Self-Hosted Weekly: Week 33, 2026. Jellyfin Exodus, rsync 33 CVEs, Podman 6.1

This was a rough week for the software most of us actually run. Jellyfin lost three of its most senior people in a matter of days. The rsync project shipped a release fixing 33 security issues at once, which is not a number you see on a 30-year-old backup tool. Podman patched a Quadlet bug that quietly left old content inside files you thought you'd replaced.

Here's what shipped, what broke, and what it means for your stack.

1. Jellyfin Lost Three Core Leaders in One Week

Project leader Joshua Boniface stepped down after 7.5 years, citing burnout and mental health. Co-founder Andrew Rabert left after disagreements over his desktop client rewrite, including pushback on his use of AI-assisted tooling. Core team member Anthony Lavado is leaving over shifting personal priorities and has offered to help with the transition.

None of this came out of nowhere. The team's "State of the Fin" post back in May flagged burnout as a growing problem, and named one specific cause: a flood of AI-generated pull requests that added review load without adding much value.

Hot take: The code isn't going anywhere and your server will keep transcoding on Monday. But institutional knowledge doesn't survive a departure, and Jellyfin just lost three people who held a lot of it. This is the honest risk profile of self-hosting community software. Your dependency runs through volunteers who can run out of energy, which behaves very differently from a vendor that can raise prices. The mitigation isn't running back to Plex. Keep your library metadata portable and your config in version control, so that whatever the project looks like in two years, your data isn't hostage to it. If you want the boring version, Jellyfin runs on Elestio with updates and backups handled.

2. Jellyfin Drops the "10." Prefix, Next Release Is 12.0

Amid all that, the project also settled a long-running versioning question. Jellyfin confirmed that 10.11.x is the last branch using the old scheme. The next major release goes straight to 12.0, skipping 11 to match internal sequencing. Release candidates are already out.

The reasoning: the project no longer expects the hard API break that the permanent 10. prefix was reserving space for, and users kept misreading what counted as a major release. Under the new scheme the first digit means significant changes, the second means bug and security fixes.

Hot take: Version numbers are documentation, and a prefix that never changes is documentation that lies. Good change. The practical warning is for anyone with automation pinned to 10.* tags, because that pattern stops matching once 12.0 ships. Check your Watchtower rules and Compose tags now rather than during an upgrade.

3. rsync 3.5.0 Fixes 33 Security Issues at Once

rsync 3.5.0 landed August 13 and the project's own NEWS file calls it an "extraordinary release." All 33 issues were found through a focused audit of path handling and the daemon protocol, a fuzzing pass against that protocol, and external researcher reports.

The pattern underneath most of them is symlinks: arbitrary file read via symlinked input files, arbitrary file write and privilege escalation via symlinked output paths. The fix is a hardened path-resolution framework, secure_relative_open(), which pins directory file descriptors and blocks out-of-tree symlink hops. Backports for the 3.4.1 and 3.2.7 branches are rolling out alongside it.

# Check what you're running
rsync --version | head -1

# Debian/Ubuntu
sudo apt update && sudo apt install --only-upgrade rsync

Hot take: If your backup script runs rsync as root over SSH, and most do, this is your weekend. The symlink class of bug is exactly the kind that sits unnoticed for years in a tool nobody thinks of as an attack surface, because rsync feels like plumbing rather than software. Finding 33 at once also tells you something encouraging: somebody finally sat down and audited it properly.

4. Podman 6.1 Adds Volume Rename and Patches a Quadlet File Bug

Podman 6.1 landed August 13 with podman volume rename, a podman machine restart command, and a new ImageVolume= key for Quadlet .container units.

The security note matters more than the features. CVE-2026-19730 meant podman quadlet install --replace didn't truncate the file it was replacing, so swapping a long unit file for a shorter one left trailing content from the original behind. A race condition that could corrupt systemd units also got fixed.

# Rename a volume (fails if a container is using it)
podman volume rename old-data-vol app-data-vol

Hot take: The --replace truncation bug is nastier than its CVE number suggests, because the failure is silent and your unit file looks fine until you read it closely. If you've been iterating on Quadlet units in place, go check your generated files against what you actually wrote before assuming they match.

