Michał "DualFroz" Fox
Full-stack developer from Kraków, Founder & CEO of VulCode. I build web apps, panels, bots and infrastructure, and I fix bugs in the open source tools I use every day.
dualfroz.com · vulcode.com · me@dualfroz.com
Open source contributions
137 merged pull requests in 71 projects with 610 420 GitHub stars combined.
Every project links to a repository here with my commits to it (original author, date and diff). Pull request links point to the upstream project.
zed-industries/zed
Code at the speed of thought – Zed is a high-performance, multiplayer code editor from the creators of Atom and Tree-sitter. · ★ 91 790
telegramdesktop/tdesktop
Telegram Desktop messaging app · ★ 33 257
- Hide the topics toggle in broadcast group settings (2026-10-14)
composer/composer
Dependency Manager for PHP · ★ 29 549
- Clarify which config keys support --json and --merge (2026-10-08)
icsharpcode/ILSpy
.NET Decompiler with support for PDB generation, ReadyToRun, Metadata (&more) - cross-platform! · ★ 26 665
- Fix #4137: Keep nint in conditionals with mixed native int branches (2026-10-11)
- Remove the delegate cache left by a discarded method-group conversion (2026-09-19)
- Recognize a VB exception filter's type test (2026-09-15)
urfave/cli
A declarative, simple, fast, and fun package for building command line tools in Go · ★ 24 290
PHPMailer/PHPMailer
The classic email sending library for PHP · ★ 22 312
- Don't send QUIT while DATA is in progress (2026-10-04)
- Fold long address headers (2026-10-04)
- Normalise line breaks in S/MIME signed messages (2026-09-10)
postcss/autoprefixer
Parse CSS and add vendor prefixes to rules by Can I Use · ★ 22 205
- Add
/* autoprefixer: ignore next warning */control comment (2026-10-07) - Set source for Grid prefixes in source maps (2026-10-05)
- Inherit grid gap set with the row-gap and column-gap longhands (2026-09-15)
gleam-lang/gleam
⭐️ A friendly language for building type-safe, scalable systems! · ★ 21 992
- Point guard constant type errors at the guard (2026-10-13)
twpayne/chezmoi
Manage your dotfiles across multiple diverse machines, securely. · ★ 21 944
- fix: Don't double backslashes in shellQuote (2026-10-11)
- fix: Pass /dev/null to diff command for missing files in apply --interactive (2026-10-11)
Seldaek/monolog
Sends your logs to files, sockets, inboxes, databases and various web services · ★ 21 398
valeriansaliou/sonic
🦔 Fast, lightweight & schema-less search backend. An alternative to Elasticsearch that runs on a few MBs of RAM. · ★ 21 361
- fix(core): Back up and restore FST buckets again (2026-10-05)
- docs: Document the 128 characters limit on collection, bucket and object names (2026-10-05)
- fix(core): Make
TRIGGER backupwork while stores are in use (2026-10-05) - docs: clarify write_buffer_size (2026-09-24)
- Stop leaking a client slot when a channel read fails (2026-09-15)
OpenRA/OpenRA
Open Source real-time strategy game engine for early Westwood games such as Command & Conquer: Red Alert written in C# using SDL and OpenGL. Runs on Windows, Linux, *BSD and Mac OS X. · ★ 17 576
- Preserve player definition order in MapPlayers (2026-10-11)
briannesbitt/Carbon
A simple PHP API extension for DateTime. · ★ 16 588
- fix: numeric round()/floor()/ceil() precision >= 60 seconds does not carry into minute/hour/day (2026-09-25)
PuerkitoBio/goquery
A little like that j-thing, only in Go. · ★ 14 989
- Expose html parse options (addresses #139, noscript) (2026-09-30)
- RemoveClass leaves a class behind when the source repeats it (2026-09-07)
App-vNext/Polly
Polly is a .NET resilience and transient-fault-handling library that allows developers to express policies such as Retry, Circuit Breaker, Timeout, Bulkhead Isolation, and Fallback in a fluent and thread-safe manner. From version 6.0.1, Polly targets .NET Standard 1.1 and 2.0+. · ★ 14 246
