GitHub Trending: Today — Trivy, Paperless-ngx, Kafka, prompts.chat, Media-Downloader

GitHub Trending today reads like a list assembled by someone who has run a server before. No brand-new repo, no overnight AI launch: five mature, self-hostable workhorses, the youngest already three and a half years old.

A list with no newborns

The dates tell the story before the descriptions do. Trivy is seven years old, Paperless-ngx four, prompts.chat three and a half, media-downloader five, and Kafka almost fifteen. Not one is a new_repo_viral_burst; none arrived this year. What ties them together is the other axis: every one is something you run on your own hardware — your documents, your media, your prompts, your scanners, your event log. On a day with no hype repo to crown, Trending surfaces the durable instead of the new, and the most interesting question becomes which of these the community actually trusts.

aquasecurity/trivy — the scanner that became the payload

+21 stars today · 37k total · Go

For platform and DevSecOps teams, the pitch is one binary in CI instead of five. Point Trivy at a container image, a Git repo, a Kubernetes cluster, an IaC file or a live cloud account and it reports known CVEs, leaked secrets, misconfigurations and a full SBOM; it absorbed the old tfsec Terraform scanner, which is why a single command now covers application code and infrastructure together. That breadth is exactly what made its breach matter.

In March 2026 attackers abused a pull_request_target workflow to steal a Personal Access Token, then force-pushed malicious commits over 75 of 76 version tags on trivy-action and used that foothold to seed a self-spreading npm worm dubbed "CanisterWorm" across dozens of packages. The GitHub security advisory drew the loudest Hacker News thread the project has had in years.

"Pretty ironic that the security tool is insecure" — an HN commenter on the advisory

A more pointed reading came from someone who connected it to an earlier breach the maintainers never fully closed out:

"This attack seems predicated on a prior security incident at Trivy where they failed to successfully remediate and contain the damage… This did not happen, and the second compromise…" — an HN reader who linked the two incidents

The recurring practical advice in the thread: pin GitHub Actions to commit SHAs, not movable tags.

paperless-ngx/paperless-ngx — the archive people refuse to give up

+35 stars today · 42k total · Python

This is for home-labbers and small offices who want receipts, contracts and tax letters digitized and kept on their own hardware, not in a cloud locker. The pipeline runs OCR over every incoming PDF, full-text indexes it, auto-tags it, and serves it through a Django/Angular web UI with per-user ownership, so a household or a team can share one instance without sharing one login. It is the rare self-hosted tool people describe as genuinely set-and-forget.

"I self host a couple things, but if I had to choose only one, it'd be this… zero issues over two years. I've killed my instance twice now and had to restore from backup, which is also surprisingly pleasant to do." — a self-hoster who has rebuilt his instance from backup twice

Not everyone makes it that far. The install path is the standing complaint:

"this seems like an insane way to package an application for users to install… I'm scared off even trying to set [it] up" — a would-be user stopped by the setup guide

What is new is where it now turns up. On Bluesky, self-hosters are bolting a local LLM onto it for tagging and classification through projects like Paperless-AI, turning a plain OCR archive into a private, on-device document assistant that never phones home.

apache/kafka — the incumbent a Rust upstart is benchmarking against

+25 stars today · 33k total · Java

Kafka is for backend and data teams moving high-volume event streams: logs, metrics, change-data-capture, the plumbing under most things labelled "real-time." It is a durable, partitioned commit log with publish/subscribe on top: producers append, consumers read at their own pace, the log persists. At nearly fifteen it is the oldest repo on today's list and the default nobody is fired for picking. The interesting pressure on it is coming from Rust.

"Same pipeline, same hardware. Iggy vs Kafka… 3× throughput · ~29× lower p99.9 latency · 7× tighter end-to-end tail." — the Iggy project, a Rust competitor

Apache Iggy is an Incubator-stage streaming engine built from scratch on io_uring and a thread-per-core design, and it keeps publishing head-to-head numbers like these. Vendor benchmarks earn the usual skepticism, and Iggy's ecosystem is a rounding error next to Kafka's. But the matchup — JVM incumbent versus from-scratch Rust log — is the live argument in streaming right now, and it is why a fifteen-year-old repo is back on the daily page.

f/prompts.chat — 164,000 stars, almost no conversation

+88 stars today · 164k total · HTML

The audience is anyone assembling prompts for ChatGPT, Claude or Gemini, plus organizations that want a private, self-hosted prompt catalog. It began life as Awesome ChatGPT Prompts — a single README of copy-paste prompts — and has since grown into a Next.js app with search, collections and a vibe-coding section that turns a prompt into a small working app. Then there is the anomaly. At 164k stars it is, by a wide margin, the most-starred repo on today's list, yet it is nearly silent everywhere people actually talk: the only Hacker News submission this period is a "Show HN" with 2 points and 3 comments, and Bluesky carries little beyond bare link reposts. It is the cleanest example here of a repo people star as a bookmark rather than adopt and argue about: an awesome-list reflex, not a community.

mhogomchungu/media-downloader — a GUI so you never memorize a yt-dlp flag

+27 stars today · 4.8k total · C++

For desktop users who want yt-dlp's reach without its command line, this is a Qt/C++ front-end that wraps yt-dlp, gallery-dl, aria2c and half a dozen other downloaders behind one window with batch queues. The open issues read like a healthy one-maintainer project: a request to migrate the backend to aria2-next, a sizing bug under tiling window managers, broken Pixiv downloads. One Bluesky user named its real handicap in four words: "Most generic name ever."

What floats up on a quiet day

A trending page with no newborn repo is a different signal than one topped by the week's AI launch. What surfaces instead is the split between what people re-star out of habit and what they actually run. That gap is today's lesson in one line: prompts.chat carries eight times Trivy's star count and a fraction of its conversation, while the repo developers are genuinely wrestling with is the one whose maintainers got burned twice. On a day like this, read the comment counts, not the star counts — stars tell you what's bookmarked, threads tell you what's load-bearing.