5. Uptime Kuma 2.5.0 Waits Two Weeks Before Trusting Any npm Package

Uptime Kuma 2.5.0 adds an NTP monitor type, unlimited check intervals, a rootless Docker tag, and new notification providers. The change with the widest blast radius is a build policy: the project now applies a 14-day cooldown on npm dependency updates.

The logic is that when someone publishes a hijacked version of a package, it usually gets yanked within days of discovery. The projects that get burned are the ones pulling the newest version the moment it appears. Waiting two weeks means most poisoned releases are gone before the build ever sees them.

Hot take: This is the most quietly interesting thing any self-hosted project shipped this week. Uptime Kuma sits inside your network and holds credentials for the ninety-plus notification services it can reach, which makes its dependency tree a genuinely attractive target. Trading two weeks of dependency freshness for that much supply-chain surface reduction is a good deal, and patience is the only thing it spends. You can deploy Uptime Kuma on Elestio if you'd rather not manage the stack.

6. Paperless-ngx 3.0.5 Cleans Up After the 3.0 Release

Paperless-ngx 3.0.5 is a broad bug-fix and performance pass across search, custom fields, AI suggestions, PDF handling, email sending, and database behavior.

Two fixes stand out for anyone using the newer AI features: the AI suggestion cache is now keyed by model and endpoint, and custom field values are validated in bulk operations. There are also performance improvements to the vector store.

Hot take: Keying a suggestion cache by model and endpoint is the kind of fix that only exists because someone swapped their Ollama model and kept getting suggestions from the old one. That's a healthy 3.0.x line: the interesting features shipped, and now the team grinds through the consequences. Good time to upgrade if you sat out the 3.0 excitement. Paperless-ngx on Elestio if you want it managed.

7. Caddy 2.11.2 Adds zstd Log Rolling

Caddy 2.11.2 adds zstd compression for log rolling and deprecates roll_gzip in favor of a roll_compression directive that takes none, gzip, or zstd.

log {
    output file /var/log/caddy/access.log {
        roll_compression zstd
    }
}

Hot take: Small release, but roll_gzip is deprecated rather than removed, which means your config keeps working while quietly accumulating a warning nobody reads. Migrate now while it's a two-word change. Zstd at comparable ratios is meaningfully faster than gzip, which matters more than it sounds when you're rotating access logs on a busy reverse proxy.

8. Immich v3.1.0 Continues the Post-v3 Cleanup

Immich v3.1.0 is another round of quality-of-life improvements and bug fixes following the v3.0 major release in July.

Worth repeating the project's own upgrade guidance, because it catches people every cycle: the server is only compatible with the matching major version, so upgrade mobile clients first. And read release notes before updating if you run Watchtower, because Immich ships breaking changes at a pace automated updaters don't respect.

Hot take: "Point Watchtower at Immich and forget about it" remains bad advice, and the project says so itself. Pin to a major-version metatag like :v3 instead of :latest. That gets you patches without waking up to an unplanned schema migration. Immich runs on Elestio if you'd rather someone else sequence those upgrades.

What We're Watching Next Week

Who picks up Jellyfin's project lead role. Boniface held it for 7.5 years. How the team handles succession will say more about the project's next two years than any release note.

Distro backports of rsync 3.5. A fix list that long means a long tail of stable-branch backports. On Debian stable or an LTS Ubuntu, watch for the security advisory rather than waiting on 3.5.0 itself.

Whether the npm cooldown idea spreads. Uptime Kuma is small enough to change its build policy overnight. Watch whether anything larger follows.

Jellyfin 12.0 leaving RC. Release candidates are out. Check your version pins before it lands.

The Bottom Line

Patch rsync. That's the one item this week touching nearly everyone reading this, and running it as root over SSH is the default for most backup scripts.

The wider theme is maintainer sustainability, and Jellyfin is the visible case rather than the unusual one. A flood of low-quality AI-generated pull requests has become a real operational burden on volunteer projects, and it surfaces as burnout in the people who review them. The useful response isn't anxiety about your media server. It's keeping your data portable and, where it matters, putting money or contribution time behind the projects you depend on.

Elestio runs 400+ open source services fully managed, with patching and backups handled, if you'd rather spend your weekend on something other than CVE triage.

Thanks for reading ❤️ See you in the next one 👋