Open Source Chronicle

Preface | 2025: A Turning Year from Scale Expansion to Institutionalized Open Source

2025 is widely regarded as an important watershed for the global open source cause.

This year, open source has clearly shifted from the growth logic dominated by "scale expansion" over the past decade or so to a new stage centered on "high-quality governance" and "deep AI integration". Open source is no longer just a way of technical collaboration, but plays the role of institutional infrastructure in AI competition, digital sovereignty games, business model restructuring and community governance systems. Around this shift, a series of key events with long-term impact erupted intensively in 2025.

First, in the field of artificial intelligence, open source completed a paradigm shift.

AI technology characterized by large models fully entered a new stage of "open source dominance" in 2025, and the technology path long controlled by closed-source giants was substantively broken. New-generation open source models represented by DeepSeek, through dual innovation in technology routes and cost structures, changed the industry's blind faith in the "Scale Law" of large models. Its R1 model proved that relying solely on reinforcement learning, a model with top-level reasoning capability can be trained at extremely low cost, triggering widespread global discussion about "model equality". The subsequent math and theorem-proving models further consolidated its technological influence.

At the same time, 2025 was also called the "Year One of Agents" by the industry. Moving from general large models to executable-task Agent systems became a key direction of AI evolution. Domestic and foreign vendors successively launched computer and web automation agents for real usage scenarios, globally popular AI Coding agents appeared in the programming field, and breakthroughs in omni-modal models made real-time collaboration of speech, vision and text a reality. This series of progress marks that open source AI is no longer just "sharing of model weights", but has begun to dominate complete product forms and interaction paradigms.

More noteworthy is that the regional structure of global open source AI forces is also changing. Multiple statistics show that the share of open source models developed by China in global downloads exceeded that of the United States for the first time, with projects such as Qwen and DeepSeek becoming major contributors, and open source AI beginning to present a more multipolar development pattern.

Second is the value leap of open source at the level of international politics and global governance. In 2025, open source was no longer just a tool for technical cooperation, but was formally incorporated into national strategies and international governance frameworks. At the second "United Nations Open Source Week" held mid-year, the UN explicitly regarded open source as an important pillar of Digital Public Infrastructure (DPI), and the Apache Software Foundation also publicly stated it would support the institutional implementation of related principles.

At the regional level, Europe closely binds open source with technological sovereignty, regarding it as an important institutional tool for enhancing long-term competitiveness. Switzerland's release of a national-level open source model covering more than a thousand languages is a typical manifestation of this trend. At the same time, the geopolitical game between China and the US in AI and open source continued to intensify. On the one hand, legislative moves emerged at the US congressional level to restrict domestic users from using some Chinese open source technologies; on the other hand, China proactively shaped the discourse space of open collaboration by issuing international cooperation initiatives and co-building open source communities with ASEAN. Open source is becoming a key strategic means in the technology diplomacy game of the digital era.

Third, China's open source ecosystem completed a structural leap in 2025. This year, China was no longer just an important participant in the global open source system, but gradually formed a complete ecosystem closed loop of "incubation—growth—graduation". Multiple foundational software projects moved from foundation hosting to mature autonomy, and the formal graduation of OpenHarmony and openEuler was widely regarded as an important sign that China's foundational software ecosystem had entered a new stage.

In terms of scale, the number of Chinese open source developers and active projects continues to lead globally, forming a huge and diverse community base. At the same time, the global developer landscape is also being reshaped, with India surpassing the United States for the first time in total developers, showing that open source contributions are spreading to a broader range of developing economies.

However, beneath the prosperity, governance and trust crises were also exposed intensively. In 2025, multiple events triggered deep global reflection on the sustainability of open source. At the licensing level, Redis chose to return to the OSI-recognized AGPLv3 license, trying to repair its trust relationship with the community while guarding against cloud vendors' "free-riding".

At the infrastructure level, Ingress NGINX, long maintained by volunteers, announced the termination of its maintenance plan due to exhausted manpower and funding, impacting a large number of production systems globally. This event clearly revealed the structural risk of "critical infrastructure lacking stable investment".

The tension between commercial companies and open source communities also intensified. The controversy surrounding KubeSphere was widely regarded as a case of undermining the open source lifecycle and community contract. In addition, security attacks and privacy leakage incidents targeting AI systems themselves continue to remind the industry: when open source and AI are deeply combined, security and trust issues will be magnified many times over.

Overall, the open source world in 2025 underwent dramatic plate reshaping. If the global open source ecosystem is viewed as a shared technological ecosystem, then this year's AI open source wave was nothing less than a violent "orogeny" — it rapidly reshaped the technology landscape, giving small and medium developers and emerging organizations the opportunity to stand on the high ground of capability. But at the same time, the problems of neglected infrastructure, broken trust and absent governance, like growing cracks, remind us that crises are everywhere.

Governments of various countries intervened through legislation and policies, trying to build institutional guardrails for this digital commons. Open source is transforming from the idealistic practice of geek culture into the foundational infrastructure of modern digital civilization — solid and critical, but in greater need than ever of careful governance and long-term care.

Chapter 1 | Open Source AI: Model Capabilities, Agents and the Realization of "Model Equality"

In 2025, the open source AI field experienced explosive growth, with the technology paradigm shifting from pure parameter competition to deep reasoning, omni-modal perception and autonomous agents. China's open source AI forces performed particularly strongly, gradually occupying an internationally leading position in downloads and model quality.

The following is a summary of open source AI news in 2025:

1.1 The Paradigm Shift of Reasoning Models: From Parameter Competition to Reinforcement Learning

At the beginning of 2025, the release of DeepSeek-R1 attracted global attention, proving that reasoning models trained based on pure reinforcement learning (RL) can significantly reduce costs and improve logical capabilities.

The DeepSeek series: DeepSeek-R1 and the R1-Zero version not only performed excellently in mathematics and code, but are fully open source and offer highly competitive API prices. Subsequently, DeepSeek continued to iterate, launching DeepSeekMath-V2, whose performance rivals the gold-medal level of the mathematical Olympiad, and DeepSeek-Prover-V2, specializing in theorem proving.

Whole-industry follow-up: Alibaba open-sourced the QwQ-32B reasoning model with performance comparable to much larger models; Xiaomi open-sourced the lightweight model Xiaomi MiMo-V2-Flash, which surpasses larger models in math and code reasoning; Ant Group open-sourced the trillion-parameter thinking model Ring-1T.

Reasoning paradigm innovation: StepFun launched the parallel collaborative reasoning framework PaCoRe, and Huawei improved inference speed by 80% through FlashComm technology.

1.2 From Multimodal to Omni-modal

Large models are no longer limited to text and images, but are comprehensively evolving toward audio, video, 3D and real-time multimodal interaction.