hajimehoshi/ebiten
A dead simple 2D game engine for Go · ★ 13 565
- audio: run the tests waiting on real time on synctest's fake clock (2026-10-06)
- .github/workflows: run go test -race for all packages (2026-10-03)
- internal/gamepad: don't fail when inotify is unavailable on Linux (2026-09-13)
filp/whoops
PHP errors for cool kids · ★ 13 230
- Stop output buffer cleanup at buffers that cannot be removed (2026-10-03)
- Restrict escapeButPreserveUris() to http/https schemes (fixes #791) (2026-09-05)
spencermountain/compromise
modest natural-language processing · ★ 12 162
- find payloads by term id so they survive a .remove() (2026-10-06)
- keep a titlecase comparative before 'than' as an adjective (2026-10-06)
- keep a closing bracket in the word when it closes one inside it (2026-10-05)
- match lexicon words that start with # or @ (2026-10-05)
- leave a spaced dash out of a match's text (2026-10-05)
- contract each match on its own (2026-10-05)
- don't add an implicit 'to' after 'wanna' before a noun (2026-10-05)
- split hyphens in a match the same way the tokenizer does (2026-10-05)
- contract 'he is not' to he's not instead of he'sn't (2026-10-05)
- drop does/did when turning a negative verb positive (2026-10-05)
- contract 'can not' to can't (2026-10-05)
- dates: read singular possessive durations (2026-10-05)
- don't merge an -ent syllable back into an open first syllable (2026-10-05)
- run the regex-boundaries tests on the full build (2026-10-05)
- parse 'fortnight' as two weeks (2026-10-05)
- Treat 's before a copula as possessive (2026-09-29)
- Keep the case in toSingular (2026-09-29)
- Keep "never" when going to the infinitive (2026-09-29)
- Skip the verb of a relative clause following the subject (2026-09-19)
- Recognize more openers of a secondary clause in mainClause (2026-09-19)
- Only treat subordinators as secondary-clause signals before the verb (2026-09-14)
doctrine/lexer
Base library for a lexer that can be used in Top-Down, Recursive Descent Parsers. · ★ 11 141
kanboard/kanboard
Kanban project management software · ★ 9 907
- fix(ical): only accept known columns as the calendar start date (2026-10-11)
- fix(security): escape the project name in the analytic modal title (2026-10-11)
- fix(session): scope the session cookie to the directory without a trailing slash (2026-10-02)
- fix(api): return a full batch response when one request is forbidden (2026-09-11)
FluentValidation/FluentValidation
A popular .NET validation library for building strongly-typed validation rules. · ★ 9 764
serilog/serilog
Simple .NET logging with fully-structured events · ★ 8 051
concourse/concourse
Concourse is a container-based automation system written in Go. It's mostly used for CI/CD. · ★ 7 919
- Interpolate task file vars before parsing the file (2026-10-05)
predis/predis
A flexible and feature-complete Redis/Valkey client for PHP. · ★ 7 778
- Use SENTINEL REPLICAS for Sentinel replica discovery (2026-10-12)
- Fix ConnectionErrorProof response count on single node read errors (2026-10-08)
- Replace deprecated spl_object_hash() with spl_object_id() in ConnectionErrorProof (2026-10-08)
vscode-neovim/vscode-neovim
Vim mode for VSCode, powered by Neovim · ★ 7 756
NLog/NLog
NLog - Flexible and Structured Logging for various .NET Platforms · ★ 6 549
- CachedLayoutRendererWrapper - Added CachedUntil to reset cached value when hour or day changes (2026-10-11)
- docs: document default values for Filters properties in XML docs (2026-09-05)
maildev/maildev
📫 SMTP Server + Web Interface for viewing and testing emails during development. · ★ 6 141
Pagefind/pagefind
Static low-bandwidth search at scale · ★ 5 515
xoofx/markdig
A fast, powerful, CommonMark compliant, extensible Markdown processor for .NET · ★ 5 342
