标签：#gsoc

Contributor: Nikhil Kumar Rajak ( @ryzrr ) Organization: webpack · Project: webpack-doc-kit Mentors: Aviv Keller ( @avivkeller ), Claudio Wunder ( @ovflowd ), Sebastian Beltran ( @bjohansebas ) Teammates: Mohamed Shams El-Deen ( @moshams272 ), Tushar Thakur ( @TusharThakur04 ) Period: 25 May to 17 August 2026 The problem webpack's docs lived at webpack.js.org and every API change meant somebody updating them by hand. Pages go stale and nobody notices until a reader does. webpack-doc-kit fixes that. It takes webpack's TypeScript declarations, runs them through TypeDoc, hands the output to nodejs/doc-kit for linking and UI, and produces a site that regenerates itself. We split the work three ways. Shams took AST parsing and content, Tushar took routing and navigation and UI, and I took the operational side: how docs get generated on a release, versioned & deployed. My six deliverables were PR-based doc sync, release-aware doc generation, versioned output folders, a deployment pipeline, CI validation before merge, and README fetch automation. All six shipped. Merged PRs in webpack-doc-kit 31 Lines added / removed +1,959 / −1,419 Distinct files touched 89 First / last merge 28 May ( #110 ) / 14 Aug ( #241 ) Merged PRs in other repos 2 Upstream issue filed and fixed 1 Everything below is merged into main . Nothing is open or pending. The release pipeline webpack releases happen in webpack/webpack . The docs live in webpack/webpack-doc-kit . A release in one needs to produce updated docs in the other with nobody doing anything. #110 set up versions.json as the single source of truth everything downstream reads, plus the script that maintains it and the workflow that runs it. My mentor proposed an object schema with latest , label , major , exactVersion , commit and frozen per entry. Review cut it to a flat array of tag strings, because everything else is derivable from the semver string and position [0] with unshift() already tells you which is latest. Right call, and I d

When I started GSoC in May, my plan was to build a runtime sandbox for community plugins. By week two my mentor had talked me out of it, and I ended up spending the rest of the summer building a review queue instead. This post is about how that happened and what I actually shipped. Quick summary Project: Community Driven Plugin Ecosystem for OWTF Org: OWASP Foundation Mentors: Abraham Aranguren, Viyat Bhalodia What got shipped: Six pull requests against owtf/owtf , around 6,000 lines of Python and TypeScript, 153 backend unit tests, and a trust model doc. Working mirror of this post: gist If you only want the code, here are all my PRs on OWTF . The problem I was trying to solve OWTF is a security testing framework, and until this summer its plugin catalogue was static. If you wrote a detection for some new attack pattern, your options were: open a PR against the framework itself (high bar, slow), or keep the plugin to yourself. Most useful plugins never made it upstream because of that. The Community Plugin Marketplace fixes this. Any authenticated user can upload a Python plugin through the web UI. The plugin is validated at upload time, lands in a pending queue, and waits for an admin to look at the source. Once approved, the plugin gets mirrored into OWTF's standard plugin table. From that point on, the runner, the worklist, and the report generator all treat it exactly like a built-in plugin. The pivot My accepted proposal called for a sandbox. Community plugins would run inside something like a subprocess with dropped privileges, so that a malicious plugin could not do too much damage. Then Viyat said this in Slack: A sandbox in Python that talks to the same postgres, the same file system, the same target scope as OWTF itself is not really a security boundary. I sat with that for a couple of days and realised he was right. A plugin that runs inside OWTF has to see the target, has to read config, has to write results. Any "sandbox" I put around that is going to

Hello again! Weeks 9 and 10 covered the fourth estimator family, the first release that carries my work, and a git mess that taught me more than the code did. PR #1920 merged, and sbi 0.27 shipped First, the ratio estimator builder from my last post made it in, together with the whole base class hardening bundle. Right after that, sbi 0.27 was released and PRs 1 to 5 were ported over to main . So the typed builder API is now actually in a release, for NPE, NLE, MNPE, MNLE and all four NRE variants. That also means the free rename window is closed. The z_score_input and z_score_condition names we picked in week 7 are now the shipped names, which is exactly why we did that rename when we did. Writing the design before the code Under the new workflow I described last time, the vector field work started with a markdown file instead of a Python file. The vector field family is genuinely harder than the others. build_vector_field_estimator picks along what looks like three axes at the same time: whether you want flow matching or score matching, which SDE type you want if it is score matching, and which network architecture sits inside. And unlike every other family, there are no per-model build functions to hang a config class on. I wrote up the options with some open questions then my mentor, Jan reviewed it and we settled on one builder with a base class abstraction to cut the redundancy across builders. Doing this on paper first was clearly the right call. Some of the things I had assumed while writing the proposal turned out to be wrong, and finding that out in a review comment on a markdown file was a lot cheaper than finding it out in a review comment on 800 lines of code. PR #1921 : VectorFieldEstimatorBuilder With the design agreed, the implementation covers FMPE and NPSE. The builder takes the architecture as model , one of mlp , ada_mlp , transformer or transformer_cross_attn , plus estimator_type for flow versus score and sde_type for the noise schedule. One de