Omni-modal base models: Alibaba open-sourced the world's first end-to-end omni-modal large model Qwen2.5-Omni-7B, as well as the subsequent more powerful Qwen3-Omni, supporting real-time streaming text and speech output. Kunlun Wanwei and Ant Group also successively released and open-sourced their own omni-modal fusion models.

Vision and video: Alibaba Cloud open-sourced the Tongyi Wanxiang Wan2.2 film-level video generation model; ByteDance open-sourced the video framework ATI supporting user hand-drawn trajectory control; Tencent open-sourced the industrial-grade image generation model Hunyuan Image 3.0.

3D and audio: Tencent Hunyuan open-sourced the art-grade 3D generation model Hunyuan3D-PolyGen; Bilibili open-sourced its self-developed speech generation model IndexTTS-2.0; Mistral released the first enterprise-grade open source audio model Voxtral.

1.3 Agents Become the Core Product Form

2025 is regarded as the "Year One of Agents", and open source AI is moving from the "dialogue box" toward the "operating system".

Desktop and mobile automation: Zhipu released the world's first computer agent GLM-PC that works with a press of the Enter key, and AutoGLM supporting mobile phone automation; Microsoft open-sourced the browser task agent Magentic-UI.

Development frameworks: 01.AI joined with Open Source China to launch the Open Agent Kit platform to lower development barriers; the University of Glasgow released EvoAgentX, the world's first self-evolving framework for AI agents.

Programming assistants: GitHub Copilot launched the Agent mode, marking the move from code completion toward autonomous programming agents; Moonshot AI open-sourced Kimi-Dev-72B, which has the ability to autonomously repair codebases.

1.4 High-quality Open Source AI in Vertical Fields

Open source AI demonstrates deep practical value in professional scenarios:

Medical and scientific: Ruijin Hospital and Huawei jointly open-sourced the clinical-grade pathology model RuiPath; Westlake University open-sourced the fully automated AI scientist system DeepScientist; the Shanghai AI for Science Institute open-sourced Aneumo, the world's first large-scale computational fluid dynamics database for aneurysms.

Vertical industry: Tsinghua University open-sourced the structured data large model LimiX; the State Key Laboratory of Marine Precision Sensing Technology of Zhejiang University released OceanGPT, the first open source model in the marine field.

Embodied intelligence: Agibot open-sourced GO-1, the general-purpose embodied base large model; Xiaomi open-sourced MiMo-Embodied, which connects autonomous driving with embodied intelligence.

Intelligent vehicles: these can be divided into the "model supply side" and the "industry adoption side"

Model supply side: automakers and the vehicle industry participate in open source models and embodied bases. Geely and StepFun jointly open-sourced Step-Video-T2V and Step-Audio, explaining their uses in autonomous driving data synthesis and cockpit interaction; Xiaomi open-sourced the cross-embodiment base model MiMo-Embodied (connecting intelligent driving and robots); XPeng open-sourced the second-generation VLA (for global commercial partners).

Industry adoption side: open source large models are spreading at scale in cockpits/on-device. More than 20 automakers integrated DeepSeek, with three types of integration paths: direct integration / multi-model collaboration / deep fusion distillation training; multiple cockpits integrated Qwen, with the engineering path of "underlying multi-model fusion + distillation collaboration" emerging; the MiniCPM on-device cockpit assistant emphasizes "purely local, usable on weak networks, millisecond-level response", serving as a typical example of "productizing on-device open source models".

Summary

The open source AI of 2025 was like a spring rain of "technology popularization". If early open source AI only provided an observable "black box", then the open source wave of 2025 directly moved "the precision instruments of the laboratory" onto developers' desktops. From DeepSeek's reconstruction of training costs, to Qwen's comprehensive multimodal coverage, to the deep involvement of various Agents in productivity, open source AI is making advanced productivity as accessible as air and water, and customizable on demand.

Chapter 2 | Foundational Open Source Technology: Operating Systems, Languages and Computing Power Bases

In 2025, the open source technology and infrastructure field welcomed significant modernization and architectural innovation. The main trends include the continued deepening of system kernels and operating systems, the rise of AI-native infrastructure, cross-platform optimization of development toolchains, and the pursuit of system security and efficiency.

2.1 Evolution of Operating Systems, Kernels and Underlying Architectures

The Linux kernel and mainstream distributions continue to evolve in performance and architecture support, while the domestic operating system ecosystem is moving toward maturity.

Linux kernel updates and architecture evolution:

Stable release: Linux 6.18 was officially released, introducing important new features such as AccECN congestion control protocol support, BPF program signing, memory management improvements based on sheaves, the Rust-written binder driver and namespace file handle management. The previously released Linux 6.13 introduced a new "lazy preemption" model to balance scheduling flexibility and performance, and supported fine-grained file timestamps.

Memory management optimization: the kernel continues to optimize the memory subsystem, including improving the hugetlb page table traversal mechanism, merging anonymous virtual memory areas (VMAs) to improve performance, and improving the efficiency of the Slab allocator through the sheaves cache layer. In addition, new patches are being developed to support hot page migration between NUMA nodes and dedicated memory management for accelerators.

New architecture support: developers successfully ported the Linux kernel to the WebAssembly (Wasm) platform, opening new paths for edge computing and sandboxed applications. At the same time, the ARM architecture completed further integration of the PREEMPT_RT real-time patches, enhancing Linux's capabilities in real-time control scenarios.

Security and Rust rewriting: the community has set off a wave of rewriting key components with Rust. Ubuntu 25.10 plans to replace the traditional sudo with the Rust-written sudo-rs, and Debian's APT tool also announced Rust dependency requirements. In addition, the uutils project has completed Rust rewrites of more than 100 core commands of GNU Coreutils.

Domestic operating systems mature: OpenHarmony officially graduated smoothly from incubation in November 2025, marking the entry of China's foundational software ecosystem into a mature stage. The OpenHarmony 6.0 Release version enhanced multiple core capabilities such as ArkUI components, window management and distributed data management. In the automotive field, Li Auto (Li Auto Star Ring OS), Dongfeng Motor (Tianyuan OS middleware) and Prima (the Star Program) successively promoted the open sourcing of vehicle operating systems, helping industry standardization.

2.2 Modernization of Programming Languages, Toolchains and Development Environments

The popularity of AI is driving the intelligence of development tools and the memory safety of underlying languages.

Language popularity changes: Python set an all-time high share of 25.35% on the TIOBE index, while Perl returned to the top ten after many years. Java also welcomed the important moment of its 30th anniversary, actively integrating into the AI era through projects such as Project Loom.

