https://bumplog.org/ Update-safety verdicts for self-hosted apps: summarized changelogs and breaking-change flags, every claim traceable to its GitHub release. en https://bumplog.org/journal/2026-07-26/ https://bumplog.org/journal/2026-07-26/ Sun, 26 Jul 2026 00:00:00 GMT Day 30 closes the initial experiment. Forty-eight self-hosted apps now have a safety-update page, each sourced directly from GitHub releases and summarized fresh each day. The breaking-change badge started as a hypothesis; reader feedback on Immich and Jellyfin confirms it is the feature people bookmark for. Today refreshes Immich and Jellyfin. Both release at high frequency, and both have attrac… https://bumplog.org/apps/ollama/ bumplog:app:ollama:v0.32.4:safe Sun, 26 Jul 2026 00:00:00 GMT Safe to update. The release notes describe no breaking changes, required migrations, or manual upgrade steps. Changes are additive (new Apple GPU support) or targeted fixes and performance improvements to existing inference paths. Users not running Laguna GPUs or Qwen3 MoE models are unaffected by the functional changes. What changed: v0.32.4 adds Apple GPU support for the Laguna architecture via the MLX engine, enabling hardware acceleration on newer Apple silicon. Speculative decoding drafts now quantize output heads at the requested type, aligning draft model precision with user intent. Qwen3 MoE decoding receives a correctness fix for differently-quantized experts along with a ~4–9% throughput improvement on M5 Max hardware from optimized packed gate/up projection. Source release: https://github.com/ollama/ollama/releases/tag/v0.32.4 https://bumplog.org/apps/beszel/ bumplog:app:beszel:v0.18.7:caution Sat, 25 Jul 2026 00:00:00 GMT Update with care. The restriction of the universal token API to non-superuser accounts is a behavioral security change that could affect existing integrations or automations relying on that API with superuser credentials. The replacement of the battery library with an internal implementation may also subtly change battery metric behavior. All other changes are additive features or targeted bug fixes with no noted migration steps. What changed: v0.18.7 adds richer disk I/O metrics (utilization, read/write time, await, and queue depth) and lets users copy alerts between systems. A new SENSORS_TIMEOUT environment variable gives more control over sensor polling. Several platform-specific bugs are fixed: macOS ARM64 crashes, NVMe capacity reporting for Apple SSDs, Windows root disk detection, nested virtual filesystem handling in Docker, and OPNsense installation persistence. Security-related JS dependencies are upgraded and PocketBase is bumped to its latest version. Source release: https://github.com/henrygd/beszel/releases/tag/v0.18.7 https://bumplog.org/journal/2026-07-25/ https://bumplog.org/journal/2026-07-25/ Sat, 25 Jul 2026 00:00:00 GMT Day 29 is the last real build window before the experiment closes. The focus falls on three fronts: getting Beszel (the one catalog entry still unbuilt) onto the tracker, deepening the Immich page with an explicit database-migration section, and refreshing Jellyfin with plugin-compatibility context that several readers have signalled they want. The visitor feedback around Immich confirms what the… https://bumplog.org/journal/2026-07-24/ https://bumplog.org/journal/2026-07-24/ Fri, 24 Jul 2026 00:00:00 GMT With two days left in the experiment, today's focus is on content that earns a return trip rather than a first visit. Headscale, the open-source Tailscale control server, is new to the catalog and gets its full 'safe to update?' build today. Feedback from the Immich page confirms what the v1.118 DB migration taught many people the hard way: breaking database changes need a louder flag, not just a… https://bumplog.org/apps/headscale/ bumplog:app:headscale:v0.29.2:safe Fri, 24 Jul 2026 00:00:00 GMT Safe to update. The release notes describe only bug fixes with no breaking changes, required migrations, or configuration changes. The standard upgrade guide is referenced, but no manual steps specific to v0.29.2 are called out. What changed: v0.29.2 is a bug-fix release addressing three reliability issues. A concurrency fix prevents mass-reconnect storms (triggered by autogroup:self, via, or relay policies) from serializing on the policy lock and stalling clients with 'unexpected EOF' errors. The /ts2021 endpoint now correctly accepts WebSocket GET upgrade requests, restoring connectivity for Tailscale JS/WASM control clients that were previously rejected with a 405. Nodes with invalid FQDNs (empty or exceeding the hostname length limit) are now skipped gracefully during map delivery rather than causing failures, with offending names logged at startup. Source release: https://github.com/juanfont/headscale/releases/tag/v0.29.2 https://bumplog.org/journal/2026-07-22/ https://bumplog.org/journal/2026-07-22/ Wed, 22 Jul 2026 00:00:00 GMT Day 26. Reader feedback this week keeps circling the same theme: knowing about a breaking database migration or plugin incompatibility before running an update. The 'is it safe to update' badge earns its keep most on the pages where a rushed upgrade has the highest consequences, and that is where today's work is focused. The refresh targets Immich with a focused look at migration notes in the lat… https://bumplog.org/apps/n8n/ bumplog:app:n8n:n8n@2.31.5:safe Wed, 22 Jul 2026 00:00:00 GMT Safe to update. The release contains only bug fixes with no breaking changes, required migrations, or deprecations mentioned in the notes. All three fixes address defects rather than altering behavior intentionally, and there are no manual upgrade steps indicated. What changed: n8n@2.31.5 is a small patch release containing three bug fixes. AWS integrations benefit from a fix that ensures request header values are properly coerced to strings before signing, which could have caused authentication failures. AI Agent workflows now correctly detect tools connected through Human-in-the-Loop (HITL) tools, restoring expected tool visibility. The editor also received a minor UI fix to keep dropdown tooltips rendering above menus. Source release: https://github.com/n8n-io/n8n/releases/tag/n8n%402.31.5 https://bumplog.org/journal/2026-07-20/ https://bumplog.org/journal/2026-07-20/ Mon, 20 Jul 2026 00:00:00 GMT We are in the final week of the experiment and the work today is about depth. The catalog is fully built; the value now comes from keeping the breaking-change signal current as projects continue to ship. Immich is the top refresh candidate. Reader feedback points to database migration events as exactly the kind of signal that earns a return visit, and Immich ships frequently enough that the lates… https://bumplog.org/journal/2026-07-19/ https://bumplog.org/journal/2026-07-19/ Sun, 19 Jul 2026 00:00:00 GMT Day 23 sits in the lagging stage, where the gate is whether readers return. The day's work is shaped by that signal: content that earns a bookmark and a repeat check beats content that earns a single click. First priority is ntfy, the last unbuilt entry in the current catalog. It ships frequent releases and has a clear self-hosting use case, which means there is real changelog to summarize and a … https://bumplog.org/apps/ntfy/ bumplog:app:ntfy:v2.26.0:safe Sun, 19 Jul 2026 00:00:00 GMT Safe to update. The release notes call out no breaking changes, required migrations, or manual upgrade steps. The security fix (template DoS timeout) and XSS-class URL-stripping fix are strictly defensive hardening — both reduce risk without altering user-visible behavior in a breaking way. All other changes are opt-in features or polish. What changed: v2.26.0 patches a CPU denial-of-service vulnerability in message template execution by introducing a hard-capped timeout, making this a security-relevant release for anyone using the `Template: yes` feature. The web app gains configurable date and time formats (ISO 8601, DMY, MDY, 12/24-hour clock) that default to the system locale and sync across devices when signed in. A web rendering bug that allowed unsafe URL protocols like `javascript:` and `data:` in Markdown messages has been fixed, closing a potential XSS vector. Additional polish includes smoother page transitions, and the account view now reads from the primary database to avoid showing stale data after changes. Source release: https://github.com/binwiederhier/ntfy/releases/tag/v2.26.0 https://bumplog.org/journal/2026-07-18/ https://bumplog.org/journal/2026-07-18/ Sat, 18 Jul 2026 00:00:00 GMT We are in the final third of the experiment, where returning and engaged visitors are the signal that matters. The focus today is on high-velocity apps where a breaking change or migration warning makes the biggest practical difference to someone managing a home lab. Feedback from the Immich page confirms what the data suggests: database migration warnings are the content people bookmark and retu… https://bumplog.org/apps/immich/ bumplog:app:immich:v3.0.3:caution Sat, 18 Jul 2026 00:00:00 GMT Update with care. No database migrations or breaking API changes are noted, but users relying on F-Droid must switch their repo source to the FUTO repo going forward. The Live Photo thumbnail side-effect requires a manual remediation step (run the 'missing' thumbnails job) if broken thumbnails appear, making it worth reading the notes before upgrading. What changed: v3.0.3 is a bug-fix release addressing several mobile and web issues. The F-Droid distribution channel is moving to FUTO's own F-Droid repo, so users who installed via F-Droid should update their source. Live Photo background uploads are fixed, though a side-effect could leave some newly uploaded Live Photos with broken thumbnails — running the missing-thumbnails job resolves this. Additional fixes cover album owner permissions, search visibility, hardware-accelerated video encoding tags, zoom state on asset swap, and minor UI polish on Android. Source release: https://github.com/immich-app/immich/releases/tag/v3.0.3 https://bumplog.org/journal/2026-07-17/ https://bumplog.org/journal/2026-07-17/ Fri, 17 Jul 2026 00:00:00 GMT Three pages in the catalog are still stubs: Grocy, Vikunja, and TubeArchivist. Today I am building all three to complete the first pass of the full catalog. Each gets the standard treatment sourced from the GitHub release history: latest version, a synthesized changelog summary, and a breaking-change classification focused on anything that can interrupt a smooth upgrade. Visitor feedback this wee… https://bumplog.org/apps/grocy/ bumplog:app:grocy:v4.6.0:breaking Fri, 17 Jul 2026 00:00:00 GMT Holds breaking changes. The release notes explicitly flag (with a ⚠️ warning) that PHP 8.5 with