- Fix definition lists requiring 3 spaces after the marker (2026-10-15)
- Fix grid table open last cell taking a | from the next line (#494) (2026-10-15)
- Fix: keep trailing content out of an unmatched emphasis closer (#743) (2026-09-19)
- Fix heading auto-link hijacking nested link labels (#668) (2026-09-19)
dromara/carbon
A simple, semantic and developer-friendly time package for golang · ★ 5 222
alecthomas/chroma
A general purpose syntax highlighter in pure Go · ★ 5 054
olekukonko/tablewriter
ASCII table in golang · ★ 4 820
- twwidth: purge width cache in SetTabWidth (2026-10-11)
knadh/koanf
Simple, extremely lightweight, extensible, configuration management library for Go. Supports JSON, TOML, YAML, env, command line, file, S3 etc. Alternative to viper. · ★ 4 219
spencermountain/spacetime
A lightweight javascript timezone library · ★ 4 107
- Return titlecased timezone names from whereIts (2026-10-15)
- Expose the tzdb version as spacetime.tzdbVersion (2026-10-15)
- Fix hour() setter clamping to an invalid hour (24) (2026-09-08)
itchyny/gojq
Pure Go implementation of jq · ★ 3 812
Suor/funcy
A fancy and practical functional tools lib · ★ 3 509
thephpleague/csv
CSV data manipulation made easy in PHP · ★ 3 482
composer/satis
Simple static Composer repository generator - For a full private Composer repo use Private Packagist · ★ 3 305
- Allow relative URI references for homepage and archive prefix-url (2026-10-06)
- Resolve dependencies through the repositories the packages filter dropped (2026-09-14)
montanaflynn/stats
A well tested and comprehensive Golang statistics library package with no dependencies. · ★ 3 030
versity/versitygw
A simple to deploy but feature rich S3 object storage server for your filesystem · ★ 3 027
- fix: return NextMarker in ListObjects only when a delimiter is set (2026-10-13)
- fix: reject the start-after query in ListObjects (V1) (2026-10-13)
- fix: compute IsTruncated from the absolute index in ListMultipartUploads (2026-10-08)
- fix: validate and apply the ListBuckets bucket-region query (2026-10-07)
- fix: drop upload-id-marker without key-marker in ListMultipartUploads (2026-10-05)
- fix: report the last upload in ListMultipartUploads next markers on a single page (2026-10-05)
- fix: return InvalidURI for a malformed escape in the request path (2026-10-05)
- fix: accept upload-id-marker together with key-marker in ListMultipartUploads (2026-10-05)
- fix: return MalformedXML for a DeleteObjects request without objects (2026-10-05)
- fix: reject ListMultipartUploads requests that also carry uploadId (2026-10-05)
- Return IllegalLocationConstraintException for a mismatched LocationConstraint (2026-09-14)
thephpleague/commonmark
Highly-extensible PHP Markdown parser which fully supports the CommonMark and GFM specs. · ★ 2 979
mitsuhiko/insta
A snapshot testing library for rust · ★ 2 973
BurntSushi/jiff
A datetime library for Rust that encourages you to jump into the pit of success. · ★ 2 957
- fmt: fix buffer sizes when printing durations (2026-10-13)
zzzprojects/html-agility-pack
Html Agility Pack (HAP) is a free and open-source HTML parser written in C# to read/write DOM and supports plain XPATH or XSLT. It is a .NET code library that allows you to parse "out of the web" HTML files. · ★ 2 851
Paymenter/Paymenter
Free and open-source webshop solution for hostings · ★ 2 718
- fix(cart): hide Edit when there is nothing to configure (2026-10-10)
- Refresh the config options of a cart item whose product changed (2026-09-17)
api-platform/core
The server component of API Platform: hypermedia and GraphQL APIs in minutes · ★ 2 580
- fix(state): avoid deprecated PartialDenormalizationException::getErrors() (2026-10-13)
- fix(hal): use spl_object_id() for circular reference counters (2026-10-09)
