Harbor
Harbor's patch train is now mostly about undoing regressions from its own security hardening.
A side-by-side editorial comparison of Drone and GitHub — release velocity, themes, recent moves, and the top alternatives to consider.
Drone's source now ships as Harness Open Source, and it last released in August 2025.
Both tracked releases are tagged Harness Open Source from the harness/harness repo, which is where Drone's code now lives. v3.2.0 added Git LFS, PR revert, retargeting and Code Owner auto-assignment; v3.3.0 added favorite repos, tag protection rules and a fix for a Git LFS path-traversal issue. Nothing has shipped since August 2025.
GitHub is building an identity trail around agent-era code: who pushed, who prompted, who pays.
GitHub's latest releases add attribution and admin controls rather than new agent capabilities. Copilot client telemetry can now tie activity to a named user without capturing prompts or responses, a day after push attribution started recording the authenticated pusher of each commit. Alongside them come smaller enterprise fixes such as anonymous org-level Dependabot registries and centrally billed Copilot code review.
Both tracked releases are tagged Harness Open Source from the harness/harness repo, which is where Drone's code now lives. v3.2.0 added Git LFS, PR revert, retargeting and Code Owner auto-assignment; v3.3.0 added favorite repos, tag protection rules and a fix for a Git LFS path-traversal issue. Nothing has shipped since August 2025.
The product has moved from a CI engine toward a full code-hosting platform with PR workflows and branch/tag governance. The 14-month gap since v3.3.0 points to slow or paused open-source releases.
The entries give no sign of a next release; another quiet period is the base case.
GitHub's latest releases add attribution and admin controls rather than new agent capabilities. Copilot client telemetry can now tie activity to a named user without capturing prompts or responses, a day after push attribution started recording the authenticated pusher of each commit. Alongside them come smaller enterprise fixes such as anonymous org-level Dependabot registries and centrally billed Copilot code review.
The platform is layering accountability onto a workflow where more code and more activity come from agents: commit provenance, per-user Copilot usage, org billing for review, and limits on low-quality pull requests. Copilot is being packaged for organizations that need to measure and govern it, with the same settings spreading across IDEs. Code scanning keeps getting steady engine upgrades underneath.
Expect attribution data (pusher identity, per-user Copilot telemetry) to surface in audit logs, rulesets or usage reporting as these previews mature. The entries don't show whether Copilot pricing itself will change.
Other Infra & APIs products tracked by Sparkpulse, ranked by recent ship velocity. Tap any card for the full editorial trajectory or compare directly with Drone.
Harbor's patch train is now mostly about undoing regressions from its own security hardening.
Tyk is in maintenance mode on four release lines at once, with 5.16 barely stirring.
werf exposes git provenance to build commands and auto-includes Git LFS content.
Infisical puts secret changes on its global approval system and splits out secret scanning.
Airflow's feed right now is a wall of provider release candidates, not core changes.
Redocly lets docs teams define their own MCP tools, turning a docs site into an agent endpoint.
Other Infra & APIs products tracked by Sparkpulse, ranked by recent ship velocity. Tap any card for the full editorial trajectory or compare directly with GitHub.
Zed 1.23.3 is a cleanup patch, plus opt-in telemetry on agent checkpointing.
Rivet adds Hosted VMs, so agentOS sandboxes are addressable by ID over plain HTTP.
Apache Arrow Rust 60.0.0 added Parquet page index APIs; the 59.x branch is still getting fixes.
Bun now ships its own TypeScript type checker, claiming 3-6x the speed of tsc 7.
Dapr backports its service-invocation security fixes to 1.18 and steadies 1.19.
Manticore stays in hardening mode: merge fixes and a more realistic load tester.
Latest ship moves from both products, interleaved chronologically. ⚡ = editorial spark.
They serve adjacent needs but don't currently overlap on shipped themes. GitHub is currently shipping more aggressively (velocity 10.0 vs 0.0), with 0 editorial sparks in the last 30 days against 0. See the at-a-glance table above for a side-by-side breakdown of velocity, recent sparks, and editorial themes.
Sparkpulse doesn't pick a winner — we score release velocity, not feature parity. GitHub is currently shipping more aggressively (velocity 10.0 vs 0.0), with 0 editorial sparks in the last 30 days against 0. For your specific use case, the alternatives sections above list other Infra & APIs products to evaluate alongside.
Top Drone alternatives in Infra & APIs are ranked by recent ship velocity. Browse the "Drone alternatives" section above for the current picks, or visit /alternatives/drone for the full list with editorial commentary on each.
Top GitHub alternatives in Infra & APIs are ranked by recent ship velocity. Browse the "GitHub alternatives" section above for the current picks, or visit /alternatives/github for the full list with editorial commentary on each.