Self-developed languages: Huawei officially open-sourced Cangjie, an all-scenario intelligent programming language. The AI-native language MoonBit released a beta official version, with its compiler open-sourced and moving toward version 1.0, demonstrating extremely high performance in the WebAssembly field.

High-performance full-stack platform: Bun 1.3 was officially released, evolving from a runtime into a fully featured full-stack development platform, with native HTML running support, a built-in database client and a high-performance Redis client, as well as enhanced Monorepo management and supply chain security features.

Cross-platform and cloud-native development: Tencent open-sourced the cross-platform development framework Kuikly based on Kotlin Multiplatform technology (supporting iOS 26 new features), as well as ovCompose/KuiklyBase, solving the compatibility problems of Compose Multiplatform on HarmonyOS and iOS. ByteDance also open-sourced the cross-platform front-end framework Lynx based on the Rust toolchain, supporting unified development across four platforms.

AI-native toolchains: Huawei announced the full open sourcing of the CANN and Mind series toolchains to promote the openness of the Ascend ecosystem. Tsinghua University open-sourced the "Chitu" inference engine, achieving native operation of FP8 precision models on domestic chips for the first time.

Quantum and scientific computing: China Mobile open-sourced the "Wuyue Era" quantum computing operating system; Sugon released the one-stop scientific large model development platform OneScience.

2.3 Innovation in Data Infrastructure and Middleware

Driven by AI and cloud-native demands, data storage, stream processing and network protocols welcomed key upgrades.

Cloud-native and data streams: the Apache Kafka 4.0.0 release candidate was published, and the community is promoting documentation migration and a proposal for a new virtual cluster architecture. OpenTeleDB, the world's first carrier-grade open source database, was officially released by Tianyi Cloud, focusing on high-concurrency, high-reliability communication scenarios. PostgreSQL 18 and MySQL 9.3 were also released successively, continuously optimizing SQL performance and extensibility.

AI-native data foundation: Ant Group open-sourced the first AI database seekdb. The new converged database EloqConvergedDB fuses relational, KV, document and vector data capabilities into a single engine to simplify the AI application development stack.

Networking and communication: the Linux kernel began integrating QUIC protocol infrastructure, aiming to improve the efficiency of modern network services. Intel open-sourced the Tofino P4 network switch compiler components, providing an innovative platform for high-performance network switching technology.

2.4 Hardware, Tools and Application Upgrades

From general applications to professional operations tools, open source software continues to iterate, focusing on security and user experience.

Hardware and high-performance computing support: Moore Threads announced that its GPUs fully support the open source ecosystem, having developed 300 high-performance operators and gradually open-sourcing them. Hygon's DCU completed adaptation for the DeepSeek-V3 and R1 models. Sugon launched the open source scientific large model development platform OneScience.

Development tools and IDEs: IntelliJ IDEA continuously fixed issues such as Docker Engine, WSL compatibility and Gradle synchronization in multiple 2025 versions (2025.2.2, 2025.2.5). DBeaver 25.3 enhanced fixes and optimizations for the SQL editor.

Professional software upgrades: the open source 3D modeling software Blender 5.0 was officially released, bringing a completely redesigned color management system and enhanced support for the Vulkan rendering backend. The open source e-book management tool Calibre 8.0 added a more advanced text-to-speech engine and audio overlay features.

Security and operations tools: the Apache Software Foundation (ASF) launched the first "ASF Tools Initiative", focusing on building key toolchains that support reproducible builds and generate SBOMs (Software Bill of Materials) to meet increasingly strict legislative security requirements. In the operations field, the 1Panel open source panel added Ollama model management and GPU monitoring features to improve the operations efficiency of AI developers.

2.5 Vehicle Operating System Open Sourcing: From Projects to Community Bases

Dongfeng open-sourced "Tianyuan OS", becoming the first open source project of the AUTOSEMO community; subsequently, source code and cross-domain middleware were gradually released.

Li Auto proposed and open-sourced "Star Ring OS" by components (vehicle control, intelligent driving, communication middleware, virtualization, etc.), and established a steering committee to promote ecosystem collaboration.

Summary

In short, open source technology infrastructure is embracing the needs of the AI era at an unprecedented speed, building a safer, more efficient and more open digital foundation through innovations in underlying systems (such as the Linux kernel and OpenHarmony), new programming languages (Rust/MoonBit) and high-performance data flow and computing architectures (such as OpenTeleDB and AI supercomputing networks). This trend reflects the evolution of the open source ecosystem from simple code sharing toward the openness and collaboration of full-stack technology resources.

Chapter 3 | Open Source Community Ecosystem: Prosperity, Transformation and the Sustainability Crisis

In 2025, the "open source community ecosystem" presented a complex pattern of shifting global contribution centers of gravity, active governance institutional reforms, and severe sustainability challenges. The following is a comprehensive summary of related news for the year:

3.1 Structural Changes in the Global Contribution Landscape

In 2025, the geographic distribution of open source contributions underwent a historic shift.

The rise of India: according to the GitHub Octoverse 2025 report, India surpassed the United States for the first time to become the world's largest base of open source contributors, with more than 5.2 million new developers in 2025. On the first anniversary of the Linux Foundation India (LF India), six new sub-foundations were added, driving India's transformation from an open source "user" to an "influencer".

Strategic adjustments in Europe and Japan: according to the "2025 European Open Source World Report", open source adoption is widespread in Europe, with an operating system adoption rate of 64%, and more than 90% of organizations obtaining sustained or increased value from open source, but senior leadership's awareness of its strategic value still lags; Europe is committed to enhancing digital sovereignty through open source. At the same time, 69% of Japanese organizations improved their business value through open source, far above the global average, but their OSPO (Open Source Program Office) establishment rate still needs improvement.

3.2 Governance Institutional Reforms and Compliance Responses

Major foundations are responding to growing legislative and technological demands through organizational adjustments and new initiatives.

Apache Software Foundation (ASF): in 2025, the ASF completed the leadership transition, appointing a new Chairman and Vice Chairmen, and launched the first "ASF Tools Initiative", aiming to improve project secure delivery capabilities to address compliance requirements such as the EU Cyber Resilience Act (CRA). In addition, multiple projects such as Gravitino and StormCrawler successfully graduated from the incubator to become top-level projects.

Linux Foundation (LF): Google joined with the LF to launch the "neutral" Chromium development fund, attracting giants such as Meta and Microsoft to join, to ensure the neutral governance of the Chromium ecosystem.

Rust Foundation: established an "Innovation Lab" to provide financial hosting and operational support for Rust projects with commercial potential, promoting the long-term stability of the ecosystem.

3.3 The Quality Leap of China's Open Source Ecosystem

China's open source community is transforming from scale expansion toward deep industrial implementation.