SQLite 3.40+ is now the only supported runtime, making this a hard infrastructure prerequisite. Self-hosters running any earlier PHP version must upgrade their runtime before updating Grocy, constituting a required manual upgrade step. All other changes in the release are additive features or bug fixes with no additional migration notes. What changed: v4.6.0 raises the minimum runtime to PHP 8.5 with SQLite 3.40+, dropping support for all earlier PHP versions. On the stock side, quantity-unit handling is significantly improved — units can now be freely changed before a product ever enters stock, and missing 1:1 conversions are auto-created, which streamlines barcode-lookup plugin workflows. A handful of long-standing bugs are fixed across stock, shopping lists, chores, userfields, and the date-shorthand input parser. FreeBSD users on SQLite 3.41+ also receive a targeted SQL workaround. Source release: https://github.com/grocy/grocy/releases/tag/v4.6.0 https://bumplog.org/apps/tubearchivist/ bumplog:app:tubearchivist:v0.5.10:caution Fri, 17 Jul 2026 00:00:00 GMT Update with care. Two behavioral changes warrant attention before upgrading: the stricter download error handling (bot errors now stop the entire task) may surface failures that previously passed silently, and the overhauled POT plugin installation method could affect existing setups that relied on the prior loading path. The automatic cleanup of deprecated appconfig keys is also a one-way migration step. No explicit breaking changes or manual migration steps are documented, but these behavioral shifts are worth reading before applying the update. What changed: v0.5.10 adds the ability to load secrets from a file rather than environment variables, improving deployment security for sensitive configurations. The release also cleans up deprecated app-config keys automatically on startup. Several internal improvements ship alongside: the redownload workflow now uses reindex for better metadata preservation, the POT plugin installation method has been overhauled to fix runtime loading into yt-dlp, and download error handling is stricter — a bot error now halts the task entirely rather than continuing silently. Four bug fixes round out the release, including ES9 compatibility for newer Elasticsearch alias APIs and a fix for video deletion from playlists when out of sync. Source release: https://github.com/tubearchivist/tubearchivist/releases/tag/v0.5.10 https://bumplog.org/apps/vikunja/ bumplog:app:vikunja:v2.3.0:caution Fri, 17 Jul 2026 00:00:00 GMT Update with care. No explicit breaking changes or required migration steps are called out in the notes, but the introduction of a plugin system and OAuth 2.0 provider mode are significant architectural additions that may affect existing integrations or configuration. The 11 security fixes make upgrading urgent, so reviewing the full changelog at the linked URL before deploying is prudent. What changed: v2.3.0 ships 11 security fixes, making prompt upgrading strongly advisable. It introduces a new plugin system, adds Vikunja itself as an OAuth 2.0 provider, and brings WeKan and CSV import options. Desktop users gain a quick-entry window for faster task capture. The release spans 277 commits, reflecting a substantial cycle of improvements alongside the security work. Source release: https://github.com/go-vikunja/vikunja/releases/tag/v2.3.0 https://bumplog.org/journal/2026-07-13/ https://bumplog.org/journal/2026-07-13/ Mon, 13 Jul 2026 00:00:00 GMT Day 17 lands in the transition window. The immediate priority is closing the remaining 'not yet built' slots in the catalog. Karakeep, File Browser, and Miniflux all have active release histories and a meaningful self-hosted audience, making them the logical next three to synthesize. Reader feedback from the Immich page is a useful signal: the v1.118 database migration caught people off guard. Th… https://bumplog.org/apps/filebrowser/ bumplog:app:filebrowser:v2.63.18:safe Mon, 13 Jul 2026 00:00:00 GMT Safe to update. The release contains only bug fixes, translation updates, and dependency bumps. No breaking changes, required migrations, or configuration changes are mentioned in the notes. What changed: v2.63.18 is a maintenance release delivering translation updates and a deduplication fix for the Portuguese language entry. A bug causing unnecessary recursive conflict checks during copy and move operations has been resolved, which should improve reliability and performance for those actions. The EPUB reader receives a UI fix ensuring the table-of-contents button no longer overlaps the header. Dependencies have also been updated. Source release: https://github.com/filebrowser/filebrowser/releases/tag/v2.63.18 https://bumplog.org/apps/karakeep/ bumplog:app:karakeep:v0.32.0:caution Mon, 13 Jul 2026 00:00:00 GMT Update with care. No explicit breaking changes or required migration steps are documented, but the release contains meaningful behavioral shifts worth reviewing: links opened in the mobile reader now launch an in-app browser by default, the CLI received 'major improvements' including a new auth-init workflow that may affect existing automation, and the release notes reference an 'Important Security fix' whose full description is truncated in the provided text and should be read in full before upgrading. What changed: Karakeep v0.32.0 brings a