Welcome to The Weekly Five - your curated list of 5
exceptional open source projects I discovered this week.
Infrastructure foundations: Tools that power modern development environments, from bare metal to application layer
Modern software runs on layers of abstraction, but someone still has to build the foundations. This week's collection spans the full stack of infrastructure tooling: from bare-metal Kubernetes networking and embedded USB implementations to security rulesets, architecture visualization, and blazing-fast package management. These are the unsexy, essential tools that let everything else work.
Top takeaways
Bare metal still matters: Projects like MetalLB and TinyUSB prove that low-level infrastructure work remains critical, especially as cloud costs push teams toward on-premises deployments and embedded systems proliferate
Security and visualization shift left: OWASP CoreRuleSet and Archify bring enterprise-grade security rules and architecture diagramming directly into development workflows, not just production
Speed is a feature: Aube's Rust-based package manager demonstrates that developer experience improvements at the tooling layer compound across entire teams
Who this issue is for
Engineers building or maintaining infrastructure, from embedded systems developers to platform engineers running bare-metal Kubernetes clusters.
Aube
A fast Node.js package manager written in Rust.
Why this made the cut: Delivers measurable speed improvements while maintaining compatibility with existing lockfiles from pnpm, npm, Yarn, and Bun.
Why it matters
Package installation time multiplies across every developer on a team and every CI/CD run. Aube's Rust implementation with content-addressable storage deduplicates package files and parallelizes network requests more aggressively than JavaScript-based managers. The lockfile compatibility means teams can adopt it incrementally without migration risk or workflow changes.
Key features
Lockfile compatibility: Reads and writes pnpm, npm, Yarn, and Bun lockfiles without conversion
Integrated commands: Run aubr test or aubr build to install dependencies automatically before executing scripts
Content-addressable storage: Deduplicates package files across projects, saving disk space
Drop-in replacement: Works with existing package.json and node_modules structures
How to use
Install aube globally or use npx to run it in existing projects. Replace npm install with aube install, or use integrated commands like aube test or aube run build that handle installation automatically. Your existing lockfile (package-lock.json, pnpm-lock.yaml, or yarn.lock) will be read and updated without format changes. The content-addressable store builds up over time as you work with multiple projects, sharing identical package files automatically. For CI/CD, substitute aube commands in place of npm/pnpm/yarn with no other changes required.
Using with Angular
As an Angular developer, my first thought was to see if this works with Angular—and it did. Angular Repo I created a new Angular app, used aube, and everything worked well. Maybe I'll write a detailed blog on how well it performs with big workspaces.
Here is what I did to make it work with Angular:
Create a new app using aube dlx @angular/cli@latest new aube-angular
Delete the package-lock.json and run aube install
aube will create a new aube-lock.yaml
Run the build using aube run build or serve using aube start
I opened a PR to add support for aube in the Angular CLI, which was closed, but I hope the community supports built-in aube support. For now, follow the steps above.
You can upvote the Aube support issue to help decide if it's worth adding.
🔗 View on GitHub | GitHub stars: 1,981
Learning resources
Getting Started | aube - Official Documentation - Official guide showing how to install aube and run your first commands in existing projects.
MetalLB
A network load balancer implementation for Kubernetes using standard routing protocols.
Why this made the cut: The only mature solution for LoadBalancer services on bare-metal Kubernetes, filling a critical gap that cloud providers solve automatically.
Why it matters
Cloud-managed Kubernetes clusters get load balancers for free, but bare-metal deployments hit a wall when services request type LoadBalancer. MetalLB bridges this gap using standard protocols (BGP, ARP, VRRP) instead of proprietary cloud APIs, making bare-metal Kubernetes clusters production-ready for teams avoiding cloud lock-in or managing on-premises infrastructure.
Key features
Layer 2 mode (ARP/NDP): Assigns IP addresses to services and responds to ARP requests, no special hardware required
BGP mode: Integrates with network routers using Border Gateway Protocol for true load balancing across multiple nodes
FRR integration: Uses Free Range Routing for advanced BGP configurations and better protocol support
VRRP failover: Provides high availability for LoadBalancer IPs when primary nodes fail
How to use
Deploy MetalLB to your bare-metal cluster using manifests from a stable branch (not main, as main may contain unstable or non-backward compatible changes). Configure an IP address pool matching your network's available range, then choose layer 2 mode for simple setups or BGP mode if your network supports it. Services requesting type LoadBalancer will automatically receive IPs from your configured pool. For production deployments, use BGP with router peering to distribute traffic across nodes and avoid single points of failure.
🔗 View on GitHub | GitHub stars: 8,345
Archify
Agent skill for beautiful, verifiable architecture, workflow, sequence, data-flow, and lifecycle diagrams with self-contained HTML output.
Why this made the cut: Solves the architecture diagram problem with code-first generation that produces both interactive HTML and crisp exports, purpose-built for AI coding agents.
Why it matters
Architecture diagrams rot faster than code because they live in separate tools (Lucidchart, draw.io) that require manual updates. Archify treats diagrams as code artifacts that AI agents and developers can generate, verify, and version alongside implementation. The self-contained HTML output means diagrams remain interactive and viewable without external dependencies or subscription tools.
