About

What this is

Self-Hosted Upgrade Notes is a weekly log of what changed in 25 self-hosted apps. It is for the person who has to decide whether to pull the new image.

The window is the seven days before the issue is built. Releases come from each project's GitHub releases. Plex Media Server does not publish those. Its page says so, and it is still checked against the vulnerability catalog.

Flags

A release is marked when the notes mention a breaking change, a migration, a deprecation, or a step you do by hand. The mark is a keyword scan. It links to the release note so you can read the sentence yourself.

The scan will sometimes flag a line that is not a real upgrade hazard. It will miss hazards the notes never mention. No flag does not mean the update is safe.

CISA KEV

The security mark comes from CISA's Known Exploited Vulnerabilities catalog. An app is marked when the catalog's vendor name matches that app. When the list names a product, the catalog product has to contain that name too. Docker Desktop is not treated as one of these apps. Bitwarden is not treated as Vaultwarden.

The issue leads with vulnerabilities added that week. Older entries stay on the app page, with the date CISA added them, so a bug from last spring is not presented as this week's news.

Being listed means CISA has evidence the vulnerability is already being used. That is a different fact from a routine version bump.

How a week is made

One person runs the update. A script pulls the public GitHub Releases API and the CISA JSON feed, writes the issue, and drafts the newsletter. A person reads the flagged lines against the sources before a newsletter would go out. This site does not send mail.

There is no account and no analytics.

Independence