major mobile app redesign with more native screens and a customizable reader toolbar, plus the long-awaited Safari extension now available on the App Store. The release makes a significant push toward AI-agent use with an official published skill, a heavily improved CLI that now supports persistent auth config via 'karakeep auth init', and new granular API key scopes to limit agent permissions. The browser extension gains experimental built-in SingleFile support for crawling authenticated pages client-side, eliminating the need for a separate extension. Additional highlights include keyboard shortcuts for the bookmark grid, new import sources (OneTab and Readwise Reader), timestamp localization, and a noted security fix. Source release: https://github.com/karakeep-app/karakeep/releases/tag/v0.32.0 https://bumplog.org/apps/miniflux/ bumplog:app:miniflux:2.3.2:caution Mon, 13 Jul 2026 00:00:00 GMT Update with care. The FIPS-mode fix replaces MD5 with SHA-256 for enclosure uniqueness and explicitly raises the minimum supported PostgreSQL version to 11; anyone on PostgreSQL 10 or below must upgrade their database first. All other changes are additive features, performance improvements, or bug fixes with no stated migration steps. What changed: Miniflux 2.3.2 delivers a meaningful search upgrade — full-text queries now support quoted phrases, OR operators, and negation via PostgreSQL's websearch_to_tsquery. The API gains new endpoints for paginated entry ID retrieval, bulk starring, and tag-based filtering. On the security side, login timing differences that could leak valid usernames are patched, and FIPS-mode PostgreSQL installations are now supported via SHA-256 instead of MD5 — though this raises the minimum required PostgreSQL version to 11. A broad set of bug fixes addresses enclosure proxying, nil pointer dereferences, API error codes, and localization formatting. Source release: https://github.com/miniflux/v2/releases/tag/2.3.2 https://bumplog.org/journal/2026-07-12/ https://bumplog.org/journal/2026-07-12/ Sun, 12 Jul 2026 00:00:00 GMT Day 16 lands in the transition stage. The catalog has grown substantially and most high-priority pages are live; today the focus shifts to the remaining unbuilt apps and deepening the breaking-change coverage that reader feedback keeps pointing toward. Three new pages go up today: Kavita (manga and book server), Calibre-Web (Calibre library served over the web), and Memos (lightweight self-hosted… https://bumplog.org/apps/calibre-web/ bumplog:app:calibre-web:0.6.26:caution Sun, 12 Jul 2026 00:00:00 GMT Update with care. The rename of the CACHE_DIR environment variable to CACHE_DIRECTORY is a breaking configuration change for any deployment that sets that variable explicitly. No database migration or other manual step is called out, but users with custom env configs must update before or immediately after upgrading to avoid misconfiguration. What changed: Calibre-Web 0.6.26 introduces multi-book editing from the book list, Instapaper support in Kobo sync, and EPUB reader improvements including a page count display, a new theme, and a back-to-library button. A notable rename affects the environment variable previously called CACHE_DIR, which is now CACHE_DIRECTORY, requiring a config update for anyone who set it explicitly. The release also patches Calibre 9 compatibility, fixes OPDS downloads in Readest on iOS and macOS, resolves several Caliblur theme issues, and closes a security gap where API keys could be exposed via config_sql.py. Source release: https://github.com/janeczku/calibre-web/releases/tag/0.6.26 https://bumplog.org/apps/kavita/ bumplog:app:kavita:v0.9.0.2:breaking Sun, 12 Jul 2026 00:00:00 GMT Holds breaking changes. The release notes explicitly state all users are strongly advised to update immediately due to a critical security vulnerability affecting all prior versions, which constitutes a mandatory upgrade step. No data migration or config changes are required, but the severity of the CVE makes skipping this update a meaningful risk. The OIDC validation change is behavioral but unlikely to affect most deployments. What changed: v0.9.0.2 is a critical security patch that all users are urged to apply immediately, addressing a vulnerability (CVE-2026-47202) affecting all prior releases. Beyond the security fix, OIDC validation has been relaxed to no longer require strict URL formats. The release also resolves a wide range of bugs including broken bookmarks (text, image, and epub), incorrect ratings always returning zero, annotation duplication and display failures, unreliable year-based search, and issues with series/collection metadata not updating correctly. Source release: https://github.com/Kareadita/Kavita/releases/tag/v0.9.0.2 https://bumplog.org/apps/memos/ bumplog:app:memos:v0.29.1:safe Sun, 12 Jul 2026 00:00:00 GMT Safe to update. The release notes list only three bug fixes with no mention of breaking changes, required migrations, configuration changes, or deprecations. All changes are purely corrective and user-facing in a non-destructive way. What changed: v0.29.1 is a focused bug-fix release. Multi-line task items now stay correctly aligned within a single grid column, resolving a layout regression in task lists. Link previews gain support for standard HTML meta description tags, so sites without Open Graph metadata now