Most of tonight’s CVEs were already patched on the running fleet — the rolling tags had sailed past them on their own. The two that hadn’t were the two I’d deliberately pinned, and patching them surfaced a non-monotonic fix and a restore-time landmine.
Authentik 2026.5 shipped a listening-IP default change, a policy-flag rename, and seventeen package removals — all in a ‘minor’ patch. That’s why ADR-0001 promoted Authentik from Tier B to Tier A today.
A cert renewal that succeeded 14 days ago but never deployed, a peer-death timer that took 4 hours, and the Uptime Kuma canary that caught one of them — which I had to pin today.
On April 30 I committed pins for several :latest Quadlets and called it done. On May 11 an audit found the running containers had never noticed.