Three things worth your attention this week: Jellyfin's long-awaited 12.0 rewrite reached its fifth release candidate, Gitea shipped a patch release led by a SECURITY section, and a homelabber published a postmortem of getting compromised. Underneath that, a fat stack of routine updates — Nextcloud's next major branch entered beta, Portainer pushed an LTS bump with a documented known issue, and n8n landed the week's only actual feature release.

If you only do one thing after reading this: patch Gitea.

This Week's Highlights

Jellyfin Server 12.0 RC5 lands. The Jellyfin team announced the fifth release candidate of 12.0, explicitly labelled a preview release intended for people who want to test 12.0 ahead of its final public release.

Why it matters: 12.0 is the most anticipated media-server release in the self-hosting world, and hitting RC5 means the rewrite is genuinely closing in on stable. That's the signal to stop waiting and start rehearsing. Migrations across a major version boundary are where library metadata, watch history and user accounts get mangled — and the time to discover that is now, on a copy, not on release day with the household watching.

Practical advice: clone your library database and config to a scratch instance, run the upgrade there, and check the things your users would actually notice — playback, transcoding profiles, and whether watch state survived. RC5 is not a production upgrade. It is a free dress rehearsal.

Close-up of a video editing timeline on a computer screen, showcasing modern technology.
Close-up of a video editing timeline on a computer screen, showcasing modern technology.

Gitea v1.27.1 is a patch-now item. The 1.27.1 release notes open with a SECURITY section, including a fix for an orgmode render include path issue.

Self-hosted Git forges have an awkward property: they're one of the few homelab services people deliberately expose to the public internet, because you want to push from a laptop on someone else's Wi-Fi. That exposure plus a security-led patch release is the definition of a don't-sit-on-this update. It's a point release on an existing branch, so the upgrade cost is close to zero — pull the new image, restart, done.

"My Homelab Got Hacked — A Postmortem." A homelabber published a first-hand writeup of their own compromise, and it climbed Lobsters this week.

We link a lot of hardening checklists in this newsletter. Checklists don't change behaviour; specific failure stories do. A postmortem written by someone who was running roughly the same stack you are, with roughly the same reasoning about what was "probably fine to expose," tends to land harder than any amount of generic advice about reverse proxies and 2FA. Read it alongside the Gitea patch above — the pairing is not a coincidence, and the comment thread is worth your time too.

New Releases & Updates

  • Nextcloud v35.0.0 beta1 — the first beta of the next major branch sets the upgrade horizon for the most widely deployed self-hosted cloud; maintenance RCs for 32, 33 and 34 also landed this week.
  • Home Assistant 2026.8.1 — a bugfix point release cleaning up regressions from 2026.8.0; low-risk and worth taking.
  • Portainer 2.39.6 LTS — an LTS-channel update to the default container UI for a huge share of Docker self-hosters, with a documented known issue: on Async Edge environments an invalid update schedule date can display when browsing a snapshot.
  • n8n 2.35.0 — the one feature release in a week of roughly eight n8n patch tags; fixes include stopping pre-tool-call text from leaking into AI Agent Node responses.
  • AdventureLog v0.13.0 — the self-hosted travel tracker turns two, marked with a new release and a writeup from the author.
  • Lingarr 1.3.0 — automated subtitle translation that slots neatly into an existing Jellyfin or Plex stack, filling a gap the *arr suite never covered.

Close-up of server racks in a data center highlighting modern technology infrastructure.
Close-up of server racks in a data center highlighting modern technology infrastructure.

Community Spotlight

The thread that got people talking this week: "Tautulli phones home by default?" on r/selfhosted, pointing at a post on r/Tautulli and the project's repo, with the claim that install information is being collected and that this isn't clearly disclosed. Telemetry-by-default in a widely installed Plex companion app is exactly the trust question this audience cares about — not because anonymous install counts are inherently sinister, but because "on by default and undocumented" is the part that erodes goodwill. If you run Tautulli, this is a good prompt to go read your own config rather than assume. The thread is still developing, so treat the specifics as community reporting rather than settled fact.

  • beszel — a lightweight server monitoring dashboard with Docker stats; a much simpler alternative to standing up a full Prometheus and Grafana stack.