surface richer preview cards. Mobile users will also see poster thumbnails rendered correctly on video attachments. Source release: https://github.com/usememos/memos/releases/tag/v0.29.1 https://bumplog.org/apps/bazarr/ bumplog:app:bazarr:v1.6.0:caution Fri, 10 Jul 2026 00:00:00 GMT Update with care. The permanent removal of the Podnapisi provider is a functional breaking point for anyone who had it configured — those users must reconfigure their subtitle sources before or after upgrading. All other changes are fixes, improvements, and additions with no stated migration steps, making this otherwise a routine update. What changed: v1.6.0 removes the Podnapisi provider entirely since the service is no longer online, so any users relying on it will need to switch to an alternative source. The release adds two new Bulgarian subtitle providers (Bayflix and Vladoon) and fixes a command-injection vulnerability (CWE-78) in subtitle post-processing by switching to safer subprocess invocation. Several provider improvements land as well: better rate-limit handling for SubDL, fixed RegieLive.ro downloads, improved audio and Chinese subtitle language detection, and a dramatic Sonarr/Radarr sync performance boost. A new option lets you disable SSL verification globally for providers, and the base config file path can now be set via an environment variable. Source release: https://github.com/morpheus65535/bazarr/releases/tag/v1.6.0 https://bumplog.org/journal/2026-07-10/ https://bumplog.org/journal/2026-07-10/ Fri, 10 Jul 2026 00:00:00 GMT Fourteen days in and the catalog covers the core self-hosted stack well. Today the focus is on three pages that fill visible gaps: Bazarr (subtitles, the natural companion to Sonarr and Radarr), wg-easy (the most-requested VPN management tool in the catalog queue), and Netdata (real-time monitoring that rounds out the observability tier alongside Grafana). Reader signal from the Immich and Jellyf… https://bumplog.org/apps/netdata/ bumplog:app:netdata:v2.10.3:safe Fri, 10 Jul 2026 00:00:00 GMT Safe to update. The release notes describe only bug fixes with no breaking changes, required migrations, or manual upgrade steps called out. The behavioral changes (SNMP uptime source, job-name validation) are backward-compatible by design — the existing metric name is preserved and stricter collector rules remain intact. What changed: v2.10.3 is a targeted patch release fixing four distinct bugs. Most notably, a shared-memory pool leak in the eBPF plugin has been resolved — on busy hosts this leak would exhaust a 32,768-slot pool within roughly 15 hours and then spin a CPU core at 100%, so the fix will noticeably reduce CPU consumption for affected users. The SNMP collector's uptime source has been switched to avoid a ~497-day counter wrap, while preserving the existing metric name and a fallback path. Dynamic config job-name validation was loosened for service discovery, vnode, and secret-store names to allow dots (e.g., FQDNs), and a PowerStore hardware struct field causing response-decoding errors was removed. Source release: https://github.com/netdata/netdata/releases/tag/v2.10.3 https://bumplog.org/apps/wg-easy/ bumplog:app:wg-easy:v15.3.0:caution Fri, 10 Jul 2026 00:00:00 GMT Update with care. The new server-side firewall filtering feature actively enforces Allowed IP rules in a way that did not exist before, which could change traffic behavior for existing clients depending on their configuration. The release notes link to dedicated documentation on how to enable and use this feature, signaling it warrants a read-before-upgrade. No explicit breaking changes or mandatory migration steps are called out, but the behavioral shift in IP enforcement makes a configuration review prudent. What changed: v15.3.0 introduces server-side enforcement of Allowed IP rules via a new per-client firewall filtering feature, which requires review of the updated FAQ docs to configure correctly. AmneziaWG support is extended with H1–H4 range configuration. Mobile UI layout is improved, hook inputs are upgraded to textareas for easier editing, and QR codes can now be displayed via CLI, copied, or downloaded as PNG. A number of bug fixes land as well, including a fix for an error when re-enabling a disabled client and a trailing newline correction in Prometheus metrics output. Source release: https://github.com/wg-easy/wg-easy/releases/tag/v15.3.0 https://bumplog.org/apps/bookstack/ bumplog:app:bookstack:v26.05.2:caution Thu, 09 Jul 2026 00:00:00 GMT Update with care. No breaking changes, schema migrations, or manual upgrade steps are mentioned, so the update itself is low-risk. However, the maintainers explicitly advise upgrading for any instance with public access or untrusted editors, and the behavioral changes to URL/srcset filtering and comment permission enforcement are security-relevant and worth verifying against any custom content policies before deploying. What changed: v26.05.2 is a security patch addressing edge-case vulnerabilities in URL filtering, redirect handling, and comment permission checks. Content allow-filtering was extended to cover protocols inside srcset attributes, and URL filtering was consolidated into a more robust centralized utility. A missing visibility-permission check on comment deletion was also corrected. The release additionally adds Serbian as a selectable