-head comparison with either Dashy or mod_auth_openidc.
Quay
Quay ships nothing but CVE remediation, mirrored across two supported branches
Unleash
Feature flags repositioned as the runtime kill switch for AI agents writing your code.
Kubernetes
The blog has become a teaching channel, with the real releases arriving as Gateway API and deprecation notices.
ToolJet
ToolJet runs two release trains at once, and neither has changed direction in months
Honeycomb
Honeycomb bets that the agent, not the engineer, should notice the anomaly first
See all Dashy alternatives → · See all mod_auth_openidc alternatives →
Recent activity from Dashy and mod_auth_openidc
Latest ship moves from both products, interleaved chronologically. ⚡ = editorial spark.
- 1d agoDashyTraditional Chinese UI translations completed
- 2d agomod_auth_openidcOIDCDebugMaskSecrets reopens debug logs, cache tier removed
- 2d agomod_auth_openidcInternal audit turns up eight security issues, including an identity-header bypass ⚡
- 4d agoDashyNine grouped dependency updates
- 6d agoDashySingle dependency bump for fast-uri
- 9d agoDashyMissing German translations added
- 10d agomod_auth_openidcPBKDF2 key stretching invalidates all existing sessions
- 11d agoDashyOut-of-memory crash from unclosed secureConnect listeners fixed
- 11d agoDashyTwo grouped dependency updates
- 1mo agomod_auth_openidcOut-of-bounds read and write fixed in the state-cookie parser
- 2mo agomod_auth_openidcFixes core dumps under threaded MPM startup load
- 5mo agomod_auth_openidcFixes claims-based authorization regression in OAuth RS mode
Frequently asked questions
What is the difference between Dashy and mod_auth_openidc?
They serve adjacent needs but don't currently overlap on shipped themes. Dashy and mod_auth_openidc are shipping at a similar cadence (velocity 6.3 vs 6.3, both within Sparkpulse's "active" band). See the at-a-glance table above for a side-by-side breakdown of velocity, recent sparks, and editorial themes.
Is Dashy better than mod_auth_openidc?
Sparkpulse doesn't pick a winner — we score release velocity, not feature parity. Dashy and mod_auth_openidc are shipping at a similar cadence (velocity 6.3 vs 6.3, both within Sparkpulse's "active" band). For your specific use case, the alternatives sections above list other Infra & APIs products to evaluate alongside.
What are the best alternatives to Dashy?
Top Dashy alternatives in Infra & APIs are ranked by recent ship velocity. Browse the "Dashy alternatives" section above for the current picks, or visit /alternatives/dashy for the full list with editorial commentary on each.
What are the best alternatives to mod_auth_openidc?
Top mod_auth_openidc alternatives in Infra & APIs are ranked by recent ship velocity. Browse the "mod_auth_openidc alternatives" section above for the current picks, or visit /alternatives/mod-auth-openidc for the full list with editorial commentary on each.