hey.xyz froze its open source on 2026-05-15 and then said so five times

A snapshot, and the README says so in five places

The opening block is an Open Source Snapshot Notice. This repository represents the last publicly available open-source version of Hey.xyz before May 15, 2026. Development and changes made to Hey.xyz after that date are currently not open source and are not included here. It is preserved as a historical snapshot of the codebase as it existed before that date.

Then it says it again. The About section restates that this is the open-source version available before May 15, 2026. An Important section adds that the production version may contain features, architectural changes, infrastructure changes, security improvements and other modifications not present here.

A table makes the timeline explicit: before May 15, 2026 open source; May 15, 2026 the last open-source development period; after that, currently not open source.

Two more statements close the loop. No claim is made that this repository represents the current implementation running on Hey.xyz. And the disclaimer says the current application may differ substantially from the code contained in this repository.

The tech stack names Next.js and the build script names Vite

The Tech Stack section lists TypeScript, React, Next.js, Tailwind CSS, GraphQL, Lens Protocol, Wagmi, Viem, PostgreSQL, pnpm and Node.js.

package.json disagrees on one of them. There is no Next.js dependency, and the build script is vite build, the dev script is vite dev --port 4783, and the start script is vite preview --host 0.0.0.0 --port 4783. The root of the repository holds vite.config.mjs and index.html, which is the shape of a Vite single-page application rather than a Next.js one.

So the framework named in the stack list is not the one in the manifest. Several other entries appear in the dependency block: Tailwind through the @tailwindcss/vite plugin, GraphQL through graphql and @apollo/client, and the Lens Protocol through @lens-chain/sdk and @lens-protocol/metadata.

package.json also carries a codegen script, graphql-codegen with its config at src/indexer/codegen.ts.

Node 22, pnpm, PostgreSQL, and four things you must not commit

The Requirements section names four prerequisites: Node.js v22 or later, pnpm, PostgreSQL and Git, with NVM recommended for managing Node versions.

The installation path is short and complete. Clone the repository and change into it:

git clone https://github.com/slymnoyann/hey.xyz.git
cd hey.xyz

If the repository contains an .nvmrc file, run nvm install and nvm use, then check the result with node -v. pnpm goes in globally with:

npm install -g pnpm

Verify with pnpm -v, then install from the repository root with pnpm install.

Configuration is a copy away:

cp .env.example .env

Typical values needed there are Lens configuration, a database connection, Redis configuration, API authentication, wallet and private key configuration, storage configuration and application configuration. The security note is blunt about the fifth of those: never commit private keys, API secrets, database credentials or other sensitive values to Git.

Five pnpm scripts cover the whole workflow

The Development through Linting sections each carry one command, and together they are the entire day-to-day surface.

Start the development environment with pnpm dev, then open the local URL displayed in the terminal. Produce a production build with pnpm build. Check types with pnpm typecheck, which package.json maps to tsc --pretty. Check formatting and linting with pnpm biome:check, and fix what it can with pnpm biome:fix, both of which map to the biome CLI with and without --write.

One script is in the manifest but not in the README: codegen, pointing at src/indexer/codegen.ts.

Two details in the scripts are worth noting. The dev and preview servers are pinned to port 4783 rather than a default, and start binds to 0.0.0.0, which exposes the built application on every interface. The presence of ecosystem.config.cjs in the root is consistent with running that preview server under a process manager in a deployment.

The tree is one application, not really a monorepo

The Project Structure section calls it a monorepo-style structure and then prints a tree that does not look like one:

.
├── .github/
├── .husky/
├── .vscode/
├── public/
├── script/
├── src/
├── .gitignore
├── .nvmrc
├── biome.json
├── ecosystem.config.cjs
├── generated.ts
├── index.html
├── package.json
├── pnpm-lock.yaml
├── possible-types.ts
├── tsconfig.json
└── vite.config.mjs

There are no workspace packages listed, and package.json has no workspaces field. The README hedges as well, saying the exact structure may vary between historical commits and branches.

script/ is worth a look, because it holds three maintenance tools run with node: script/clean.mjs for cleaning generated files and installed dependencies, script/update-dependencies.mjs, and script/sort-package-json.mjs for sorting package files.

A local build does not mean you can deploy this

The Development Notes section is the most useful paragraph in the document, and it is a warning.

This repository contains a historical version of Hey and may require adjustments to run against currently available third-party infrastructure. The categories it names are specific: Lens Protocol APIs, GraphQL endpoints, RPC endpoints, third-party APIs, database schemas, authentication systems, storage providers, blockchain networks and wallet infrastructure.

That list is a map of everything outside your control.

The conclusion the README draws is the sentence to keep: a successful local build does not necessarily mean the application can be deployed to production without modification. That is not caution for its own sake. The code stopped being the production code on 2026-05-15, and every dependency it talks to has had five months to move since.

The licence is AGPL in two files and GPL-3.0 in the metadata

The repository metadata reports this project as GPL-3.0. The README and package.json both say AGPL-3.0, and the README is specific about which one, naming the GNU Affero General Public License v3.0 and linking the LICENSE file.

The AGPL reading is almost certainly the correct one, because AGPL-3.0 is written into package.json as the license field. But a tool that trusts the metadata will give you the wrong answer, and for a social network application the difference between GPL and AGPL is not academic: the Affero clause is what reaches users who interact with the software over a network rather than distributing it.

Two other fields in package.json are worth reading. The version is 0.0.0 and private is set to true, which is consistent with a snapshot nobody intends to publish to a registry.

There are no GitHub releases on this repository at all. The last push was on 2026-09-06, four months after the freeze, so something has been committed since, though the README does not say what.

Editorial conclusion

Treat this repository as an archive with a working development setup rather than as a product you can fork forward. It suits reading the codebase, teaching from it, or researching how a Lens Protocol social app was assembled with Apollo, Wagmi-adjacent wallet libraries and Vite. Do not plan a production deployment from it: the README states outright that a successful local build does not mean the application can be deployed without modification. If you want the real product, go to hey.xyz. If you want to run this, verify the external services listed in the development notes still resolve, because nine categories of third-party dependency are named as things that may have changed since May 2026.

Frequently asked questions

Official sources

1. Issues
2. License: GPL-3.0
3. Project website
4. README
5. slymnoyann/hey.xyz on GitHub