$ tail -f topics/infra.log
Daily updates from the platform-engineering layer - Kubernetes, Terraform, Linux, Arch, and the tools that run production.
42 updates across 6 projects this week.
One calm review of what shipped across Infrastructure - the commits, releases, and security advisories that matter. Every Monday, with security advisories same-day. Free, unsubscribe in one click.
We'll start you on the top Infrastructure projects - refine anytime. · Read a sample issue →
CachyOS
CachyOS introduces cachyos-drm-awaiter, a systemd generator that loads GPU drivers in early boot, allowing users to drop GPU modules from initramfs images and cut their size dramatically.
read --wire →
Linux
Kernel 7.3-rc3 pulls in configfs fixes for a symlink-rmdir race that could hit freed memory, while omarchy hardens sudo expiry and adapts to Arch's dropped broadcom-wl package.
read --wire →
Arch Linux
Arch Linux released kernel v7.2.4-arch1 with a new sysctl to disable unprivileged user namespaces, while upstream configfs fixes close a symlink race that could read freed memory.
read --wire →
HashiCorp
A backported fix stops a single misconfigured route from taking down an entire API gateway listener.
read --wire →
Kubernetes
kube-state-metrics ships three new experimental PVC metrics for VolumeAttributesClass and kops adds initial Akamai firewall support.
read --wire →
Go
The Go compiler reorganizes its SSA rewrite packages and the net package fixes a data race in QUIC stream resets.
read --wire →
Go
golang/net fixes a data race in HTTP/3 by clearing the fast-path receive buffer when a stream is reset.
read --wire →
CachyOS
Arch Update's tray now runs desktop files in-process via the gio crate to eliminate zombie processes, while scx-manager ships Chinese and French translations and drops scx_cake profiles.
read --wire →
Linux
Omarchy ships hardening for lock authentication and sleep-hook ownership, while Kitty's remote-control defaults move to the system config to close an untrusted-terminal attack channel.
read --wire →
Arch Linux
Arch Linux tightened AUR package base rules: pushing to a deleted package base is now rejected, and pushing to an orphan no longer claims it.
read --wire →
HashiCorp
HashiCorp's automated licensing review is adding or fixing copyright headers across multiple repositories, including go-changelog and vault-servicenow-credential-resolver.
read --wire →
Kubernetes
The most impactful merge today is the Spanish localization of the SIG Docs participation page, expanding contributor documentation to a wider audience.
read --wire →
CachyOS
CachyOS's package repos saw routine but notable updates, with Chromium 152 and Teams for Linux 2.20 shipping with no risk flags.
read --wire →
Linux
Linus pulled driver core, block, and LoongArch fixes for 7.3-rc2 covering SELinux xattr exposure, an NVMe out-of-bounds write, and Rust/KASAN build errors, while Omarchy ships OpenClaw as a desktop app and adds data-deletion prompts.
read --wire →
Arch Linux
pkgconf has been promoted from core-testing to core, and asusctl and sing-geosite-rule-set have graduated from extra-testing to stable repositories.
read --wire →
HashiCorp
Routine maintenance landed, with no material API, security, or major-release change.
read --wire →
Kubernetes
The VPA Helm chart now manages CRDs as templates so upgrades keep them in sync, while kOps test infra adds full Amazon Linux 2027 support and minikube fixes a Hugo security break.
read --wire →
Go
Three crypto/x509 commits from Daniel McCarney align name-constraint handling with RFC 5280, restricting URI and email constraints to exact hosts and rejecting empty GeneralSubtrees sequences.
read --wire →
CachyOS
CachyOS package updates landed with no detected risk flags across desktop apps and browser packages.
read --wire →
Linux
Linux 7.3-rc2 merges include DRM fixes for Blackwell GPUs, a ceph use-after-free fix, and HID-BPF adjustments for the stricter verifier.
read --wire →
