$ tail -f topics/infra.log
Daily updates from the platform-engineering layer - Kubernetes, Terraform, Linux, Arch, and the tools that run production.
42 updates across 6 projects this week.
One calm review of what shipped across Infrastructure - the commits, releases, and security advisories that matter. Every Monday, with security advisories same-day. Free, unsubscribe in one click.
We'll start you on the top Infrastructure projects - refine anytime. · Read a sample issue →
Linux
The 7.1-rc3 merge window closes with critical fixes across networking, sound, and SELinux—including a nasty out-of-bounds queue access bug in veth that could corrupt XDP redirects.
read --wire →
Arch Linux
Archinstall is moving to mypy 2.0 across both direct and pre-commit dependencies, a significant type-checking upgrade that requires immediate validation before deployment.
read --wire →
HashiCorp
Terraform azurerm reaches v4.72.0 with a new list resource for subnets and Go 1.25.10 bump, while vault-provider hardens its AWS/GCP integration layer across the stack.
read --wire →
Kubernetes
Kops migrated the kubelet away from CLI flags to config files [ref:14], while test infrastructure dropped unnecessary source checkouts that were slowing every periodic job by a minute.
read --wire →
Go
Go just patched a panic in Windows syscalls that could crash net.Dial and LookupPort, and tightened sumdb validation to block a proxy attack vector that could slip corrupted modules past verification.
read --wire →
Linux
Linus pulled critical EFI recovery fixes for x86 and LoongArch while archinstall replaced its broken paste service with a native share-log command.
read --wire →
Arch Linux
The installer's log upload feature is working again after 0x0.st went dark, while the Haskell library stack quietly marches through staging.
read --wire →
HashiCorp
HashiCorp shipped emergency security upgrades to Jinja2 and pymdown-extensions across Consul Kubernetes, closing HTML attribute injection and Markdown processing vulnerabilities that could enable XSS attacks.
read --wire →
Kubernetes
Kubernetes is gutting seven-year-old containerized mounter code and streaming images directly into containerd—a two-part nodeup overhaul that cuts disk I/O and hardens image verification.
read --wire →
Go
Go shipped a critical fix for a denial-of-service vulnerability in the mime package's WordDecoder that could consume unbounded CPU on malformed headers [ref:1], while the security team locked down FIPS 140-3 cryptographic module documentation across the ecosystem.
read --wire →
Linux
The kernel is patching critical races and memory safety bugs in cgroups, framebuffer drivers, and RDMA subsystems ahead of the 7.1 final release.
read --wire →
Arch Linux
Archinstall now preserves standalone initramfs when UKI is enabled, fixing a critical gap that broke grub-btrfs snapshot detection.
read --wire →
HashiCorp
HashiCorp's Terraform Enterprise client library now manages SCIM group mappings at scale, while Nomad's UI completes its migration to the latest Ember LTS with stability improvements across the stack.
read --wire →
Kubernetes
kOps just dropped two massive dependency chains it barely used — cutting 43k lines of vendored code and simplifying its cloud provider story.
read --wire →
Go
gopls just closed a security gap that could have exposed your debug server to the network, while the standard library gates the new JSON format tag behind an experiment flag.
read --wire →
Linux
Critical kselftest regressions that broke fixture test ordering are patched before the final 7.1 push.
read --wire →
Arch Linux
Arch is staging a coordinated update to its git stack with libgit2 1.9.3 [ref:1] and matching cgit bumps [ref:2] [ref:3] hitting extra-testing, signaling incoming stability work across AUR and package infrastructure.
read --wire →
HashiCorp
HashiCorp's Terraform Enterprise SDK now supports tagging modules, providers, and component configs — a capability that's been in development and just landed in go-tfe.
read --wire →
Kubernetes
Kubernetes core shipped a critical kube-openapi fix that corrects type lookups for resources with special characters in their names—the kind of bug that silently breaks schema generation for custom resources.
read --wire →
Go
Go's standard library is hardening against corrupted data while the compiler fixes a critical precedence bug in build constraints that affects real codebases today.
read --wire →
