Cognition did not buy a license. It hired the people who can publish the next version. When the Dioxus team announced it was joining Cognition on September 10, every crates.io owner of Blitz's core crates and two of Taffy's three owners went to work for a coding-agent vendor. Blitz is the rendering engine Cloudflare built its Kitesurf agent browser from; Taffy is the layout library under Zed's GPUI, Bevy and Slint. Your code is still permissively licensed. The schedule for its next release is now set largely inside the company building Devin.
That is not a scandal, and nothing in either announcement hints at one. It is a dependency whose owner changed, and it deserves the treatment you would give a SaaS vendor that was just acquired: write it down, pin it, and ask the one party that has a relationship with you — Cloudflare, if you are piloting Kitesurf — how it intends to maintain what it built on.
What Cognition Actually Promised the Open-Source Projects
Cognition said it plans on "continuing support for" four projects, with no term, no governance change and no disclosed deal terms. Cognition's announcement says the team will spend its time "improving Devin's virtual machine, computer use skills, and testing capabilities," and that the company will keep supporting "Dioxus, Blitz, Taffy, and Subsecond, while increasing investments in Dioxus-Native and Blitz." Neither that post nor Dioxus Labs' own gives a price, a duration or a governance structure, and Dioxus frames it as a team joining rather than a company sale.
Read the one named staffing line closely. The Dioxus post says: "Our lead engineer on Blitz, Nico Burns, will be devoted full time to maintaining and improving Dioxus." For the rest, the team will "continue to work on Dioxus, Blitz, Taffy, and Subsecond." That is a commitment to keep working. It is not a release cadence, a support window or a security response time — and it names Devin, not your stack, as the reason the team exists.
The strongest case for the deal is in the same post. Dioxus Labs had raised $3.5M in venture funding from Y Combinator and Khosla Ventures, and the post says joining lets the team keep developing Dioxus and Blitz "without financial pressure." Before September 10, these crates ran on startup runway. Now they run on the payroll of a company that says it "used Dioxus extensively to build and improve the performance of Devin", and the Dioxus post says the Devin CLI terminal renderer is built with Dioxus. An owner that depends on the code has every reason to keep it alive.
Who Can Publish Blitz and Taffy Now?
Every crates.io owner of Blitz's core crates now works at Cognition, and so do two of Taffy's three. A crates.io owner is an account that can publish and yank versions of a crate, and a named user owner can also add or remove other owners, "including the owner that made them an owner." Here is who held those rights on September 14 for the crates that Kitesurf and much of the Rust UI ecosystem lean on:
| Crate | Role | crates.io owners | Owners now at Cognition |
|---|---|---|---|
| blitz-dom | Blitz core crate | Nico Burns | 1 of 1 |
| blitz-traits | Blitz core crate | Nico Burns | 1 of 1 |
| blitz-paint | Painting; named in Kitesurf | Nico Burns | 1 of 1 |
| blitz | HTML/markdown frontend | Jonathan Kelley, Nico Burns | 2 of 2 |
| taffy | Block, Flexbox and Grid layout | Jonathan Kelley, Alice Cecile, Nico Burns | 2 of 3 |
| parley | Text shaping and line breaking | Six users, including Nico Burns | 1 of 6 |
| stylo | Firefox's CSS parser | Martin Robinson, Nico Burns, a Servo team account | 1 of 2 users |
The crate roles come from Blitz's README, which lists blitz-dom and blitz-traits as its core crates and says Blitz uses Stylo, Taffy for box-level layout, and Parley. The post confirms Burns is already inside ("Since joining Cognition, Nico's productivity has actually increased substantially"), and Unite.AI reports that Jonathan Kelley joined along with the entire Dioxus team. Taffy's third owner, Alice Cecile, is a Bevy maintainer and is not named in either announcement.
Read the table honestly, because it cuts both ways. Parley has six owners, and Stylo has a Servo team account beside two individuals, so their releases do not hinge on one person. Taffy keeps one owner outside Cognition. The concentration is Blitz, which is precisely the piece Cloudflare named.
Why Kitesurf Carries the Sharpest Exposure
Kitesurf is a free beta built on Blitz modules whose publishers now work at Cognition, and until Cloudflare open-sources it you cannot see which versions it runs. Cloudflare's August 6 launch post says "For parsing the HTML and the CSS we use parts of Blitz, a modular rendering engine, and Stylo," and that "another Blitz module, blitz-paint," uses Parley to shape glyphs, choose fonts and break lines. Cloudflare does not name Taffy, but crates.io's reverse-dependency list for Taffy includes both blitz-paint and blitz-dom.
Cloudflare's Kitesurf documentation says it "is in beta and available for free, behind per-account limits," and the launch post promises to "open source Kitesurf once we're ready — hopefully soon." Until then there is no public Cargo.lock to audit. What you can see is why teams want it: against a Chromium warm pool, Cloudflare measured 3.1× less CPU and 4.7× less memory for screenshots, at 1.8× the wall time. The same docs list what it cannot do yet, including "Start a long-running, authenticated session that requires persistent state."
None of this suggests Cognition will neglect Blitz. Its post says it is "increasing investments" there, and a lightweight HTML renderer is plainly useful to a company improving "computer use skills." The risk is narrower and more practical. When a bug that only bites a Workers deployment and a bug that only bites Devin land in the same sprint, the people with publish rights share one employer. The party with a relationship to you is Cloudflare, and its launch post says nothing about maintaining a fork, sponsoring upstream or contributing changes back. The closest thing on record is Nico Burns, quoted by InfoQ, saying he was not involved in Kitesurf but is "informed that they intend to open source and upstream their patches."
