AI ERP with agents inside the systems you run
AI phone and voice agents for real calls
LLM.coPrivate, self-hosted LLM deployments
Legal AI infrastructure for firms
AI RFP discovery and response drafting
Automatic.coBusiness process automation
CyberAttack.aiThreat detection and defense
Secure AI virtual data roomsKey findings
Six numbers worth knowing before you adopt open source
40.9%
of open-source ERP projects are AGPL-licensed, against 3.9% of RAG frameworks. Business-application categories carry far more copyleft obligation than AI tooling.
40%
of open-source CRM projects use a copyleft or AGPL license — the highest combined share outside ERP.
82.8%
of the 3,899 repositories use a permissive license (MIT, Apache, BSD); 6.3% use the AGPL.
21.2%
of actively maintained, popular repositories have never published a tagged release — you pin a commit, not a version.
60%
of popular open-weight models are under 10 billion parameters — sizes that run on a single GPU.
69.9%
of all model downloads go to the top 10% of models. Adoption is heavily concentrated.
Licensing
Copyleft concentrates in business applications, not AI tooling
Across all 3,899 repositories, 82.8% are permissively licensed. The average hides the variation that matters: in ERP and CRM — the categories most likely to be customised and deployed as a hosted service — AGPL and copyleft licenses are common, and the AGPL's network clause can require releasing modifications to users of a hosted application.
License family by category
DevOps (13.5% AGPL) and security tooling (24% copyleft) also sit well above the average. None of this makes those projects a poor choice — it makes the license a design input. Whether an obligation applies depends on how the software is modified and distributed, which is a question for counsel before architecture is fixed, not after launch.
Languages
What popular open source is written in
Primary language, all repositories
Leading language by category
| Category | Leading language | Share |
|---|---|---|
| Databases | Go | 14.6% |
| AI Frameworks | Python | 50.8% |
| Observability | Go | 26.4% |
| DevOps | Go | 31.5% |
| Testing | TypeScript | 16.1% |
| Security | Python | 26.2% |
| MCP Servers | TypeScript | 33.5% |
| RAG Frameworks | Python | 50.5% |
| CMS | TypeScript | 28% |
| Vector Databases | Python | 31% |
| AI Coding Agents | Python | 26.9% |
| Ecommerce | PHP | 22.1% |
| CRM | PHP | 33.3% |
| ERP | Python | 27.3% |
Releases
21.2% of maintained projects have no tagged release
Every repository here was pushed to within 18 months of discovery and 77.6% within the three months before the snapshot — yet 828 of them have never published a tagged release. Adopting one means pinning a commit hash and owning the upgrade path yourself, because there is no version line to follow. The median repository in the set has 1,600 GitHub stars.
Open-weight models
Most popular models fit on one GPU, and a few take most of the downloads
Model size
Download concentration
69.9%
of 30-day downloads across 597 models went to the most-downloaded 10%. For a team choosing a model, popularity mostly signals community support, tooling, and quantised variants — not fitness for a particular task, which still has to be evaluated on your own data.
Browse the models on open-source LLMs.
Methodology
What this data is — and what it isn't
Population. This is not a census of open source. It covers projects that meet a popularity and maintenance bar, which is the set a business would realistically shortlist.
- Repositories (3,899): GitHub repositories with 300+ stars, an SPDX license, not archived or a fork, pushed within 18 months of discovery; kept if 600+ stars at the quality gate.
- Models (597): Hugging Face text-generation models under an open license, not gated, with 5,000+ downloads at discovery and 10,000+ at the quality gate.
Fields. Figures use only source metadata recorded at sync — SPDX license, GitHub primary language, stars, last push, latest release, and Hugging Face parameters and downloads. Licenses are grouped into families (permissive, copyleft, AGPL) by SPDX identifier.
Deliberately not reported. Model license mix and gating (the selection admitted only open, ungated models), repository abandonment rates (the selection excluded inactive projects), and the editorial assessments on individual project pages (those are opinions, not source data).
Snapshot. Data as recorded on July 8, 2026. Project metadata changes daily; treat figures as a point-in-time view.
Cite this report
DEV.co, “Open-Source Software Report 2026,” July 8, 2026 snapshot. https://dev.co/research/open-source-software-report
Free to reuse with attribution (CC BY 4.0).
Explore the data
Browse the projects behind the numbers
Adopting one of these in production? DEV.co is a software development company that implements, integrates, and maintains open-source software, and our AI software development services cover self-hosted models end to end.