Cloud Native Buildpacks Just Graduated: Why Your PaaS Build Step Shouldn't Belong to One Vendor
Cloud Native Buildpacks graduated in August 2026 with 535 contributors and 20+ production adopters. Graduation makes CNB the boring, multi-vendor foundation for a fleet's build step — just as Nixpacks' maintenance mode shows what single-vendor builders cost — but build speed still has to be earned with cache locality.
Your APM Says the Deploy Was Green. The Agent Retried the Migration Three Times
An agent can return HTTP 200 with zero errors while looping, misusing tools, or producing confident nonsense. This is what an OpenTelemetry run trace of an agent-operated deploy actually looks like — and the five telemetry emissions a platform has to produce natively before its first agent-run rollout.
Dokploy Moved Its Enterprise Features Behind a New License — Here's Exactly What Changed
Dokploy's January 2026 restructure kept its core Apache 2.0 but put SSO, RBAC, audit logs, and white-labeling behind a source-available license. We map exactly what moved, who it affects, and the five checks to run against any self-hosted PaaS license.
Hetzner Changed Its Storage Box API Under Your Backup Cron: Three Breaks and the Audit Your Automation Owes Itself
Hetzner's Storage Box API now follows Cloud API conventions: snapshot plans require hour and minute, subaccount home directories moved to their own action, and rollback takes a name or ID — with the old fields removed April 21, 2026. Here is the old-vs-new table and the checklist for any backup automation still on the pre-migration shape.
Controllers Are Cheap to Write Now. Running One Still Isn't
Writing a Kubernetes controller now takes an afternoon thanks to kubebuilder — but each one still costs a replicated deployment, a sized informer cache, and idempotent reconcile logic. A promotion table for six tenant-lifecycle jobs: what a self-hosted PaaS should turn into controllers, and what should stay a script.
Your MCP Server Didn't Break — Its SDK Moved: Surviving MCP Python SDK 2.0's FastMCP-to-MCPServer Rename
MCP Python SDK 2.0 renamed FastMCP to MCPServer with no shim, so every fresh install against an unbounded mcp>=1.x pin fails at import. We cover the five-minute pin, the full port including four gotchas past the rename, and the fresh-resolve CI job that catches the next breaking major.
One Team Membership Was Enough: How Rancher CVE-2026-41053 Handed Every GitHub Org Member Every Team's RBAC Grants
Rancher CVE-2026-41053 (CVSS 8.8) let any user with one GitHub team membership inherit every team's Rancher permissions. Affected versions, the broken expansion loop, and the remediation checklist.
Woodpecker CI's 130MB Control Plane vs a 7GB GitHub Runner: What Your PaaS Build Step Really Costs on a €3.79 Hetzner Box
A Woodpecker server and agent idle at about 130MB of RAM while GitHub's standard runner is a 2-core, 7GB VM. We budget both stacks megabyte-by-megabyte on a €3.79 Hetzner CX22 and work out when owning your build fleet beats paying per-minute Actions overage.
17 Million Robot PRs a Month: What AI Coding Agents Are Doing to Open Source Maintainership
Agents now open an estimated 17 million pull requests a month while maintainer review capacity grows one human at a time. How Kubernetes upstream adapted, why the review bottleneck lands on every Cluster API-based platform, and the review-side tooling teams like yours can contribute back.