Hey everyone! Weeks 7 and 8 are done, and the biggest news first: I passed the midterm evaluation🎉. Half of GSoC is behind me now. These two weeks were less about writing new classes and more about going back and making the ones I already had a lot stricter. Here is what happened. PR #1920: The RatioEstimatorBuilder This PR adds the builder for the NRE family, so NRE_A , NRE_B , NRE_C and BNRE all get the same typed interface that NPE and NLE already had. The builder itself was honestly the easy part. By now the pattern is well established, so it was mostly mirroring what already worked, with linear , mlp and resnet as the classifier options. The interesting part was what my mentor Jan Teusen suggested we bundle into the same PR. Some improvements to the base class PR #1920 was the first PR that proved the shared base class serves a third family. My Mentor, Jan pointed out that this was exactly the right moment to fix the validation gaps in that base, because then the NRE builder and the vector field builder that was coming next would inherit the fixes for free, instead of me retrofitting four builders later. So we folded a hardening bundle into the same PR: Invalid Literal values now raise at construction. This was the real gap. If you typed a wrong field name , Python already raised a TypeError for you. But if you typed a wrong value on a correctly named field, like z_score_input="idependent" , nothing happened until you called .train() and it blew up much later. Now it fails immediately. Model-incompatible kwargs now raise too. Passing num_blocks to a linear classifier used to be silently dropped, and the same argument on mlp crashed late. Both are caught at construction now by inspecting the target build function's signature. frozen=True on the config dataclasses. Configs are now immutable. If you want a different setting, you make a new object instead of mutating the old one. This sounds like a small thing but it removes a whole class of " I changed the config

The summer is officially over. I am staring at a remarkably clean Git branch, my laptop didn't literally take off into orbit (though the CPU fans certainly tried a few times during local CI builds), and I somehow know what git rebase -i does without having to Google it in a cold sweat. If you'd asked me back in May what I was going to be doing, I would have confidently told you I was going to "write tests for Astropy's C extensions." It sounded so neat. So contained. But open source doesn't really work like that. I came in thinking I was just going to write tests, and somewhere along the way, I ended up learning how the actual machinery underneath the Python abstraction works, how maintainers think about architecture, and how to safely catch C-level memory panics without taking down the entire interpreter. So, here is the real story of what I did for the last few months, what broke, how we fixed it, and where the project stands now. So, what was I actually supposed to do? Astropy is a beast of a library. The Python-facing API is incredibly robust and beautifully documented. But underneath all those pretty Python classes is a complex, mixed-language architecture. The library relies heavily on compiled C, and Cython extensions to handle the performance-critical hot-paths. The problem? That compiled layer was a massive testing blind spot. Before this summer, these performance-critical extensions were almost entirely tested indirectly, meaning they were only validated by calling the high-level Python wrappers. That is a risky abstraction. If a regression happens deep inside the C code, the Python layer sitting above it can accidentally mask it. You wouldn't know something was fundamentally broken until a downstream package started acting weird. My project goal was to build a dedicated, de novo test suite that bypassed the public API completely and exercised each compiled extension module directly. This wasn't just for code coverage. It was an absolute prerequisite for t