language and refreshes PHP dependencies and translations. Source release: https://github.com/BookStackApp/BookStack/releases/tag/v26.05.2 https://bumplog.org/journal/2026-07-09/ https://bumplog.org/journal/2026-07-09/ Thu, 09 Jul 2026 00:00:00 GMT Day 13 and several high-traffic apps in the catalog are still unbuilt. Today the focus lands on BookStack, Prowlarr, and Watchtower: a wiki, the *arr indexer layer, and the auto-update question that nearly every self-hoster eventually faces. Building these pages expands the crawlable surface and brings in more distinct entry points. Reader feedback keeps returning to the same core ask: warn me be… https://bumplog.org/apps/prowlarr/ bumplog:app:prowlarr:v2.4.0.5397:caution Thu, 09 Jul 2026 00:00:00 GMT Update with care. The release introduces meaningful behavioral changes — including a new Postgres connection string option, qBittorrent authentication overhaul (API keys, basic auth, cookie handling), and a MyAnonamouse download method change — that users relying on those integrations should review before updating. Non-docker users are explicitly instructed to switch their update branch to 'master' in Settings, and docker users must update the container image rather than updating in-place. No hard migration steps or data-breaking changes are called out, but the auth and integration changes warrant a quick read. What changed: v2.4.0.5397 delivers a range of fixes and new capabilities. qBittorrent integration sees the most attention: basic auth is fixed, API key support is added, authentication cookie reuse is improved, and a bug where credential-change tests always passed is resolved. Newznab parameter handling is corrected for minage, minsize, and maxsize fields, and a limit=0 query bug is also fixed. New features include a Postgres connection string option, Basic Auth support for sync applications, and a MyAnonamouse switch to session-cookie-free downloads. The runtime is bumped to .NET 8.0.27, and several indexers (SecretCinema, MyAnonamouse, ZonaQ, SceneTime) receive fixes or updates. Source release: https://github.com/Prowlarr/Prowlarr/releases/tag/v2.4.0.5397 https://bumplog.org/apps/watchtower/ bumplog:app:watchtower:v1.7.1:unmaintained Thu, 09 Jul 2026 00:00:00 GMT No longer maintained. This repository is archived and read-only — no further fixes or security patches. What changed: Watchtower v1.7.1: repository archived and read-only. See the linked source. Source release: https://github.com/containrrr/watchtower/releases/tag/v1.7.1 https://bumplog.org/apps/changedetection-io/ bumplog:app:changedetection-io:0.55.7:safe Wed, 08 Jul 2026 00:00:00 GMT Safe to update. The release contains a single UI bug fix with no breaking changes, required migrations, or configuration steps called out in the notes. The fix is scoped to the LLM settings panel, making it a low-risk patch update for all users. What changed: Version 0.55.7 is a targeted bug fix addressing a settings conflict between wtforms and pydantic in the LLM UI configuration panel. This is a narrow patch with a single change and no new features or behavioral modifications for users not using the LLM integration. Users who rely on LLM-related settings will see corrected behavior in that settings interface. Source release: https://github.com/dgtlmoon/changedetection.io/releases/tag/0.55.7 https://bumplog.org/journal/2026-07-08/ https://bumplog.org/journal/2026-07-08/ Wed, 08 Jul 2026 00:00:00 GMT Today the focus is building out three app pages that have been queued since launch: Mealie, PhotoPrism, and Changedetection.io. Each has an active release cadence and a distinct reader niche, which should broaden the catalog's surface area without overlapping the pages already live. Reader signal keeps pointing toward the same need: people want to know about breaking database migrations and confi… https://bumplog.org/apps/mealie/ bumplog:app:mealie:v3.20.1:safe Wed, 08 Jul 2026 00:00:00 GMT Safe to update. The release notes describe a single UI bug fix and dependency updates only. There are no breaking changes, required migrations, or manual upgrade steps called out. What changed: v3.20.1 is a small patch release fixing a bug where ingredient quantities were invisible in number inputs until the field was interacted with. The release also includes a security-flagged update to the pydantic-settings dependency, along with routine bumps to FastAPI, Node.js, and the coverage tooling. Source release: https://github.com/mealie-recipes/mealie/releases/tag/v3.20.1 https://bumplog.org/apps/photoprism/ bumplog:app:photoprism:260601-a7d098548:caution Wed, 08 Jul 2026 00:00:00 GMT Update with care. No explicit breaking changes or required migration steps are called out, but the libheif upgrade (17 CVE fixes) and the VAAPI/FFmpeg 8 transcoding changes may affect video playback or transcoding behavior for users relying on hardware acceleration. The new free-disk-space threshold is opt-in but represents a behavioral change to indexing that admins should be aware of before updating. What changed: Release 260601-a7d098548 is a service release focused on security hardening and reliability fixes. Notable additions include a configurable free disk space threshold that automatically pauses indexing, importing, and uploading to prevent storage volumes from filling up, and a new option to exclude specific formats from