Project Browser hit stable: browse contrib and click 'Add and Install', no Composer, no terminal. But it needs a web-writable codebase and is local-dev-only — and that limitation isn't unfinished, it's a security decision in disguise (a writable codebase is exactly what production hosts forbid). Why the catch is the most reassuring part.
Planka 2.2.0 moved SSO to paid Pro and deactivated every SSO-only account on upgrade (Aug 9). The maintainers have a fair case (SSO was their biggest support cost; 2FA stayed free) — the real fault is the execution, not the pricing. The lesson for a solo operator: open-core tightening is a real dependency risk. Pin tags, read release notes, keep a break-glass admin.
Two fresh RCEs — Gitea's diffpatch hook (CVE-2026-60004, 9.8, open registration on by default) and n8n's Git node (CVE-2026-21877, 9.9) — make the one-box lesson concrete: default-open signup turns 'authenticated' RCE into anonymous RCE, and co-located apps share a blast radius. Kill open signup, segment Docker networks, don't co-locate automation with a public site.
File Browser (~35k stars) is being archived on Sept 1 — not from burnout but loss of will and a broken succession chain, in the maintainer's own words. Stars measure popularity, not resilience. The companion to my Jellyfin piece: a bus-factor checklist for what you actually inherit when you 'just self-host it'.
depends_on waits for 'running', not 'ready'. Docker does NOT restart an unhealthy-but-running container — restart policies key on exit code, not health. And a naive curl localhost returns 200 from Drupal's page cache while the DB is down. A Drupal-specific healthcheck that doesn't lie, and why healthcheck ≠ readiness ≠ monitoring ≠ alerting.
~82% of disaster-recovery setups are never tested. So I actually restored this blog cold into a throwaway container: 23MB dump in ~1s, fresh DB up in ~12s, restore in 3s, verified 47 articles back. The real lesson wasn't the sub-minute RTO — it was that the dump doesn't contain the secrets and config that actually make the site run.
Three core Jellyfin people, including the founder, stepped away in one week of July — mostly burnout, told fairly. The project isn't dying, despite the headlines. But it's a clean look at the bus factor of volunteer FOSS, and the unglamorous things a self-hoster should actually do about it.
Drupal 11.4.0 (July 1) added an experimental native command-line tool, dr, built by a team that includes the Drush maintainers. What it can and can't do yet, why 'the death of Drush' is the maintainers' own stated goal, and why that's the good version of a project handing off — not abandonment.
Docker Engine 29 (out since November, security-patched to 29.6.2 in July) makes the containerd image store the default for fresh installs and adds an experimental nftables backend. On a single Coolify VPS the danger isn't upgrading in place — it's a from-scratch rebuild, and one firewall switch you should not flip on prod.
My OVH renewal came in ~45% higher, and for once the host isn't being greedy: the world's affordable RAM is being fed to AI accelerators. Why DRAM contract prices nearly doubled, why 'just switch to Hetzner' doesn't help, why it won't ease before 2027 — and the actual tuning that made my 4GB box need less memory instead.