Taffy Is Pre-1.0 and Already Moving Fast
Taffy shipped five releases in under eight weeks this summer, and under Cargo's rules a 0.x minor bump is not picked up by a default version requirement. crates.io's release history shows 0.12.0 and 0.12.1 on July 3, 0.12.2 on July 15, 0.13.0 on August 8 and 0.14.0 on August 24. Cargo's caret rule reads ^0.2.3 := >=0.2.3, <0.3.0, so moving from 0.13 to 0.14 is a deliberate upgrade, not a patch. The Dioxus post says development of "Blitz, Taffy, and Parley have been accelerating." More velocity is good news for features and more integration work for everyone downstream.
Downstream is large. The same crates.io record shows 13.1 million all-time downloads, and 163 crates depend on Taffy, including bevy_ui, gpui and i-slint-core. Its README names Servo, Bevy, Slint, Floem — the framework behind the Lapce editor — and GPUI.
Zed shows what a careful consumer already does. It kept its own fork of Taffy and archived it on November 26, 2025, and GPUI's Cargo.toml now pins taffy = "=0.13.0" — an exact version, one release behind upstream. That pin matters more this week than last. Zed ships a code editor, and so does Cognition: Devin Desktop is what Windsurf became on June 2, 2026, less than a year after Cognition took over Windsurf's IP, product and remaining staff once Google hired its CEO in a $2.4 billion deal. Two of the three people who can publish the layout engine under Zed's UI framework now work for the company behind a rival editor. The license makes that survivable. It does not make it irrelevant.
What Did the Last Toolchain Acqui-Hires Deliver?
The licenses survived every recent deal of this kind; what moved was attention and control. Anthropic acquired Bun on December 3, 2025 and wrote that "Bun will remain open source and MIT-licensed." When OpenAI moved to acquire Astral, the company behind uv and Ruff, Simon Willison wrote: "One bad version of this deal would be if OpenAI start using their ownership of uv as leverage in their competition with Anthropic." He also noted OpenAI lacked "much of a track record with respect to acquiring and maintaining open source projects." The reassurance he quoted from Astral's Douglas Creager is the one every one of these deals leans on — that the worst cases "have the shape of 'fork and move on', and not 'software disappears forever'."
That reassurance is true, and it is incomplete. In our own coverage, Guardrails' Hub installer and hosted validators were already shut down when Harvey hired its founders, and AWS left DuckDB under its MIT license and independent Foundation while two of that Foundation's three directors joined its payroll. The license protects the code you already have. It says nothing about who ships the next version, or when.
What to Do About It
Treat Blitz and Taffy the way you would treat a vendor that was just acquired: inventory them, pin them, and get a maintenance answer in writing before anything built on them leaves beta.
This Week:
- Find every path to these crates. Run
cargo tree -i taffy --workspacein each Rust repo you ship, then repeat forblitz-dom,blitz-paint,parleyandstylo. Cargo's-iflag shows the packages that depend on a given package. Record each hit in your SBOM with the crates.io owner list beside it, because that list is what changed. - Pin what reaches production. Where a Taffy or Blitz upgrade would ship to users, use an exact
=requirement the way GPUI does, commitCargo.lock, and route upgrades through a named reviewer who reads the changelog. - Send Cloudflare three questions if Kitesurf is in a pilot. Which Blitz, Taffy and Parley versions does it run? Does Cloudflare maintain its own fork? What maintenance and security-patch commitment applies after the beta, whether or not upstream keeps pace?
This Month:
- Have counsel confirm fork rights crate by crate. Taffy is MIT; Blitz is dual-licensed MIT and Apache 2.0, and its
stylo_taffycrate is triple-licensed with MPL 2.0 added. Permissive licenses let you fork. They do not hand you the people who understand the code. - Write down a fork trigger and name its owner. Pick the conditions you would act on — no Taffy release for 120 days, an owner change on crates.io, a breaking change you cannot absorb within a quarter — and name the engineer who would carry the fork. Zed's archived fork is a reminder that carrying one is real, ongoing work.
- Keep a Chromium fallback for Kitesurf workloads. Cloudflare benchmarks Kitesurf against a Chromium warm pool; keep the jobs you move to Kitesurf portable back to that path, so an upstream stall costs you CPU and memory rather than a rewrite. If you are already sizing that trade-off, the math on computer-use agent fleets applies.
Before Kitesurf Leaves Beta:
- Put the maintenance answer in the order form. Once Kitesurf is priced, ask for notice when Cloudflare changes or forks an upstream rendering component, and for a patch commitment that does not depend on upstream.
- Check the owner lists every quarter. An owner added outside Cognition on
blitz-domortaffy, the way Parley and Stylo already spread publishing, lowers the concentration. An owner removed raises it.
The Bigger Picture
Coding-agent vendors are now hiring the maintainers of the toolchains beneath their products, and each has promised the code stays open. Anthropic took Bun in-house. OpenAI moved on Astral. Cognition, which we last covered for Devin's enterprise push, now employs everyone who can publish Blitz's core crates. Those promises are sincere, and they are self-interested: the buyer needs the code to keep working for its own agent.
Your interest is different. You need the code to move at your pace, on your platform, with someone accountable to you. None of the people in these deals owe you that. For Kitesurf, the only party that can is Cloudflare — so that is who you ask, and you ask before the beta ends.
The license means you can take over. Decide now what would make you.
Continue Reading
- Guardrails' Hub Died Aug 25. Harvey Bought the Team.
- AWS Didn't Buy DuckDB. It Hired Its Board Majority.
- Shopify Bought Tailwind. Your Agents Stopped Paying for It.
- Stilla Promised Continuity. Meta Bought It for WhatsApp.
- Cognition Hits $25B as Devin Wins Enterprise Coding
- OpenAI Bought Macs. Your Pilot Bills 24 Hours Minimum.