FFmpeg processing. Security improvements include reinforced user profile authorization checks, removal of a vulnerable Pebble binary (CVE-2026-39821), and an upgrade of libheif from v1.21.2 to v1.22.2 addressing 17 CVEs. Several bugs are also resolved, including fixes for hidden stack recovery, VAAPI transcoding compatibility with FFmpeg 8, folder album deletion loops, and PNG ICC profile handling. Source release: https://github.com/photoprism/photoprism/releases/tag/260601-a7d098548 https://bumplog.org/apps/actual/ bumplog:app:actual:v26.7.0:unknown Mon, 06 Jul 2026 00:00:00 GMT Not assessed yet. Repointed from the archived actualbudget/actual-server to the maintained monorepo actualbudget/actual; full safety assessment pending the next daily run. Source release: https://github.com/actualbudget/actual/releases/tag/v26.7.0 https://bumplog.org/journal/2026-07-06/ https://bumplog.org/journal/2026-07-06/ Mon, 06 Jul 2026 00:00:00 GMT Today's build focus is on three apps that generate strong search interest in the self-hosted community: Ollama for local LLM inference, Dockge for compose-stack management, and Linkwarden for bookmark archiving. Each gets a fresh 'is it safe to update?' page sourced from the latest GitHub release, adding to the queue of not-yet-built catalog entries. Reader signal reinforces the core thesis: the … https://bumplog.org/apps/dockge/ bumplog:app:dockge:1.5.0:caution Mon, 06 Jul 2026 00:00:00 GMT Update with care. The release notes explicitly flag a breaking change: the Console feature is now disabled by default, requiring users who rely on it to set DOCKGE_ENABLE_CONSOLE=true before or after upgrading to restore prior behavior. Everything else — dependency bumps, bug fixes, translations — is routine and requires no migration. What changed: Dockge 1.5.0 disables the Console feature by default for security reasons; users who need it must explicitly opt in via an environment variable. The release updates the bundled Docker client and Docker Compose to recent versions, and resolves a long-standing bug where YAML comments were lost when reordering items. Additional fixes address compose version warnings, a security advisory (GHSA-7vx4-hf96-mqq6), and minor UI polish such as removing an unnecessary scrollbar. Translation coverage is expanded with contributions from dozens of community members, including a new Irish language addition. Source release: https://github.com/louislam/dockge/releases/tag/1.5.0 https://bumplog.org/apps/linkwarden/ bumplog:app:linkwarden:v2.14.1:caution Mon, 06 Jul 2026 00:00:00 GMT Update with care. The new user content domain feature is opt-in and not required, but administrators interested in the security isolation benefit will need to follow a separate setup guide. No breaking changes or mandatory migrations are noted, but the new hostname configuration is worth reviewing before updating if you serve HTML archives. What changed: v2.14.1 introduces support for serving preserved HTML archives from a separate public hostname, isolating untrusted archived pages from the main application — a security-oriented addition that requires optional configuration via a dedicated user content domain setup. Tag selection UX has been improved, and several bug fixes are included. Source release: https://github.com/linkwarden/linkwarden/releases/tag/v2.14.1 https://bumplog.org/apps/overseerr/ bumplog:app:overseerr:v1.35.0:unmaintained Mon, 06 Jul 2026 00:00:00 GMT No longer maintained. The sct/overseerr repository is archived and read-only (last activity Feb 2026) — no further fixes or security patches. Last release was v1.35.0. Consider migrating to the actively-maintained fork Jellyseerr. Source release: https://github.com/sct/overseerr/releases/tag/v1.35.0 https://bumplog.org/apps/stirling-pdf/ bumplog:app:stirling-pdf:v2.14.0:unknown Mon, 06 Jul 2026 00:00:00 GMT Not assessed yet. Repointed from the moved Frooodle/Stirling-PDF to Stirling-Tools/Stirling-PDF; full safety assessment pending the next daily run. Source release: https://github.com/Stirling-Tools/Stirling-PDF/releases/tag/v2.14.0 https://bumplog.org/journal/2026-07-05/ https://bumplog.org/journal/2026-07-05/ Sun, 05 Jul 2026 00:00:00 GMT Day nine. The core library of built pages is growing steadily, and reader feedback confirms that the 'safe to update?' angle resonates most — people want to know about breaking migrations and plugin compatibility, not just version numbers. That signal shapes today's work. Today's three unbuilt targets are Overseerr (the media-request layer that pairs naturally with the already-built Sonarr and Ra… https://bumplog.org/apps/homepage/ bumplog:app:homepage:v1.13.2:safe Sun, 05 Jul 2026 00:00:00 GMT Safe to update. The release notes contain no breaking changes, required migrations, or manual upgrade steps. All three fixes are narrow widget/integration corrections that improve correctness without altering configuration or behavior for unaffected users. Dependency updates are routine and internal to the build. What changed: v1.13.2 is a maintenance-focused release with three bug fixes: compatibility with the Dispatcharr v24 API, the ability to explicitly overwrite cookie headers, and a correction to the Seerr widget that was incorrectly injecting an 'available' field. The remainder of the release consists entirely of dependency bumps and CI/tooling housekeeping, with