incident.io
Nexus does the diagnosis; the rest is on-call plumbing
Comparison · Infra & APIs
Depot vs ZoneMinder
A side-by-side editorial comparison of Depot and ZoneMinder — release velocity, themes, recent moves, and the top alternatives to consider.
Depot vs ZoneMinder: at a glance
| Feature | Depot | ZoneMinder |
|---|---|---|
| Sector | Infra & APIs | Infra & APIs |
| Velocity score | 6.3 | 2.5 |
| Sparks · 30d | 1 | 0 |
| Top themes | ci-cd, build-acceleration, test-analytics, source-control | security-hardening, rbac, api-authorization, maintenance-branch |
| Last editorial update | 1d ago | 2h ago |
| Website | — | Visit → |
What is Depot?
Depot is expanding from faster builds into the whole CI stack — tests, source control, and its own metal.
Depot has spent the last month building outward from build acceleration. Test results went generally available with JUnit ingest, org-wide flaky and slow test analytics, and timing-based shard balancing. Underneath that, Depot Metal moved CI and Sandboxes onto bare-metal microVMs the company controls end to end, and Depot Code entered private beta as a diskless git server backed by blob storage. The smaller releases fill in the surrounding surface: Tailscale access to private networks, GitLab OIDC, Datadog CI Visibility, stacked pull requests, and macOS 26 runners on M4.
What is ZoneMinder?
1.38.4 is a security release in all but name, closing ACL gaps across the API.
The 1.38 line is in maintenance, and 1.38.4 is almost entirely authorization work: per-monitor access control enforced on event, frame, zone, tag and media endpoints, two auth bypasses fixed in token validation, and SQL injection and overflow hardening. The 1.36 branch still receives backports, with 1.36.38 carrying its own SQL injection fix. The last feature release was 1.38.0 in February, which brought role-based access control, WebRTC and Go2RTC streaming, and the split of monitor function into separate capturing, analysing, and recording settings.
Depot vs ZoneMinder: editorial side-by-side
Depot
6.3INFRA · APIS
Depot is expanding from faster builds into the whole CI stack — tests, source control, and its own metal.
◆ Current state
Depot has spent the last month building outward from build acceleration. Test results went generally available with JUnit ingest, org-wide flaky and slow test analytics, and timing-based shard balancing. Underneath that, Depot Metal moved CI and Sandboxes onto bare-metal microVMs the company controls end to end, and Depot Code entered private beta as a diskless git server backed by blob storage. The smaller releases fill in the surrounding surface: Tailscale access to private networks, GitLab OIDC, Datadog CI Visibility, stacked pull requests, and macOS 26 runners on M4.
◆ Where it's heading
Each layer Depot adds is one it previously rented — compute from cloud runners, source hosting from GitHub, test insight from nothing at all. Owning the storage and hypervisor tiers is what makes the performance claims possible, and owning test data is what turns a build accelerator into something that reports on the pipeline rather than just running it faster. The pattern suggests Depot is positioning as the full CI platform, with speed as the entry point rather than the product.
◆ Prediction
Depot Code should move from private to open beta with tighter Depot CI integration, since a git server the company controls is what makes source-aware caching and test selection possible. Expect the test analytics to grow toward selecting which tests to run, not only how to split them.
ZoneMinder
2.5INFRA · APIS
1.38.4 is a security release in all but name, closing ACL gaps across the API.
◆ Current state
The 1.38 line is in maintenance, and 1.38.4 is almost entirely authorization work: per-monitor access control enforced on event, frame, zone, tag and media endpoints, two auth bypasses fixed in token validation, and SQL injection and overflow hardening. The 1.36 branch still receives backports, with 1.36.38 carrying its own SQL injection fix. The last feature release was 1.38.0 in February, which brought role-based access control, WebRTC and Go2RTC streaming, and the split of monitor function into separate capturing, analysing, and recording settings.
◆ Where it's heading
Every release since 1.38.0 has been consolidation of what that release opened up. RBAC shipped as a headline feature in February, and the four maintenance drops since have been finding the endpoints it did not cover — the familiar pattern when a permission model is retrofitted onto an API that predates it. Cadence is slow and irregular, months apart, with a 1.39 spec bump already visible in the repo but nothing from that series shipped.
◆ Prediction
Expect more per-endpoint ACL fixes on the 1.38 line before anything from 1.39 reaches release.
Alternatives to Depot and ZoneMinder
Other Infra & APIs products tracked by Sparkpulse, ranked by recent ship velocity. Each card links to a full editorial trajectory and lets you pivot into a head-to-head comparison with either Depot or ZoneMinder.
werf
Four channels, one fix stream — werf's releases are mostly concurrency repairs.
Infisical
PAM and PKI now take up most of the lines in Infisical's release notes.
Biome
Biome's patch train keeps adding rules — and is quietly growing a Markdown linter.
DNSControl
DNSControl is rewriting its record internals in public, one release candidate at a time
Fission
Fission's release feed carries only RC tags, and none of them say what shipped
See all Depot alternatives → · See all ZoneMinder alternatives →
Recent activity from Depot and ZoneMinder
Latest ship moves from both products, interleaved chronologically. ⚡ = editorial spark.
- 20h agoZoneMinder1.38.4 closes API ACL gaps and two auth bypasses
- 1d agoDepotmacOS 26 is now the default macOS version for GitHub Actions runners
- 8d agoDepotDepot CI now supports native GitHub stacked pull requests
- 13d agoDepotTest results are now generally available ⚡
- 21d agoDepotAI analysis available for all Depot CI workflows and jobs
- 27d agoDepotSplit CI test suites with historical timing data (beta)
- 1mo agoDepotDepot CI now supports Tailscale
- 2mo agoZoneMinder1.38.3 supersedes 1.38.2 with RBAC and injection fixes
- 2mo agoZoneMinderchore: bump redhat spec version to 1.39.11
- 5mo agoZoneMinder1.36.38 backports a SQL injection fix to the legacy branch
- 5mo agoZoneMinder1.38.1 unifies four ONVIF control modules into one
- 6mo agoZoneMinder1.38.0 adds RBAC, WebRTC streaming, and a monitor function split ⚡
Frequently asked questions
What is the difference between Depot and ZoneMinder?
They serve adjacent needs but don't currently overlap on shipped themes. Depot is currently shipping more aggressively (velocity 6.3 vs 2.5), with 1 editorial sparks in the last 30 days against 0. See the at-a-glance table above for a side-by-side breakdown of velocity, recent sparks, and editorial themes.
Is Depot better than ZoneMinder?
Sparkpulse doesn't pick a winner — we score release velocity, not feature parity. Depot is currently shipping more aggressively (velocity 6.3 vs 2.5), with 1 editorial sparks in the last 30 days against 0. For your specific use case, the alternatives sections above list other Infra & APIs products to evaluate alongside.
What are the best alternatives to Depot?
Top Depot alternatives in Infra & APIs are ranked by recent ship velocity. Browse the "Depot alternatives" section above for the current picks, or visit /alternatives/depot for the full list with editorial commentary on each.
What are the best alternatives to ZoneMinder?
Top ZoneMinder alternatives in Infra & APIs are ranked by recent ship velocity. Browse the "ZoneMinder alternatives" section above for the current picks, or visit /alternatives/zoneminder for the full list with editorial commentary on each.