Key features
Architecture as code: Define system diagrams in structured text format that agents and developers can read and modify
Multiple diagram types: Supports architecture, workflow, sequence, data-flow, and lifecycle diagrams from a single tool
Self-contained output: Generates HTML files with embedded interactivity, no external hosting or rendering services required
Agent-friendly: Designed as a skill for Claude, DeepSeek, and other coding agents with plugin support
How to use
Define your architecture using Archify's text-based syntax, specifying components, connections, and relationships. Coding agents can generate these definitions from code analysis or requirements documents. Run the Archify tool to produce interactive HTML diagrams with zoom, pan, and animation. Export static images for documentation. Update the text definition when architecture changes and regenerate, keeping diagrams synchronized with implementation through version control.
I was able to run this inside the Angular repo using the prompt available on the website
Use Archify to turn this plain-language system description into a high-level architecture diagram: [describe the users, core components, primary path, external dependencies, and boundaries] for Angular framework. No repository is required. Ask only for missing facts that would materially change the diagram, mark any remaining unknowns instead of inventing them, and keep one obvious primary path across 8–12 core components.And here is the output: Angular Framework Architecture
Angular architectire genarated using the Achify
🔗 View on GitHub | GitHub stars: 55,437
TinyUSB
An open source cross-platform USB stack for embedded systems.
Why this made the cut: The go-to USB stack for embedded developers, supporting dozens of microcontroller families with a clean, portable API.
Why it matters
Implementing USB from scratch is notoriously complex, involving intricate state machines, timing requirements, and hardware quirks across different microcontroller families. TinyUSB abstracts this complexity into a portable stack that works across ARM Cortex-M, RISC-V, and other architectures, letting embedded developers add USB device and host functionality without becoming USB protocol experts.
Key features
Device and host support: Implement USB devices (keyboards, MIDI controllers, mass storage) or USB hosts that control peripherals
Multiple device classes: Built-in support for HID, CDC (serial), MSC (mass storage), MIDI, and WebUSB
Wide hardware support: Runs on microcontrollers from Nordic, STM32, RP2040, ESP32, and many others
RTOS-friendly: Works with FreeRTOS, RT-Thread, Mynewt, and bare-metal applications
How to use
Add TinyUSB as a submodule or library dependency to your embedded project. Initialize the stack with hardware-specific configuration (usually just clock and pin settings), then implement device class callbacks for your use case. For a USB CDC serial device, register read/write callbacks and call tinyusb task handler in your main loop. The stack handles enumeration, data transfer, and protocol details automatically.
🔗 View on GitHub | GitHub stars: 7,084
Learning resources
GNU/Linux & USB: TinyUSB is basically magic - Johannes 4GNU_Linux - Video demonstrating TinyUSB functionality on GNU/Linux systems.
OWASP CoreRuleSet
The official OWASP ModSecurity Core Rule Set, a collection of generic attack detection rules for web application firewalls.
Why this made the cut: The industry-standard open-source WAF ruleset, protecting applications from OWASP Top 10 attacks with continuously updated detection patterns.
Why it matters
Web application firewalls are only as good as their rulesets. OWASP CRS provides community-maintained, battle-tested detection rules for SQL injection, XSS, command injection, and other attacks without requiring security teams to write rules from scratch. The anomaly scoring system reduces false positives while the 2024 plugin architecture makes customization manageable for specific application needs.
Key features
OWASP Top 10 coverage: Pre-built rules detect common web vulnerabilities including injection attacks, broken authentication, and security misconfigurations
Anomaly scoring: Assigns risk scores to requests instead of blocking on single rule matches, reducing false positives
Plugin architecture: Modular system introduced in 2024 for extending rules without modifying core files
WAF compatibility: Works with ModSecurity, Coraza, and other compatible web application firewalls
How to use
Install CRS alongside your WAF (ModSecurity or Coraza). Configure anomaly score thresholds based on your risk tolerance (lower scores block more aggressively, higher scores reduce false positives). Start in detection-only mode to tune rules against your application's legitimate traffic patterns. Enable blocking mode once false positives are addressed. Use the plugin system to add custom rules for application-specific attack patterns. Monitor logs to identify attack trends and adjust scoring thresholds as needed.
🔗 View on GitHub | GitHub stars: 3,261
Learning resources
OWASP Core Ruleset - Coraza.io - Tutorial on integrating OWASP CRS with the Coraza WAF using configuration files and Go code.
OWASP Core Rule Set: What It Is and How It Works - VergeCloud - Explains CRS anomaly scoring, the 2024 plugin architecture, and how to pair it with WAFs.
If you only try one
Try Aube if you want immediate, measurable impact this week. Installation takes under a minute, it works with your existing projects and lockfiles without migration, and faster package installs compound across every developer and build. The other tools solve critical but specialized problems (bare-metal load balancing, embedded USB, WAF rules, architecture diagrams), but slow package managers tax every Node.js developer daily. Shaving seconds or minutes off installations adds up to hours saved across a team, making it the highest-leverage starting point in this collection.
If you are doing Open Source I have a good news for you, I work at CodeRabbit which is an AI review tool and its free for Open Source, please reach out to me on X or LinkedIn or just send an email on [email protected] if you need help on adopting CodeRabbit.
You can visit our portal below to create a new account and connect your repository and start reviewing your code.