Another productive week of Google Summer of Code with OWASP BLT is in the books! Building on the visual blueprints from last week, this week was focused on locking down our structural foundations and diving deeper into the system architecture. Here is a simple breakdown of the progress made and what lies ahead. Milestones The primary goal for this phase was setting up the structural guardrails for how data travels through our app. Finalized Security Contract Structures: Successfully established the foundational security contract structures. This ensures that our application components have a uniform, strict schema to communicate safely and predictably. trying to figureout some missing point on the security_alerts with the help of my mentor. Merge request updates: Glad to share that the initial setup has been done across our repository through these milestones: 🔗 Merge Request #3 🔗 Merge Request #4 🔗 Merge Request #5 🔗 Merge Request #6 🧠 Current Focus: System Design & UI Polish With the basic structures merged, my day-to-day focus has shifted toward high-level engineering and refining the user experience. Architecture & System Designing: Spending time mapping out the data flows to ensure our local-first storage design works seamlessly with minimal, encrypted web updates. Ongoing UI Revamp: Continuing to polish the user interface layouts based on our initial feedback, ensuring the experience feels clean, intuitive, and highly minimal. ⚡ The Next Step: Building the Workers Now that the structural blueprints are active in the project, it is time to make them functional. ⚙️ Contract Workers: Moving forward, the next step is to start creating the edge contract workers. These workers will handle the actual validation and processing logic for the security contracts we just established. The structural groundwork is officially laid, and the architecture is shaping up beautifully. Excited to bring the core backend logic to life next week! 💻🛡️

Hey everyone! Welcome back to my Google Summer of Code (GSoC) journey. In my last post, I shared the story of how I got into open source and was selected for GSoC with NumFOCUS to work on the Neural Network Builder API Refactor project for sbi (Simulation-Based Inference). Since the official announcement, the past three weeks have been dedicated to the Community Bonding Period . It is designed to help contributors get to know their mentors, understand the community culture, and familiarize themselves with the codebase and tools. Here is exactly what I did during these past three weeks to get ready for the main coding phase! The Kickoff Meeting We started the bonding period with a great kickoff call on Google Meet. It was a joint meeting that included the mentors for both of the selected sbi projects, the selected GSoC candidates. We were also joined by the mentee who successfully completed the GSoC project for sbi last year! Everyone introduced themselves, and it was incredibly inspiring to meet the team face-to-face (virtually!) and hear about everyone's backgrounds. Having a former GSoC student there was a huge bonus, as they shared some great insights into what to expect in the coming months. Setting Up the Machine A big part of getting started is making sure the development environment is properly configured. During our meetings, we discussed the machine setup in detail to ensure both candidates had everything required to run and test the sbi codebase locally without any hiccups. Embracing AI Coding Assistants One of the most interesting discussions we had was about using AI coding assistants. In the modern development world, tools like these are becoming standard, and our mentors actually encouraged us to use them! However, they emphasized using them carefully and strictly following project guidelines. To help us get the most out of these tools without compromising code quality, the mentors shared some excellent Claude code tutorials and provided us with resour

"This wasn't a success story. It started as survival." Intro Hey, I'm Supreeth C , a third-year engineering student, open source developer, and professional overthinker from Bengaluru. This is my first blog, and fair warning: it's long. Not "LinkedIn post with 5 bullet points" long. Actually long. This is the story of how I got selected for Google Summer of Code 2026 with CircuitVerse but more honestly, it's the story of how I almost didn't submit a proposal, almost quit twice, and spent a lot amount of time reading codebases on the Bengaluru Metro while missing my stop. Connect with me on GitHub and LinkedIn PS: I'm writing this at 4.05am, because sleep is a myth XD. Act I: The Prequel Second semester. Fresh-faced. Absolutely clueless. I joined Pointblank , the one genuinely breathable space in my Tier-3 college. I can say its the best student-run club overall and the main reason being : everyone around me was terrifyingly good . Codeforces experts and specialists, GSoC mentees, LFX mentees, Smart India Hackathon winners. People whose LinkedIn bios are of several lines. And me? I knew C++. That was it. That was my entire personality. Cue the imposter syndrome : that lovely feeling where you're convinced you snuck into a room you have no business being in, and everyone else is one conversation away from figuring it out. My solution? Chaos. I started learning everything simultaneously: web dev, Android, ML, DevOps, a bit of systems engineering. Jack of all trades, master of none, spiraling fast. I wasn't learning; I was collecting domains like Pokémon and actually using none of them. Then a senior said something that cut clean through the noise: "Find your own path." So I slowed down. Started from the basics of web dev. Attended many hackathons but always ended up in third or fourth and winning: zero . But something clicked anyway. Those hackathons introduced me to open source, and somewhere in that chaos, I gave myself a simple challenge: 4 pull requests for Hacktob