Landmark project graduation: the 2025 OpenAtom Developer Conference announced that OpenHarmony and openEuler officially graduated, marking the entry of China's foundational software ecosystem into a mature stage. As of mid-2025, the total number of HarmonyOS ecosystem devices exceeded 1.19 billion.

Regional ecosystem linkage: Suzhou landed the first provincial-level open source community in China, the "OpenAtom Zijin Special Zone"; Chongqing released the country's first open source community for embodied intelligence robots; Wuhan publicized annual excellent open source projects including OpenHIS.

Developer scale: the OpenAtom Foundation disclosed that as of the end of 2024, China had 2.27 million active open source developers and more than 3 million active projects.

3.4 Organized Automotive Open Source Communities: Operating System Communities + Compliance/Standards Collaboration

The AUTOSEMO community: centered on the vehicle OS base of the "centralized + regional control" EE architecture, it covers virtualization, kernels, standard middleware, cross-domain middleware and toolchains/standards systems from the bottom up, and releases interfaces and standards in stages.

EasyXMen "Star Program" (Kaiyuan Xiaoman): oriented toward production-vehicle OS collaborative innovation and application enablement, reflecting the industry demand of moving "from usable to dare-to-use".

OpenSDV: participates in compliance working groups, group standards, closed-door seminars, forums and blue book writing, reflecting the composite form of "community = collaboration + standards + compliance".

3.5 Ecological Crisis and Sustainability Warnings

Despite prosperity, the open source model also encountered severe tests in maintenance and trust.

Infrastructure crisis: the Ingress NGINX controller project, which had been running for several years, was announced by the Kubernetes community to be terminated in 2026 due to long-term lack of manpower and funding support, causing confusion among thousands of users. In addition, experts warned that open source projects' excessive reliance on proprietary infrastructure such as GitHub carries the risk of "repeating the same mistake".

Commercial–open source conflict: the KubeSphere closed-source and repository-deletion incident triggered strong reactions from the global community, which said it undermined the open source trust system and violated the OSI open source standards.

Security compliance challenges: research shows that open source communities are unevenly prepared for the EU CRA act, and urgently need to shift from mere compliance to community co-built security practices.

Summary

Overall, the open source community ecosystem has always presented a mixed picture of joys and sorrows. The foundation of this tropical rainforest — long-term maintenance and the trust system — remains fragile. If an effective "nutrient return" mechanism (i.e., substantive rewards from enterprises to open source maintainers) cannot be established, no matter how lush the forest surface appears, it may face the risk of collapse due to the withering of core infrastructure.

Chapter 4 | Open Source Software Security: Supply Chains, Attacks and Institutional Responses

In 2025, news in the open source software security field reflected the deep involvement of AI technology, the evolution of supply chain security paradigms, and cyber confrontation under an intense geopolitical background. The following is a comprehensive summary of related news for the year:

4.1 The "Double-edged Sword" of the AI Era: Defense Strengthening and Privacy Leakage

In 2025, AI was both a sharp tool for improving security capabilities and a new source of risk.

The explosion of security models and frameworks: the industry released multiple open source tools specifically for improving AI security, such as Meta's LlamaFirewall (addressing prompt injection and insecure code generation), Meta-SecAlign-70B jointly open-sourced by Meta and UCB (with defense capabilities exceeding mainstream closed-source models), and Oyster-I jointly released by Alibaba and universities (advocating a new paradigm of "proactively guided security"). JD.com also open-sourced the JoySafety framework, building a four-layer protection system from training data to content recognition.

Automated auditing tools: Anthropic open-sourced Claude Code Security Reviewer and Petri, promoting the evolution of security assessment from manual to scaled, automated. OpenSSF released Model Signing v1.0, providing a digital signature standard for machine learning models to prevent tampering.

Major privacy and security incidents: despite technological progress, a report at the end of 2025 noted that GitHub Copilot leaked the contents of more than 20,000 private repositories, involving giants such as Google and Huawei. In addition, the DeepSeek iOS app was found to transmit data in plaintext, drawing attention to the basic network security practices of open source AI applications.

4.2 Deepening of Supply Chain Security: From SBOM to Reproducible Builds

Software supply chain security has moved from theory to the dual drive of practical combat and legislation.

Global collaboration on SBOM: CISA, NSA and 19 other international partners released the "SBOM Cybersecurity Common Vision", defining SBOM as the "ingredient list" of software. The EU Cyber Resilience Act (CRA) further strengthened SBOM's status as a legal requirement.

Reproducible Builds: Fedora plans to achieve reproducible builds for 99% of software packages, to verify the consistency between binary packages and source code. Google launched the OSS Rebuild project, verifying package integrity through the rebuild process to guard against "poisoning".

Governance tools and platforms: new open source tools such as Heisenberg (a supply chain health check tool) and VulnRisk (a context-aware vulnerability risk assessment platform) emerged.

4.3 High-risk Vulnerabilities and Attack Landscape

2025 witnessed multiple record-breaking attack events and widely influential system vulnerabilities.

DeepSeek suffered extreme DDoS attacks: in January 2025, DeepSeek's servers experienced the strongest attack in history with a peak of 230 million requests per second, defended collaboratively by multiple cloud vendors.

Critical infrastructure vulnerabilities: four high-risk vulnerabilities collectively known as "IngressNightmare" in Kubernetes environments were disclosed, affecting more than 40% of cloud environments globally. React was found to have new vulnerabilities causing source code leakage and DoS attacks. In addition, Node.js, WSL and the iOS system all fixed significant security vulnerabilities.

Repository pollution and poisoning: the npm repository suffered a large-scale "token farming" attack, with more than 150,000 malicious packages planted. The Shai-Hulud v2 attack campaign spread from npm to Maven, exposing thousands of API keys and credentials.

4.4 Security Governance Responses of Foundations and International Organizations

Open source foundations and local policies are building a more resilient security ecosystem.

Foundation developments: the Apache security team continuously tracked more than a hundred security issues in 2025, and fully deployed Content Security Policies (CSP) to protect privacy. OpenSSF deeply discussed the "OSPS Baseline" as a shared security checklist.

International policy directions: the 2025 EU Open Source Policy Summit called for open source to be regarded as a public good, and explored establishing an EU-supported long-term maintenance fund to address the security risks caused by insufficient funding for foundational projects.

Industry patents and standards: institutions such as the China Academy of Railway Sciences applied for patents on open source software risk handling, and companies such as Anshi Technology cooperated with foundations to promote software security from passive protection toward proactive governance.