pelican/panel
Free, open source game server management panel built on Laravel and Docker. · ★ 2 387
- Move the primary allocation when it is removed from a server (2026-10-10)
- Fix plugin update crashing after the rows are refreshed (2026-09-25)
gookit/goutil
💪 Helper Utils(900+): int, byte, string, array/slice, map, struct, dump, convert/format, error, web/http, cli/flag, OS/ENV, filesystem, system, test/assert, time and more. Go 常用的工具函数：数字，字符串，数组，Map，结构体，反射，文本，文件，错误，时间日期，特殊处理，格式化，常用信息获取等等 · ★ 2 361
dedoc/scramble
Modern Laravel OpenAPI (Swagger) documentation generator. No PHPDoc annotations required. · ★ 2 219
gocarina/gocsv
The GoCSV package aims to provide easy CSV serialization and deserialization to the golang programming language · ★ 2 198
- Add MarshalBytesWithoutHeaders (2026-10-12)
- Fix date layout in README and full example (2026-10-12)
- Make SetHeaderNormalizer safe to call while decoding (2026-10-12)
- Parse integer fields as base 10 (fixes #182) (2026-09-05)
thephpleague/html-to-markdown
Convert HTML to Markdown with PHP · ★ 1 907
- fix: honor start="0" on ordered lists (2026-09-07)
AfterShip/email-verifier
✅ A Go library for email verification without sending any emails. · ★ 1 643
fabiocaccamo/python-benedict
📘 dict subclass with keylist/keypath support, built-in I/O operations (base64, csv, html, ini, json, pickle, plist, query-string, toml, xls, xml, yaml), s3 support and many utilities. · ★ 1 606
gookit/color
🎨 Terminal color rendering library, support 8/16 colors, 256 colors, RGB color rendering output, support Print/Sprintf methods, compatible with Windows. GO CLI 控制台颜色渲染工具库，支持16色，256色，RGB色彩渲染输出，使用类似于 Print/Sprintf，兼容并支持 Windows 环境的色彩渲染 · ★ 1 606
- fix(convert): zero-pad each channel in RgbToHex (2026-09-07)
olebedev/when
A natural language date/time parser with pluggable rules · ★ 1 463
- Fix month parsing overflowing into the next month (2026-09-27)
dgilland/pydash
The kitchen sink of Python utility libraries for doing "stuff" in a functional way. Based on the Lo-Dash Javascript library. · ★ 1 447
cakephp/chronos
A standalone DateTime library originally based off of Carbon · ★ 1 362
go-playground/form
🚂 Decodes url.Values into Go value(s) and Encodes Go value(s) into url.Values. Dual Array and Full map support. · ★ 931
mkideal/cli
CLI - A package for building command line app with go · ★ 723
gookit/config
📝 Go configuration manage(load,get,set,export). support JSON, YAML, TOML, Properties, INI, HCL, ENV and Flags. Multi file load, data override merge, parse ENV var. Go应用配置加载管理，支持多种格式，多文件加载，远程文件加载，支持数据合并，解析环境变量名 · ★ 585
rust-syndication/rss
Library for serializing the RSS web content syndication format · ★ 502
kelindar/bitmap
Simple dense bitmap index in Go with binary operators · ★ 385
brick/date-time
Date and time library for PHP · ★ 361
pydantic/pydantic-extra-types
Extra Pydantic types. · ★ 338
- Add Sha256Str type (2026-10-03)
- Fix MacAddress accepting octets with a sign or whitespace (2026-09-05)
rodaine/table
Go CLI Table Generator · ★ 324
wroberts/pytimeparse
A small Python module to parse various kinds of time expressions. · ★ 299
QEDK/configparser-rs
A simple configuration parsing utility with no dependencies built on Rust. · ★ 88
- Fix panic when parsing with a multi-byte delimiter (2026-09-06)
thephpleague/uri-src
URI toolkit Library · ★ 51
spiral/testing
Spiral Framework testing SDK · ★ 7
- Ignore line endings in scaffolder output assertions (2026-10-04)
- Ignore line endings in console output assertions (2026-10-04)
- Keep configured auth transports when faking an actor (2026-09-21)
mozilla/firefox
Firefox web browser
- Bug 1996443: focus the browser window when opening about:logins via LoginHelper.openPasswordManager (2026-10-21)
proxmox/pve-manager
Proxmox VE: web interface and API