Sanity
Studio stops being a plugin host and starts being an SDK host.
A side-by-side editorial comparison of Echo and Manticore Search — release velocity, themes, recent moves, and the top alternatives to consider.
Echo is running two lines in lockstep, and security is what triggers releases
Echo maintains v4 and v5 in parallel and treats security parity as non-negotiable — both of the vulnerabilities in this window were fixed on v5 and backported to v4 within hours. The issues themselves are the same class twice over: values taken from request headers and paths being trusted too readily. Context.Scheme accepted malformed forwarded scheme values, and encoded path separators in static file URLs could bypass route-level middleware and disclose files.
The 29.0 line is stabilizing in public; 29.1 opens with load-tool work rather than engine work.
Manticore shipped 29.0.3 through 29.0.6 across four days after the 29.0.2 release notes consolidated the sharding work, and has now opened the 29.1 line. The patches are shaped by what 29.0 exposed: internal sort helper columns leaking into LEFT JOIN output, NEAR and proximity distances reset by repeated JSON query fixup, malformed binary-API search counts allocating before validation, and fatal binlog replay errors that failed to name the --replay-flags value an operator needs. The 29.1.0 opener is not engine work at all — it bumps the bundled manticore-load tool and gives it worker init and finalize hooks.
Echo maintains v4 and v5 in parallel and treats security parity as non-negotiable — both of the vulnerabilities in this window were fixed on v5 and backported to v4 within hours. The issues themselves are the same class twice over: values taken from request headers and paths being trusted too readily. Context.Scheme accepted malformed forwarded scheme values, and encoded path separators in static file URLs could bypass route-level middleware and disclose files.
The pattern that matters is where each vulnerability lived: both sat in code that decides what a request is, before any application logic runs, which is where a web framework's security surface actually is. Feature work is confined to v5 — an optional rate-limiter store context for response headers, core hot-path optimisation — while v4 receives security fixes only, a clean maintenance split with no ambiguity about which line is current.
Expect v5 to keep taking the middleware and performance work while v4 continues receiving same-day security backports, and further hardening around path and header parsing given that two reported issues in a row landed there.
Manticore shipped 29.0.3 through 29.0.6 across four days after the 29.0.2 release notes consolidated the sharding work, and has now opened the 29.1 line. The patches are shaped by what 29.0 exposed: internal sort helper columns leaking into LEFT JOIN output, NEAR and proximity distances reset by repeated JSON query fixup, malformed binary-API search counts allocating before validation, and fatal binlog replay errors that failed to name the --replay-flags value an operator needs. The 29.1.0 opener is not engine work at all — it bumps the bundled manticore-load tool and gives it worker init and finalize hooks.
The pattern after a major line opens is holding: the commit-level train runs at multiple releases a day while the newly exposed surfaces — sharded tables, LEFT JOIN, JSON query parsing — report their edge cases back, each fix arriving with regression coverage attached rather than accumulating into a batch. The 29.0.6 binlog change is a small tell about where the team's attention sits: improving the error text an operator reads at 3am is the kind of fix that only gets prioritised once real clusters are running the new line.
The patch cadence should keep compressing toward the ordinary rhythm as the 29.0 edge cases drain. The next substantive engine item is more likely to come from the columnar and KNN thread than from sharding, which has just had its release.
Other DevOps products tracked by Sparkpulse, ranked by recent ship velocity. Each card links to a full editorial trajectory and lets you pivot into a head-to-head comparison with either Echo or Manticore Search.
Studio stops being a plugin host and starts being an SDK host.
Three branches, one backport queue: Dapr is paying down workflow durability bugs
Security and governance controls catch up to the Copilot build-out
Tigris keeps publishing its architecture, and the newest post opens up the storage engine itself.
WeWeb is turning the apps it builds into AI products, and metering the AI as it goes.
Workato is dismantling the assumptions that tied a Genie to one chat window at a time.
See all Echo alternatives → · See all Manticore Search alternatives →
Latest ship moves from both products, interleaved chronologically. ⚡ = editorial spark.
They serve adjacent needs but don't currently overlap on shipped themes. Manticore Search is currently shipping more aggressively (velocity 6.3 vs 0.0), with 1 editorial sparks in the last 30 days against 0. See the at-a-glance table above for a side-by-side breakdown of velocity, recent sparks, and editorial themes.
Sparkpulse doesn't pick a winner — we score release velocity, not feature parity. Manticore Search is currently shipping more aggressively (velocity 6.3 vs 0.0), with 1 editorial sparks in the last 30 days against 0. For your specific use case, the alternatives sections above list other DevOps products to evaluate alongside.
Top Echo alternatives in DevOps are ranked by recent ship velocity. Browse the "Echo alternatives" section above for the current picks, or visit /alternatives/echo-framework for the full list with editorial commentary on each.
Top Manticore Search alternatives in DevOps are ranked by recent ship velocity. Browse the "Manticore Search alternatives" section above for the current picks, or visit /alternatives/manticoresearch for the full list with editorial commentary on each.