Summary

Open source software security in 2025 is undergoing a paradigm shift from "patching vulnerabilities" to "full-lifecycle immunity". If the open source ecosystem is compared to a globally shared water supply system, then the news of 2025 tells us: although water quality testing tools (such as AI security large models and auditing tools) have become unprecedentedly advanced, large-scale poisoning of the water source (such as npm poisoning) and powerful attacks on the water tower (such as DDoS attacks) remain rampant. The current governance approach is no longer just detecting impurities, but also ensuring that this water of life remains transparent and trustworthy in the complex pipeline network flowing to thousands of households — by attaching "digital labels" to every drop of water (SBOM and digital signatures), and establishing more transparent filtration standards (reproducible builds and security baselines).

Chapter 5 | Open Source Business: From Technological Advantage to Value Realization

In 2025, the "open source business" field made significant progress in capital operations, commercial implementation of large models, business model innovation and compliance sustainability. Based on the provided sources, the following is a comprehensive summary of open source business news for the year:

5.1 The Cost Revolution of Open Source Large Models

In 2025, open source large models not only kept pace with closed-source models technologically, but also showed huge advantages in commercial application and deployment costs.

Full integration by cloud vendors: at the beginning of 2025, mainstream cloud platforms at home and abroad including Huawei Cloud, Alibaba Cloud, Tencent Cloud, Microsoft, Amazon and NVIDIA successively integrated the DeepSeek-V3 and R1 models, forming a broad support pattern.

Deployment costs dropped significantly: by August 2025, the cost of deploying open source large models had significantly decreased. For example, running DeepSeek R1 on Fireworks AI costs only $8 per million tokens, far lower than the $75 of closed-source models, greatly promoting the popularization of enterprise-level private deployment.

Market penetration expectations: international research firm Frost & Sullivan expects that more than 80% of enterprises will adopt open source large models in the future, with their invocation volume soaring 363% year-on-year in the first half of 2025.

5.2 Financing, IPOs and Capital Structure Changes

The capital market showed extremely high enthusiasm for the open source and AI ecosystem, with financing scales frequently setting records.

Epic financing: OpenAI completed the largest single-round financing in history in March 2025 ($40 billion), with a post-investment valuation of $300 billion. In addition, the open source infrastructure platform Together AI completed a $305 million Series B financing.

IPO progress: Zhipu, one of the "Six AI Dragons", planned to complete its listing guidance in October 2025. The GPU chip company MetaX (Muxi) officially listed on the STAR Market in December 2025, and committed to continuing to promote the open sourcing of its MXMACA software stack.

Talent and service investment: the remote development platform Turing completed a $110 million Series E financing, with a valuation of $2.2 billion, consolidating its position in the AI-driven talent matching field.

5.3 Evolution of Business Models: PLG and Pay-as-you-go

Open source commercialization is no longer limited to traditional subscription models, with more diverse and efficient paths emerging.

The victory of the PLG model: the AI code assistant Cursor achieved $1 billion ARR without an enterprise sales team, relying on its open source strategy and product-led growth (PLG) model.

Flexible billing: GitHub Copilot launched the Pro+ subscription plan, exploring a new billing model based on the number of model requests.

Full-stack ecosystem: Open Source China (Gitee) built a full-stack commercialization closed loop covering "model-data-computing power-application", and its "Yuandun Trusted Central Repository" aims to safeguard software supply chain security.

5.4 Industrial Collaboration and Regional Ecosystem Building

All parties are building a better business environment through establishing funds and strengthening international collaboration.

Special funds and forums: Shanghai unveiled the country's first special fund for enterprise digital service open source. At the same time, the "Open Source + Digital Economy" forum held at the Bund explored the supporting role of open source in cross-border payments and joint construction of technical standards.

Industry leaders: Alibaba was named an "Open Source AI Leader" by Time magazine for its global influence in AI+cloud strategy and open source contributions.

Vertical applications: Quectel collaborated with RWKV to promote lightweight on-device AI implementation; Tian Tian Open Source released the OpenHIS and OpenCOM series management software for healthcare and enterprises.

5.5 Compliance, Security and Sustainability Challenges

Behind the prosperity, open source business also faces tests of law, security and survival models.

Regulatory compliance: enterprises need to begin preparing for the EU Cyber Resilience Act (CRA), fulfilling obligations such as risk assessment and vulnerability disclosure.

Security risks: the incidents at the end of 2025 of using AI chatbots (such as Drift AI) to steal enterprise credentials remind enterprises that AI interfaces are becoming new springboards for supply chain attacks.

Summary

Open source business in 2025 has fully shifted from "technological sentiment" to "value creation". If open source business is compared to a fruit tree, then early open source was more about cultivating roots and branches (technology and community); by 2025, with capital irrigation and business model innovation, this tree has entered a large-scale harvest period. However, we must also remember to fertilize the roots (compensate maintainers), otherwise prosperity will be hard to sustain.

Chapter 6 | License and Compliance Governance: Rule Restructuring from Software to AI

In 2025, the field of "open source licensing and compliance governance" is in a violent transition period from traditional software to the artificial intelligence (AI) era. Due to the ambiguous legal attributes of AI model weights, training data and generated content, combined with increasingly strict international regulation, compliance governance has become a core issue for enterprises and communities. The following is a comprehensive summary of related news for the year:

6.1 The Game of AI Large Model Licensing: Openness and Restriction Coexist

In the AI field, the competition between permissive licenses and special-purpose licenses is intensifying, aiming to balance ecosystem building and commercial interests.

The spread of permissive licenses: at the beginning of 2025, DeepSeek open-sourced its Qwen and Llama distillation models under the MIT license, significantly lowering the usage threshold. Subsequently, IBM's Granite 3.2 series and mainstream models such as GPT-OSS and Qwen3 also mostly adopted Apache 2.0 or MIT licenses, which is considered an important foundation for promoting compliant adoption of open source AI by enterprises in sensitive fields such as finance and healthcare.

Non-commercial and restrictive attempts: by contrast, NVIDIA's Audio Flamingo 3 model adopted the OneWay non-commercial license, limited to research purposes only. In addition, the release of OpenAI's first open-weight model was postponed multiple times due to security testing, reflecting the trade-off between openness and risk control among giants.

The establishment of new standards: the Free Software Foundation (FSF) released criteria for evaluating whether machine learning applications meet "free" standards, covering training data sources and model reproducibility. At the same time, legal experts began to deeply explore complex propositions such as large model patents, the legal status of Agents, and unfair competition.

6.2 Community Turmoil and the "Fork Wave" Caused by License Changes

When enterprises adjust licenses for commercialization, they often trigger defensive counterattacks from the community, leading to project forks.

Redis returns to open source: after the controversy of switching to SSPL, Redis added AGPLv3 as one of the optional licenses starting from version 8.0, marking its return to OSI-certified true open source, aiming to balance preventing cloud vendor exploitation and maintaining community trust.

