Most weeks my home server news feed is a parade of small release notes and patch announcements. This week was quieter than that, and the drop in volume turned out to be the story. When the people who actually run their own infrastructure slow down enough to write, what they write is what matters. Below is what I am acting on this week, what I am ignoring, and the one thing I am not sure anyone has a real answer to.
Two forges just set a new floor on AI-generated contributions
SourceHut and Codeberg both published updated contributor terms this week that explicitly reject patches written by a language model. Drew DeVault has been one of the more public voices in this corner of open source, and SourceHut joining Codeberg means the two oldest, most opinionated forges now hold the same line. Neither platform asked the wider community to vote first. Both decided and posted.
I think the move is overdue. If you self-host your own git service and you want to follow their example, you will need to draft your own written policy and then enforce it on every incoming pull request. That sounds easy until you try it. Debian ran a parallel debate at its project level this week, and the resolution that won out of nine candidates was “Responsible Use of Generative AI.” The phrase is doing a lot of work, and the people who turn it into something a code reviewer can act on have not been hired yet.
- SourceHut and Codeberg both refuse LLM-written patches at the platform level
- Debian picked “responsible use,” a softer stance than either forge has taken
- Smaller hosted git providers will draft their own rules within the next few months
- The hidden cost is the unpaid hours maintainers already do not have
Selfh.st also retired its “AI-assisted” project tag this week. The reason was practical: too many submissions carried that label when they should have been labeled “generated and submitted without anyone reading it.” That distinction is worth preserving, and the directory wanted to keep it.
If Plex is on your network, the patch is not optional
The Plex situation reappeared in my inbox this week with an urgent flag. No specific advisory was linked in the note, but Plex has now had a steady cadence of remote code execution and authentication bypass disclosures over the past year. The pattern is consistent enough that I have stopped being surprised each time a new one lands. There is enough surface area on a Plex server that someone eventually finds a way in.
I am tired of writing that sentence. The people who run Plex have read it before. The people who are about to learn it the hard way are the ones who stopped opening these newsletters.
Here is the honest trade. Plex’s library management is still the best in its class, and its client apps work on every TV, phone, and tablet in the house. That is not nothing. It also stops mattering the moment a stranger can read your media library or hop across your network to reach the other machines behind your router. Both have happened in the last twelve months. Self-hosting pays dividends when you actually keep what you run patched. The day you stop is the day your home setup becomes a soft target on the public internet.
- Pull the current server build and confirm it matches the latest release
- Walk through every client app and confirm each one is on a recent version
- Front the server with a reverse proxy plus auth so the raw port is not exposed
- If you have been weighing Jellyfin or Navidrome as alternatives, this is the moment
I am not telling you to abandon Plex. I am telling you to put the upgrade on the calendar like a recurring appointment, not a chore you remember when something breaks.
File Browser is finished, and the replacement hunt starts tonight
The maintainer behind File Browser, a long-running web UI for moving files in and out of a server, called it quits a few weeks ago. The repo on GitHub is now read-only, with no active fork filling the gap. That is the kind of news that does not look urgent the day it happens, and looks catastrophic the day your container stops building.
The tool did one job and did it well. You pointed it at a folder, got a clean web page, and you could upload or download without standing up a full cloud. From what I have read in the last few days, most of the alternatives are heavier, less polished, or quietly abandoned. If File Browser is in your stack, the time to plan an exit is now, before a registry cleanup or a future Debian release breaks the image you were relying on.
- List every service that points at File Browser for upload or browse flows
- Test FileGator, SpiceFile, or a stripped-down Nextcloud as a replacement
- Lock your compose file to the version you trust today
- Save a copy of the binary somewhere off the host, in case the image disappears
Honestly, this is the same lesson every time. Small, useful projects die without warning, and most of us only notice when an update fails. I have at least two services on my own box that fall into the same category, and I have not dealt with either yet.
BentoPDF quietly built something other projects will lean on
On a lighter note, the latest BentoPDF release opens up the standards and compression code that powers its PDF toolkit. BentoPDF runs entirely in your browser, so you can merge, split, reduce, and reorder PDFs without uploading anything to the random free sites that monetise your files. The interesting bit in this release is that the developer is exposing the underlying engines to other projects. That is how a one-person tool eventually becomes a foundation. Other self-hosted office suites are likely to start using these engines within the next year.
- BentoPDF runs entirely client-side, so the files never reach a server
- The new release publishes the engine code under an open license
- It is a good example of how a single-developer tool can still matter
- Bookmark it for the next time someone asks you to merge 40 PDFs without a paid account
Bot comments are now the baseline, and that changes what you do
A small tool circulated this week that pokes fun at how many GitHub accounts feel automated. The joke works because the underlying experience is real. A growing share of the issues I read on the projects I follow could have been generated by a language model. The same goes for a meaningful percentage of the pull requests that land in my notifications, which is why I now read the description twice before I click through. Even YOURLS shipped release notes this week with the wrong metadata, and the maintainers had to publish a correction. Stuff like that used to be the exception. Now it shows up most weeks.
I do not have a clean answer for this. If you contribute to open source, take thirty seconds before you file an issue. Make sure the words sound like yours and the question is specific. Maintainers notice. It matters more than you think.
Trade-offs
A quiet news week does not mean a quiet week for your server. The few stories that landed each carry a real cost in time or upkeep, and most of them cannot be delegated to a script.
- Patching Plex takes roughly an hour when you include the clients, and the alternative is reading about your own server in a disclosure thread next month.
- Migrating off File Browser takes a weekend, and the replacement will almost certainly be heavier than what you had.
- Writing an LLM policy for your own self-hosted forge takes a long afternoon and an uncomfortable conversation with your contributors.
- Reading one of these newsletters takes ten minutes, but skipping them is how people end up running software that nobody is patching.
If you run anything exposed to the public internet, treat the AI-policy shift as a forcing function to write down what you actually believe about patches and contributions. If you run Plex, treat tonight’s update as non-optional. If you depend on File Browser, start the migration now. None of this is glamorous, and that is the point. Self-hosting stays interesting when you treat it like gardening rather than a product launch. Tinker with the pieces that work, retire the pieces that no longer earn their place, and resist the urge to adopt a stack you will not maintain.