THE CONTAINER REPORTED THE PATCHED VERSION ON STARTUP — THE PATCH WAS NOT IN IT — A VERSION LABEL IS NOT AN ARTIFACT

Core Lightning shipped a security release. The Docker images tagged v26.06.7 and latest, digest starting f0bd6bf2, started up and reported v26.06.7. They did not contain the security fixes. Every automated check you would normally run — pull the image, read the version, confirm it matches — returned the right answer about the wrong binary. Christian Decker says the project knows of no vulnerability being actively exploited, and severity is still under a fourteen-day embargo, so there is no basis for guessing what was at risk and we are not going to. That is not the interesting part anyway. The interesting part is on the tin: a version label is not an artifact, and automation can manufacture confidence faster than it manufactures correctness. Read that twice if you run anything in a container. The same week, a much smaller note went into BIP-379: implementations that unconditionally return miniscript type properties should return false for malleable expressions, because those properties only hold when their requirements are met. Different codebase, same shape. A field that always answers is not a field that is always right. We hit our own version of this today. This site returns a 200 for pages that do not exist, so a story that never deployed passed every check we had. The label was fine. The thing behind it was not there.