Defensive forks: in response to HashiCorp's restriction of the Terraform license, OpenTofu as a fully open source alternative attracted attention. In addition, because Semgrep changed its ruleset license to prohibit free commercial use, multiple software companies jointly launched the Opengrep project to fork, maintaining the openness of the rulesets.

Concerns over ownership changes: after being acquired by Qualcomm, Arduino modified its terms of service, triggering widespread community concerns about its possible future shift to closed source or restricted commercial use. Liquibase also announced license change plans, continuously sparking discussions about commercial balance.

6.3 Compliance Judicial Practice and Institutionalized Regulation

2025 is a key year for open source compliance moving from "industry self-discipline" to "judicial enforcement".

GPL enforcement milestone: in the SFC v. Vizio case, a US judge issued a preliminary ruling supporting that SFC, as a purchaser, had a contractual relationship with Vizio, potentially forcing Vizio to share the source code of its TV software under the GPL. In addition, Wikipedia comprehensively reviewed the legal effects of the GPL and the fluctuation in adoption rates in recent years due to compliance complexity.

The impact of EU legislation: with the advancement of the EU Cyber Resilience Act (CRA), open source contributors urgently need to clarify the legal liability boundary between "manufacturers" and "maintainers". The EU policy summit even suggested requiring large commercial users of critical infrastructure to bear security audit and maintenance costs.

Global regulatory challenges: developers began systematically addressing the impact of US OFAC sanctions on global open source collaboration, and exploring how to establish cross-border compliance frameworks.

6.4 Practical Implementation of Patent Open Sourcing in the Automotive Field

Deepal open-sourced two core patent groups (battery safety, pulse heating, etc.), a typical event of "opening intellectual property assets".

OpenSDV participated in the patent pool group standard and organized the "Patent Open Source Strategy and Operation Practice" seminar: it can serve as a sample of "patent open source moving from initiative to institutionalized operation".

6.5 Upgrades of Governance Tools and Standards

Automation and standardization have become the main means of reducing compliance costs.

Official tool releases: OSI (Open Source Initiative) launched a new API allowing programmatic querying of its approved open source license list, enhancing the automation capability of compliance governance.

Standards and patent protection: China's national center and organizations in Shanghai, Jiangsu, Zhejiang and Beijing successively initiated standards discussions on open source software intellectual property risk assessment and first-version project evaluation. Shenzhen Open Source applied for a ScanCode-based license recognition patent to improve source code scanning efficiency. In addition, in response to the increasingly severe patent risks, OSI experts proposed various legal solutions for identifying and avoiding patent threats.

Copyright disputes escalated: Disney sent a letter to stop Google Gemini, accusing it of infringing intellectual property, highlighting the urgent need for content provenance and copyright attribution in the generative AI era.

6.6 Innovative Exploration of License Mechanisms

To adapt to the new environment, the community began trying new licensing models.

The restart of the Copyleft-next project: this project introduced a "copyleft sunset clause" (automatically converting to a permissive license after 15 years) and a "dual license invalidation" mechanism, attempting to find a new balance between code entering the public domain and developer income.

Summary

Open source licensing and compliance governance in 2025 is like sailing in the "digital deep-water zone". If open source licenses are compared to navigation rules, the old rules mainly targeted sailing ships (traditional software); now, with the addition of AI, these "nuclear-powered giants", the old rules appear inadequate in power attribution and emission standards (weight data and generated content). Therefore, this year we have seen both the utmost maintenance of traditional rules (such as the defense of the GPL in the Vizio case) and rule reshaping and tool upgrades to adapt to new shipping lanes.

Chapter 7 | Open Source Education: From Skill Supplement to Institutionalized Cultivation

In 2025, open source education entered a new stage of transformation from "interest-driven" to "systematic talent cultivation". As open source has become important innovation infrastructure in the digital economy era, universities, foundations, enterprises and communities jointly build a cultivation system covering curriculum development, engineering practice, capability certification and career development. At the same time, the rapid development of generative AI has further lowered the threshold of open source participation, promoting the evolution of open source education toward intelligence, practicality and inclusiveness.

7.1 Institutional Introduction into Universities and Professional Systems

In 2025, multiple universities incorporated open source technology and open source collaboration methods into formal teaching systems, promoting the gradual standardization and institutionalization of talent cultivation.

Micro-majors and discipline construction. Huazhong University of Science and Technology established the country's first OpenHarmony micro-major at a 985 university, and launched an outstanding engineer cultivation program. The OpenAtom Foundation supported the construction of the "open source software development" major direction, exploring a complete cultivation chain from course teaching and practical training to capability certification.

Evaluation mechanism reform. Open source contributions began to be incorporated into talent evaluation systems. North University of China took the lead in including students' open source contribution achievements in the bonus points for postgraduate recommendation and teacher title evaluation indicators, promoting the implementation of a "contribution-oriented" evaluation mechanism and providing a replicable practical sample for open source education in universities.

Promotion of excellent cases. The OpenAtom Foundation released the "2025 China University Open Source Education Case Collection", including 35 typical cases from 29 universities such as Tsinghua University and Beijing Institute of Technology. The CCF "Open Source University Tour" activity visited classrooms of universities such as Beihang University, continuously expanding the influence of open source education.

7.2 AI-driven Open Source Education Platforms

The widespread application of generative AI is reshaping open source education models, enabling learners to participate in real project development and innovation practice with a lower threshold.

Education evaluation system construction. Beijing Institute of Technology released the education large model comprehensive evaluation benchmark EduBench, integrating 18,000 open source dataset entries, covering 9 types of education scenarios such as teaching, assessment and tutoring, providing a standardized evaluation foundation for educational AI applications.

Intelligent learning platform exploration. East China Normal University built an intelligent learning platform for open source education oriented toward the AI era, achieving deep connection between course content and real open source projects, and promoting the teaching model innovation of "learning by doing".

The popularization of zero-threshold experimental environments. Andrej Karpathy open-sourced the nanochat project, helping learners understand the full process of large language models with minimal code; Westlake University open-sourced the ColabSaprot platform, enabling researchers without computer backgrounds to train protein language models; Replit created a zero-configuration cloud development environment through AI Agents, further lowering the threshold for software development and open source contribution.

7.3 Open Source Practice and Engineering Capability Cultivation Ecosystem

Compared with traditional classroom teaching, open source education places more emphasis on engineering training in real scenarios. In 2025, the ecosystem centered around open source project practice, developer cultivation and innovation competitions continued to flourish.

Open source graduation project practice. The Tiangong Kaiwu Open Source Foundation initiated the open source graduation project plan. At the 2025 CCF China Open Source Conference, students from universities such as Huazhong University of Science and Technology and Hubei University shared their open source graduation project experiences, covering directions such as remote sensing visualization protocol development and Halo plugin ecosystem construction, demonstrating the promoting role of open source in scientific research innovation and engineering practice.

