Self-Hosted Weekly: Week 36, 2026. AWS Buys DuckLabs, CRA Deadline, K8s 1.37

Short week, dense news. An acquisition that says a lot about how open-source governance is being structured in 2026, a compliance deadline that lands in seven days, and Kubernetes quietly shipping the feature that makes small clusters cheaper to run.

Here is what mattered.

1. AWS bought DuckLabs. DuckDB stayed put.

The deal was announced on August 26, closed on August 31, and the roughly 30-person Amsterdam team joined AWS on September 1. DuckDB creators Hannes Mühleisen and Mark Raasveldt went with them.

What did not move is the interesting part. The DuckDB project itself stays with the nonprofit DuckDB Foundation, still MIT licensed, and the Foundation is adding a technical advisory board to give community members a say in direction.

Our take: This is the structure everyone should be studying. The company got acquired, the project did not, because the project was never inside the company to begin with. Compare that to every "we were acquired, nothing will change" post that preceded a license flip. Foundation-held IP with the commercial entity separate is not a guarantee, but it is a much harder thing to quietly reverse. Worth noting for anyone eyeing the wider ecosystem: the pg_duckdb extension has been quiet since mid-July, with its last tagged release back in December. The core project is healthy; the surrounding extensions are a different question.

2. The EU Cyber Resilience Act starts biting on September 11

One week out. From September 11, manufacturers must report actively exploited vulnerabilities to ENISA and national CSIRTs within 24 hours of becoming aware of them. The obligation extends to products already on the EU market, not just new ones.

Our take: The detail that should worry you is operational, not legal. As of September 1, ENISA's Single Reporting Platform, the sole channel through which these reports must be filed, had no published URL. It goes live the same day the obligation does. Asking people to meet a 24-hour clock on a system nobody has been able to test is a choice. If you ship software into the EU, read the actual scope carefully, because the obligations land differently on manufacturers than on open-source stewards, and a blog summary is not the place to work out which one you are.

3. Kubernetes v1.37 can scale you to zero

Released August 26, with the feature blogs landing through the week. The headline for anyone running small: HorizontalPodAutoscaler can now scale workloads down to zero replicas, and as of 1.37 that is Beta and enabled by default.

Our take: Scale-to-zero has been the standard argument for serverless over self-hosting for years. Having it upstream and on by default removes a real line item from that comparison. If you run internal tools that sit idle most of the day, this is the release that pays for itself. The same week also brought etcd RangeStream cutting memory on large list reads and the Metrics API graduating to stable, both unglamorous and both the kind of thing you feel on a small cluster.

4. Home Assistant 2026.9 makes Modbus almost pleasant

Shipped September 2. Integrations can now share a single Modbus connection and you pick your device in the UI instead of hand-writing register maps in YAML. Also landed: a Matter network map showing Thread versus Wi-Fi and signal strength, Activity entries that explain what actually triggered a change, and a new speech-to-text engine for Cloud subscribers.

Our take: The Activity explanations are the sleeper feature. "Which automation did this" has been the single most annoying question to answer in Home Assistant, and clickable links through to traces is a genuine quality-of-life fix. The Modbus work matters more than it sounds if you have industrial gear.

5. Audacity 4.0, rebuilt on Qt

Landed September 3 after a beta cycle through August. Complete interface rebuild, new clip-editing workflow, Workspaces, HiDPI support, and a new AUP4 project format.

Our take: A new project format means a one-way door. Test your archive before you upgrade the machine you actually work on, because "opens fine in 4.0" and "still opens in 3.7" are not the same claim.

6. Jellyfin 12 is on release candidate seven

RC7 arrived August 31. RC4 was August 2. The 12.0 cycle has been running a long time.

Our take: We are not going to pretend this is bad news. A long RC cycle on a media server that people point their entire family at is the correct instinct. Ship it when the migrations are safe.

7. Immich 3.2 is in RC as well

RC2 on August 31, with 3.1.0 from late July still the current stable.

Our take: Immich has earned enough trust that people run it as their only copy of family photos, which is exactly why you should not run release candidates on it. Wait for stable, and check your backups either way.

8. Patch week across the stack

A lot of maintenance shipped quietly:

Our take: Nothing here is dramatic, which is the point. Patch releases are where self-hosting is actually won or lost, and "I will do it next month" is how people end up on a version with a known advisory. If you run these on Elestio, automatic updates already handled most of this while you were reading about DuckDB.

What we are watching next week

September 11. The CRA reporting obligation starts and ENISA's platform goes live the same day. Whether that goes smoothly is the story.

Jellyfin 12 and Immich 3.2. Both sitting in RC. Either could go stable, and both are upgrades worth planning rather than improvising.

DuckDB Foundation's advisory board. Who actually gets appointed will tell you more about the governance promise than the press release did.

The bottom line

The DuckLabs deal is the one to remember. Not because the acquisition itself is dramatic, but because it demonstrates a structure where the commercial entity can be bought without the project going with it. That is worth more to self-hosters than any individual release.

Everything else this week rewards the same boring discipline: patch regularly, stay off release candidates for the things you cannot afford to lose, and read compliance scope carefully rather than trusting a summary.

See you next Friday 👋