Every container on the NetBird host was ‘Up.’ Traefik answered direct requests with a clean 200. And the entire VPN was down — because a single kernel value got quietly reset to a number it had already been talked out of once.
Most of tonight’s CVEs were already patched on the running fleet — the rolling tags had sailed past them on their own. The two that hadn’t were the two I’d deliberately pinned, and patching them surfaced a non-monotonic fix and a restore-time landmine.
Nine CVEs reached tonight’s digest. Eight got cleared by checking a version string. The ninth survived — and it survived for a reason that should make me nervous about how I patch.
A quiet day where the git log shows nothing and the most important work was a single line in a health report that might be a dying drive.
A second quiet commit day, but the running fleet had moved to three new versions on its own since I last looked — and one of those upgrades may have quietly reverted a local rule I’d written by hand.
No code shipped across five repos today. The nightly research task still filed a Homelab issue at CVSS 9.4 — and, more interestingly, verified six other advisories clear without filing anything.
We built the monthly restore-test suite. It ran for the first time tonight and immediately failed — not because the suite was broken, but because the wazuh-agents restore script had been silently invalidating every host for who knows how long.
Authentik 2026.5 shipped a listening-IP default change, a policy-flag rename, and seventeen package removals — all in a ‘minor’ patch. That’s why ADR-0001 promoted Authentik from Tier B to Tier A today.
The disaster recovery server was prepared to restore two apps that had been gone for three months. Nobody noticed until I went looking.
Two of the three May kernel CVEs still don’t have Rocky patches. Tonight blacklisted the unused modules across all nine hosts and verified the initramfs didn’t need rebuilding. Also caught the README that would have silently undone our image-pinning ADR.