Engineering talent cultivation. More and more enterprises are beginning to introduce real open source projects into the talent cultivation process. For example, Qiniu Cloud continues to promote the XEngineer new engineering plan (formerly the 1024 training camp), guiding students through enterprise mentors, open source project collaboration and phased engineering tasks to complete their growth from learners to contributors in real R&D scenarios. This kind of model is becoming an important exploration direction for school-enterprise collaborative cultivation.

Major competitions continue to be held. The 8th CCF Open Source Innovation Competition officially launched, setting up multiple frontier topics such as AI Infra, focusing on engineering practice and innovation capability cultivation, attracting students from universities nationwide.

Resources and computing power support. Projects such as "Xiaoyuanxing" enable students to participate in real open source projects during their studies through computing power into campuses, course co-building and community collaboration, achieving "learning is practice, practice is contribution".

7.4 Global Public Welfare and Capacity Building

Open source education is transcending campus boundaries and becoming an important force for promoting global digital capacity building and technology popularization.

Public welfare fund support. The "CCF-Guanghua Youth Open Source Fund" was officially established, exploring the innovative model of "public welfare + open source" and providing project funding and growth support for young developers. The Tiangong Kaiwu Open Source Foundation simultaneously launched an annual scholarship program to encourage young people to participate in open source innovation.

International certification and talent cultivation. Open Source China and LFOSSA jointly launched an AI talent certification program, exploring the construction of an inclusive AI education and capability certification system, providing an international path for open source talent cultivation.

Global capacity building research. The UN Office of Digital and Emerging Technologies (ODET) released a research report on the impact of AI on the ICT industry workforce, focusing on future skill reshaping and talent cultivation strategies. Brazil held the OpenForum Academy seminar, conducting exchanges around open technology, digital inclusion and social innovation, demonstrating the global influence of open source education.

Summary

In 2025, open source education has evolved from simple skill training into a systematic cultivation system covering curriculum development, engineering practice, capability certification and career development. Universities incorporate open source into formal education frameworks, enterprises and communities provide real project scenarios, and AI tools significantly lower the participation threshold, jointly promoting the formation of a closed loop of talent cultivation: "education—practice—contribution—growth".

If traditional education is compared to learning to swim in an indoor pool, then open source education in 2025 is more like letting students sail directly into the real sea: AI tools become intelligent navigation systems, community mentors provide experience support, and standardized courses and evaluation systems constitute navigation rules. In the process of participating in real open source projects, learners not only master technical capabilities, but also cultivate the engineering qualities of collaboration, innovation and sustained contribution, achieving the transformation from knowledge acquirers to open source innovators.

Chapter 8 | Open Source Policy: National Strategy and Local Competition and Cooperation

In 2025, the "open source policy" field underwent a deep transformation from pure technology advocacy to the institutionalization of national strategies, the legalization of global regulation, and the competition of local ecosystems. Open source is no longer just the spontaneous behavior of developers, but has become a core issue of great power competition, industrial innovation and global governance. The following is a summary of news on open source policy in 2025:

8.1 China's National Strategy: Deepening "AI+" and Open Source System Construction

In 2025, the Chinese government elevated open source to the strategic height of cultivating "new quality productive forces", improving top-level design through multi-ministry coordination.

"AI+" special actions: the State Council and the SASAC deployed "AI+" special actions multiple times, emphasizing mastering the "root technologies" of artificial intelligence, supporting open source community construction, and promoting the open sharing of models, tools and datasets. The National Development and Reform Commission also stated it would actively practice the open source and open path, lowering application thresholds through resource sharing.

Open source system and ecosystem expansion: the Ministry of Industry and Information Technology (MIIT) made clear it would accelerate the construction of the open source system, especially increasing efforts in the application ecosystem expansion of OpenHarmony and the construction of national-level AI open source communities.

Innovative policy attempts: the MIIT for the first time clearly proposed "encouraging and exploring patent open sourcing", aiming to promote collaborative innovation in the electronic information manufacturing industry through the opening of intellectual property. In addition, the government plans to incorporate open source contributions into credit certification and teacher achievement recognition, cultivating open source culture from the source of education.

8.2 Local Government Policy Competition: Heavy Subsidies and Characteristic Layouts

In 2025, major Chinese cities issued special policies one after another, competing for the high ground of open source through high subsidies and rewards.

Beijing and Shanghai: Beijing Economic-Technological Development Area attracted high-quality projects to take root through policy rewards (up to 3 million yuan), aiming to build a world-leading open source platform. Shanghai deliberated and approved an implementation plan for open source system construction, giving rewards of up to 5 million yuan to high-impact open source models and communities, and focusing on laying out embodied intelligence open source projects.

Guangdong and Wuhan: Guangdong Province provides annual subsidies of up to 8 million yuan for open source community construction, and promotes enterprises to develop industrial models based on open source large models. Wuhan and the East Lake High-tech Development Zone performed particularly prominently, providing up to 30 million yuan in support for open source-native application development.

Long-term planning: the "15th Five-Year Plan" recommendations of Zhejiang, Chongqing and other places all explicitly proposed creating the world's best open source ecosystem and consolidating the leading position of large model construction.

8.3 The Automotive Industry Policy for the First Time Clearly Proposed "Giving Full Play to Open Source Advantages"

Multiple ministries jointly issued the "Automotive Industry Stable Growth Work Plan (2025–2026)", proposing to "give full play to open source advantages", and named key technology directions such as automotive chips, operating systems, AI and solid-state batteries.

Beijing's "Implementation Plan for Open Source Ecosystem Construction (2026–2028)" emphasized the collection of high-quality AI datasets, covering fields such as intelligent connected vehicles.

8.4 International Regulation and Policy Games: The Arrival of the Compliance Era

Globally, open source software is beginning to face unprecedented legal constraints, especially strong regulation by the EU.

EU Cyber Resilience Act (CRA): this act had a profound impact on the open source community in 2025, clarifying that open source components commercialized in the European market must fulfill security compliance obligations. To ease community pressure, the EU released a concise guide for open source developers and explored how to balance software sovereignty and compliance costs.

EU "open source first" roadmap: the European Commission released a strategic document proposing 70 measures (such as establishing the European Open Source Sovereignty Fund EOSSF), implementing the principle of "public money, public code", aiming to enhance technological autonomy and reduce external dependence through open source.

US government transparency initiatives: the US Securities and Exchange Commission (SEC) fully implemented an open source policy, requiring newly developed custom code to be open to the public by default. However, the accidental leak of the Trump administration's AI.gov plan on GitHub also sparked discussions about policy compliance and security risks.

8.5 Governance Standards and Global Collaboration: Building Trustworthy Open Source

The focus of open source policy is shifting from "openness" to "controllability and security".

