May 2026 Summaries

Open source software maintainers and users are bracing for a challenging period as advancements in automated code scanning, powered by large language models (LLMs), are expected to uncover numerous security vulnerabilities in public source code. This trend, noted by platforms like Metabase, has already resulted in a significant increase in security submissions, many of which are legitimate and require immediate attention. The rise of LLM-powered scanning tools has led to a competitive market for SaaS offerings that bulk scan open-source repositories and alert companies of potential issues, pushing open-source projects into a reactive stance where they must address vulnerabilities promptly. While this shift promises long-term improvements in software security, it imposes immediate pressures on maintainers to fix vulnerabilities swiftly. As a result, some commercial operations may opt to go closed source to manage security challenges more effectively. Users of open-source software are advised to prepare for frequent updates and adopt robust security practices, such as defense-in-depth and observability, to mitigate risks. Despite the short-term challenges, the ongoing evolution in code scanning is set to enhance the overall security landscape for both existing and future software.

Metabase recently hosted an AI Hackathon to highlight their AI features going open source, with submissions showcasing innovative uses of their platform. The winners included "Meta Chess" by Marat Surmashev, which utilized Metabase to create an interactive chess game platform where AI agents play against each other, demonstrating the platform's flexibility in employing features like the MCP server and file-based development. Another winning project, "Claude's Advice" by Owais Mumtaz, leveraged Metabase to provide personalized fitness insights through a nightly task that analyzes fitness data and offers actionable advice, illustrating the practical application of Metabase's capabilities in personal data management. Both projects exemplified unique and practical uses of Metabase's features, with the winners receiving mechanical keyboards as prizes. The event encouraged participants to explore AI in Metabase and emphasized that innovative projects can be built without the need for a hackathon.

The author shares their experience optimizing the Clojure language server (clojure-lsp) to improve performance when dealing with large codebases, specifically in the context of the Metabase project. Initially, clojure-lsp's startup time was significantly long, attributed to inefficient heap usage and frequent garbage collection. By increasing the heap size and employing tools like VisualVM and clj-async-profiler, the author identified several inefficiencies within clojure-lsp, particularly related to the clj-kondo library. Key optimizations included refining the deep-merge function, improving the rewrite-clj library, and enhancing Clojure's memoization method by reducing unnecessary allocations. These efforts resulted in a substantial reduction in execution time and memory allocation, leading to a two-fold improvement in performance. The optimizations have been merged into clojure-lsp and verified by its maintainer, Eric Dallo, though further improvements are anticipated to continue enhancing the tool's efficiency for large-scale projects.