Linux
KERNEL TASK SCHEDULER FIX LANDS AS KUNIT DEBUGFS DECOUPLED
A critical fix preventing preemption of dying tasks during kernel oops just merged, eliminating a narrow window where scheduler assumptions break and bad things happen.
read --wire →
$ tail -f topics/infra.log
Infrastructure news, every morning.
Daily updates from the platform-engineering layer - Kubernetes, Terraform, Linux, Arch, and the tools that run production.
42 updates across 6 projects this week.
Your week in Infrastructure, every Monday.
One calm review of what shipped across Infrastructure - the commits, releases, and security advisories that matter. Every Monday, with security advisories same-day. Free, unsubscribe in one click.
We'll start you on the top Infrastructure projects - refine anytime. · Read a sample issue →
Recent wires
Arch Linux
ARCHWEB MATRIX ISOLATION TIGHTENS SECURITY POSTURE
Arch infrastructure locked down Matrix well-known directory to primary host only, closing a lateral exposure vector across mirror and secondary deployments.
read --wire →
HashiCorp
HASHICORP COMPLIANCE SWEEP ACROSS ALL REPOS — COPYRIGHT HEADERS STANDARDIZED
Every major HashiCorp provider repository is undergoing a coordinated compliance audit to align with IBM licensing standards, and the headers are rolling in now.
read --wire →
Kubernetes
GCP CLOUD PROVIDER ROLLBACK REVEALS RBAC REGRESSION—NODE DELETION BROKEN IN GKE
The cloud-provider-gcp team reverted a critical library update after discovering it broke node lifecycle permissions, leaving orphaned GCE instances stranded in clusters.
read --wire →
Go
TYPESCRIPT 6 HITS PKGSITE, GOLANG TOOLS SHED DEAD CODE
The Go ecosystem's documentation and tooling infrastructure jumped a major version overnight, trading deprecated patterns for stdlib-native approaches.
read --wire →
Linux
KERNEL PLUGS RXRPC MEMORY CORRUPTION, RC3 SHIP STEADY
Linux 7.1-rc3 landed overnight with a critical rxrpc fix that patches memory safety issues in packet handling when fragments are shared across sockets.
read --wire →
Arch Linux
ARCHWEB CLEANS HOUSE ON DJANGO CRUFT WHILE ARCHINSTALL OVERHAULS CONFIG TYPES
Archweb dropped two deprecated Django settings that should have been gone years ago, while archinstall locked down its configuration architecture with a new abstract base class.
read --wire →
HashiCorp
VAULT JWT PLUGIN BUMPS GO TO 1.26.3, PACKER AZURE LOCKS DOWN COMPLIANCE
Vault's JWT auth plugin is shipping a toolchain upgrade while HashiCorp audits its entire plugin ecosystem for licensing compliance.
read --wire →
Kubernetes
KOPS LOCKS DOWN K8S 1.35 COMPATIBILITY WHILE VSPHERE ADDS MULTI-API SUPPORT
Kops shipped critical version gating for a CSI feature that was breaking cluster validation on older Kubernetes releases, while the vSphere cloud provider decoupled itself from API versioning to support multiple VM Operator versions simultaneously.
read --wire →
Go
GOPLS GETS INTERACTIVE REFACTORING, GO RUNTIME MAPS HIT SIMD FAST LANE
Gopls shipped interactive refactoring capabilities while the Go runtime rewrote its hash functions to leverage SIMD intrinsics for measurable throughput gains.
read --wire →
Linux
KERNEL RC3 CLOSES HARDWARE AND FILESYSTEM GAPS; OMARCHY 3.8.0 SHIPS WITH REMINDERS
Linux 7.1-rc3 lands critical fixes across hwmon, powerpc, and fsverity while Omarchy's new release adds reminder infrastructure and theme support.
read --wire →
Arch Linux
ACCOUNTS-QML-MODULE REMOVED FROM EXTRA
Arch dropped accounts-qml-module from extra-x86_64 overnight, signaling a shift in the mobile/GNOME ecosystem dependencies.
read --wire →
HashiCorp
NOMAD AUTOSCALER FIXES CRITICAL WINNER SELECTION BUG
Nomad Autoscaler now properly excludes out-of-window checks from scaling decisions, preventing phantom participants from skewing autoscaling logic.
read --wire →
Kubernetes
KUBERNETES TIGHTENS VALIDATION TEST COVERAGE AS KUBE-OPENAPI PROPAGATES ACROSS CORE REPOS
The core Kubernetes project is hardening its declarative validation test suite while simultaneously rolling out a fresh kube-openapi build across the scheduler, endpoint slice, and dynamic resource allocation components.
read --wire →
Go
PKGSITE LIFTS QUERY LIMITS, EXPOSES MODULE TIMESTAMPS
Go's package discovery API just got faster and more informative—hardcoded constraints are gone, and clients can now read version timestamps directly from module metadata.
read --wire →
Linux
IOMMU AND SMB3 SECURITY FIXES LAND IN RC2 AS DRM RACE CONDITION PATCHED
Critical security fixes for AMD-Vi and SMB3 hit the kernel overnight while DRM's handle-change ioctl finally gets its use-after-free sealed.
read --wire →
Arch Linux
MKINITCPIO HARDENS SYSTEMD HOOKS AS FIREFOX DEV EDITION HITS 151.0B8
The init system just got safer — mkinitcpio merged fixes to prevent phantom hwdb.bin entries and nullglob pollution in your boot chain.
read --wire →
HashiCorp
CONSUL-K8S PATCHES TORNADO COOKIE INJECTION FLAW
Consul-K8s shipped an emergency security fix overnight for a cookie attribute injection vulnerability in Tornado that could expose your gateway API layer.
read --wire →
Kubernetes
KUBERNETES UNDEPRECATES LONG-LIVED FEATURE GATE AS API MACHINERY CLEANS HOUSE
The core Kubernetes project reversed a nine-year deprecation on enable-logs-handler while simultaneously purging locked GA feature gates from the API machinery, signaling a shift toward pragmatism over rigid deprecation timelines.
read --wire →
Go
HTTP/2 API RESTORED FOR GO 1.27 COMPATIBILITY
Go's http2 package accidentally dropped critical symbols in the 1.27 build — they're back now, preserving compatibility for applications relying on ErrNoCachedConn, ErrPushLimitReached, and friends.
read --wire →