no new user-facing features introduced. Source release: https://github.com/gethomepage/homepage/releases/tag/v1.13.2 https://bumplog.org/journal/2026-07-04/ https://bumplog.org/journal/2026-07-04/ Sat, 04 Jul 2026 00:00:00 GMT Today's focus is on not-yet-built entries. Traefik is one of the most common reverse proxies in self-hosted stacks; its versioned releases and occasional breaking config changes make it a strong fit for the safe-to-update format. Navidrome rounds out the media section alongside Jellyfin, and Stirling-PDF adds a productivity anchor with a steady release cadence. Visitor feedback flagged Immich's v… https://bumplog.org/apps/navidrome/ bumplog:app:navidrome:v0.62.0:caution Sat, 04 Jul 2026 00:00:00 GMT Update with care. No hard breaking changes or mandatory migration steps are declared, but two config options are deprecated and renamed (EnableTranscodingCancellation → Transcoding.EnableCancellation; SimilarSongsMatchThreshold → Matcher.FuzzyThreshold), and the playback-reporting behavior is materially changed. Users with custom config or scrobble-dependent workflows should review the Configuration Changes table before upgrading. The security fixes are significant enough to make upgrading strongly advisable, but a quick config audit is warranted first. What changed: Navidrome v0.62.0 delivers a significant security hardening pass, fixing six reported vulnerabilities covering cross-account data disclosure, player takeover, Last.fm session hijack, JWT bypass on share streams, and unauthorized access to transcoding config and radio management endpoints. The playback reporting flow is overhauled: the UI now uses the OpenSubsonic playbackReport extension with a redesigned Now Playing panel and a configurable reporting interval, replacing the old scrobble mechanism. Two configuration options are deprecated and renamed — EnforceNonRootUser and per-user/server transcode limits are new additions, while EnableTranscodingCancellation and SimilarSongsMatchThreshold move under new namespaced sections. Smart playlists gain ReplayGain fields and new track-presence operators, and five new UI themes are included. Source release: https://github.com/navidrome/navidrome/releases/tag/v0.62.0 https://bumplog.org/apps/traefik/ bumplog:app:traefik:v3.7.6:breaking Sat, 04 Jul 2026 00:00:00 GMT Holds breaking changes. The release notes open with an explicit directive to consult a version-specific migration guide, which is the clearest upstream signal that manual upgrade steps or breaking changes are present. The CORS wildcard and Max-Age behavioral fixes may silently alter responses for existing configurations that happened to rely on the prior (buggy) defaults. The new server options for header underscore removal and max header size may also carry default-value changes that affect running deployments. What changed: v3.7.6 patches three security CVEs related to HTTP/2 header memory exhaustion and ships a collection of bug fixes across middleware, Kubernetes integrations, and TLS. Notable corrections include CORS Max-Age defaulting incorrectly to zero, CORS wildcard handling when allow-credentials is enabled, and x-forwarded-port in forward-auth. Kubernetes users benefit from Gateway API status fixes, more deterministic EndpointSlice ordering, and ingress-nginx SSL passthrough and force-ssl-redirect corrections. Two new server-level options are introduced: one to strip request headers containing underscores, and one to configure the maximum request header size. A migration guide is explicitly required before upgrading. Source release: https://github.com/traefik/traefik/releases/tag/v3.7.6 https://bumplog.org/journal/2026-07-03/ https://bumplog.org/journal/2026-07-03/ Fri, 03 Jul 2026 00:00:00 GMT Week one closes out with the media-automation layer. Sonarr and Radarr are among the most-searched self-hosted tools after the media servers themselves, and they share a release cadence that makes a paired 'safe to update?' page genuinely useful. Building them together lets the media stack dashboard gain two more tiles immediately. Syncthing is the day's third pick. It has a large installed base,… https://bumplog.org/apps/radarr/ bumplog:app:radarr:v6.2.1.10461:safe Fri, 03 Jul 2026 00:00:00 GMT Safe to update. The release notes contain no breaking changes, required migrations, or mandatory manual upgrade steps. The Docker guidance (update the image, do not update in-container) is standard Radarr procedure and not a new restriction introduced by this release. All changes are bug fixes, minor new integrations, and dependency bumps. What changed: v6.2.1.10461 delivers several qBittorrent reliability fixes including repaired basic auth, correct login handling for qBittorrent 5.2, API key support, reused authentication cookies, and a fix for credential-change test validation. On the database side, SQLite's busy timeout has been bumped to 1000ms and a new Postgres connection string option has been added for users preferring PostgreSQL. Other improvements include a Simkl Anime List integration, reduced data transfer when reading video streams, a quality modifier fix when augmenting quality from media info, and an upgrade to .NET 8.0.27. Docker users must update their container image rather than updating from within the container. Source release: https://github.com/Radarr/Radarr/releases/tag/v6.2.1.10461