Standard-tiered verification: the China Electronics Standardization Institute launched the first batch of compliance verifications for the open source openness tiered standards of large models, providing an objective basis for evaluating the openness of large models. At the same time, the release of version 2.0 of the "AI Security Governance Framework" provided guidance for cross-industry collaborative governance.

Global Digital Public Infrastructure (DPI): UN agencies and partners promoted the construction of open and trustworthy digital infrastructure in line with the principles of the Global Digital Compact through activities such as "DPI Day", using open source solutions to achieve the Sustainable Development Goals.

Ethical discussions of large models: organizations such as the Free Software Foundation (FSF) began to deeply explore the impact of large language models on the free software movement, focusing on core issues such as training data copyright and user control.

Summary

Open source policy in 2025 is moving from "free growth" to the stage of "regulated governance". If open source technology is compared to a public water source, then the policy construction of 2025 is like building a complete purification and distribution system. In the past, everyone only focused on how to draw water from the source (using open source); now, governments and international organizations are beginning to formulate rules on who maintains the water source (open source contribution), how to ensure water quality safety (CRA/security frameworks), and how to build channels so that water-scarce regions can also benefit (technology popularization). Although the added filters (regulatory policies) may complicate the water-drawing process, they ensure that the entire digital ecosystem can operate safely and sustainably in the long run.

Chapter 9 | International Collaboration and Open Source Diplomacy: Rules, Sovereignty and Public Goods

In 2025, the field of "international collaboration and open source diplomacy" presented notable trends such as deepening global governance, enhanced regional technological sovereignty and the open sourcing of large models. The following is a comprehensive summary of related news for the year:

9.1 Deepening of Global Governance and Multilateral Collaboration

In 2025, open source technology has become an important tool of international diplomacy and global governance, especially significantly strengthened under the UN framework.

UN open source initiative: the UN held the second "UN Open Source Week" in June 2025, promoting the application of open source technology in Digital Public Infrastructure (DPI) and AI governance. At the same time, the Apache Software Foundation (ASF) actively responded, planning to support the "UN Open Source Principles" and sending representatives to participate in UN activities, marking the deep integration of the open source community and international diplomatic institutions.

Cross-institutional coordination: an "Open Source United" community was established within the UN system, aiming to promote large-scale adoption of open source software across the entire UN system through cross-institutional cooperation and resource sharing.

Digital inclusion actions: China's Cyberspace Administration of China released the "Global Development Initiative Digital Inclusion Action Initiative", explicitly supporting the construction of AI open source communities, aiming to help developing countries bridge the "intelligence gap" through open technology systems.

9.2 Regional Technological Sovereignty and Policy Games

While achieving technological self-reliance through open source, countries and regional organizations also face severe geopolitical challenges.

Europe's technological sovereignty: the 2025 EU Open Source Policy Summit emphasized that open source is the core of Europe's competitiveness and technological sovereignty, calling for the establishment of a European open source cloud and AI ecosystem. At the same time, multiple European universities jointly open-sourced the Earth observation model EarthMind, and Switzerland launched the national-level open source large model Apertus covering a thousand languages, demonstrating its strategic layout in AI sovereignty.

The China–US AI game: under the shadow of open source diplomacy, geopolitical conflicts still exist. According to reports, the US Congress plans to legislate to prohibit domestic users from using Chinese AI technologies such as DeepSeek (the bill is still under review and has not been officially passed), with violators potentially facing severe penalties, reflecting the intensifying game between China and the US in the AI field.

China's international radiation: China actively promotes "open source diplomacy". The MIIT plans to release the "International AI Open Source Cooperation Initiative"; the Ministry of Science and Technology proposed building a China-ASEAN AI open source and open community. In addition, OpenHarmony promoted the overseas launch of the Oniro OS through cooperation with the Eclipse Foundation, demonstrating the influence of Chinese open source projects in international technology governance.

9.3 Ecosystem Alliances of Industrial Giants and Open Sourcing of Base Models

In 2025, the global industry saw a wave of shifting from competition to collaboration, especially in key fields such as AI and automobiles.

AI agent alliance: the Linux Foundation initiated the AI Agent open source foundation (AAIF), attracting giants such as OpenAI, Google, Amazon and Anthropic to join, aiming to prevent ecosystem fragmentation. The founder of the Linux Foundation pointed out that with the evolution of the technology stack, AI base models are destined to be fully open-sourced.

Automotive software collaboration: three major German automakers — Volkswagen, Mercedes-Benz and BMW — joined forces with 11 giants including Bosch to jointly develop an open source automotive software stack, aiming to reduce R&D costs and promote innovation.

The publicization of high-tech: IBM and NASA jointly released the open source model Surya for predicting space weather; Oracle open-sourced the core network architecture of its supercomputers, aiming to improve the efficiency of global AI computing power.

9.4 Key Regions and Diversified Contributions

The reach of open source diplomacy is extending to the Global South.

Africa's open source potential: in 2025, the Eclipse Foundation sponsored OSCAFest in Nigeria for the first time. Reports show that the proportion of female contributors in the Global South (34%) is far higher than the global average. In addition, the open source practice of regional instant payment systems (IPS) in Africa is promoting its trade integration.

Cross-regional innovation chains: in China, the establishment of the Beijing-Tianjin-Hebei Open Source Industry Alliance aims to create a cross-regional open source innovation chain, while Hangzhou, Zhuhai, Macao and other places promoted the international collaboration of government, industry, academia and research by holding international open source conferences.

Summary

Open source diplomacy in 2025 is not just technology sharing, but a deep competition and collaboration over rule-making power, digital sovereignty and global inclusiveness.

If global technological development is compared to a symphony performance, then open source diplomacy is like the public sharing of the score. Although countries (orchestras) each have their own considerations in conducting style and part arrangements (technological sovereignty and policies), and even compete, it is precisely through this collaboration based on the "shared score" that the global digitalization process can achieve grand harmony amid differences, avoiding the "aphasia" of technological islands caused by going their own ways.

Final Thoughts

In 2025, the major events in the open source world, taken as a whole, are more like an "awakening of the digital commons". If the global open source ecosystem is viewed as a shared technological ecosystem, then this year's AI open source wave was nothing less than a violent "orogeny" — it rapidly reshaped the technology landscape, giving small and medium developers and emerging organizations the opportunity to stand on the high ground of capability. But at the same time, the problems of neglected infrastructure, broken trust and absent governance are becoming increasingly obvious, like soil erosion.

Governments of various countries intervened through legislation and policies, trying to build institutional guardrails for this digital commons. Open source is transforming from the idealistic practice of geek culture into the foundational infrastructure of modern digital civilization — solid and critical, but in greater need than ever of careful governance and long-term care.