This week the Rust ecosystem got a reminder that the scariest dependency is the one you never chose: a malicious crate landed on crates.io. Elsewhere it was a quieter, more productive seven days — Nextcloud 35 reached its fourth beta, Traefik and Home Assistant shipped bugfix point releases, and n8n went on a tagging spree. And a self-hosted music server is about to cross a million downloads.
This Week's Highlights
A malicious crate on crates.io — The Rust blog reports that a malicious crate named proc-macro1 was uploaded to the crates.io repository, in an incident connected to the arrayref crate. LWN's writeup is the quickest way to get the shape of it.
The name is worth sitting with for a second: proc-macro1 is one character away from proc-macro2, a package that sits somewhere in the dependency graph of very nearly every non-trivial Rust project. A procedural-macro crate is also about the worst place to hide something hostile, because it executes at compile time — on your build machine, in your CI runner, inside your image build.
Why self-hosters should care even if they don't write Rust: a growing share of the tooling we run — proxies, sync daemons, search indexers, CLI utilities — is Rust, and plenty of us rebuild from source or through multi-stage Dockerfiles. A compromised crate propagates silently into container images, with no signal at runtime that anything changed. If you build Rust artifacts in CI, this is a good week to check your lockfiles are committed and actually respected, and to look at what your builds pulled recently.
Nextcloud 35 hits beta4 — Nextcloud tagged v35.0.0beta4 on Wednesday, following beta3 earlier in the same week. Two betas in seven days is the usual tell that a major line is converging on a release candidate rather than still discovering itself.
Nextcloud is the most widely deployed self-hosted cloud there is, which means major-version upgrades tend to be less about the server and more about everything bolted onto it. If you depend on third-party apps, or you're pinned to a particular PHP version, the window for finding out that something doesn't work is now — while it's still a bug report that can land before release, rather than a surprise on upgrade day. Spin up a copy of your instance against beta4, install your app set, and see what breaks.
Aurral approaches 1M downloads with 2.5.0 — The clearest community momentum story of the week: Aurral is about to pass a million downloads, and the 2.5.0 release is pitched as a significant step toward being a real self-hosted music library rather than a player with ambitions.
Self-hosted music is a category where the incumbents — Navidrome, Jellyfin — are entrenched and generally good, so a genuinely live third option earning that kind of adoption is notable. The download milestone is the headline, but the more interesting signal is the direction of travel in 2.5.0: library management is the hard, unglamorous part of the problem, and it's where projects either grow up or plateau.
New Releases & Updates
- Traefik v3.7.11 — A bugfix release whose headline item is FastProxy rejecting out-of-range status codes from backends; release notes here. v2.11.55 shipped alongside it for anyone still on the LTS line. Traefik fronts a large share of homelab stacks, and this one is reverse-proxy correctness rather than cosmetics.
- Home Assistant 2026.8.2 — A patch for the flagship automation platform, including Teslemetry converting streamed tyre pressure and isolation resistance to their declared units. Full changelog. Routine if you're already on the 2026.8 line; worth taking.
- n8n 2.36.4 — Released Friday with core fixes including normalizing env values before schema-based parsing. Note that n8n shipped a rapid burst of bugfix releases across the 2.36, 2.35 and 1.123 lines this week — pick the branch you're tracking and follow that, rather than chasing every tag.
Community Spotlight
Someone cataloged 28 self-hosted apps that run entirely on Cloudflare Workers — every project on the list runs on Workers plus D1 and R2/KV/Durable Objects, with no VPS, no Docker, and no server to maintain. It's a genuinely useful reframing of what "self-hosting" is allowed to mean. For a certain kind of service — the small utility you want to exist without owning its uptime — the answer increasingly isn't a box in a closet at all. Purists will have opinions about whether running on someone else's edge counts, and that's a fair argument to have; either way, the list is immediately actionable, and it's a good sanity check on which of your self-hosted apps actually need to be self-hosted.
Quick Links
- Security updates for Thursday — patches from AlmaLinux, Debian and others covering bind9.18, glib2, the gstreamer plugin sets, mysql, php and python3. Most of these live in your base images. Go update your hosts.
