Security
Public advisories matched against what each ring serves, every three hours, on both architectures. A package with an open advisory also exposes what depends on it; a promotion that would replace a clean package with a vulnerable one is blocked; a confident fix is pulled forward. Every advisory, per ring →
The five feeds
How sure we are
| Confidence | Means |
|---|---|
| exact | the tracker knows this distribution's version, or the build information names the embedded module's version |
| name-version | Debian fixed it in a version newer than ours |
| name-only | still open upstream, no version to compare — possibly affected |
Clean must mean examined: a package whose vulnerable object embeds components (Go modules, crates) is only clean elsewhere when that object was scanned for them too; one indexed before the scan existed knows nothing.
Exposure through the graph
Because the index knows what every binary loads, an advisory on a library also marks what uses it: the Security page shows the ring, the package page shows the chain, and omarchy-cli security shows what applies to one machine.
The fast-track
Fixes do not wait for the soak. When edge serves a clean newer version of a package with a confident advisory — medium or worse, or exploited in the wild — the fast-track pulls it into rc and stable with the usual health check and rollback; a factory build the trial installed takes the same lane. Each one is a fast-track line in the journal, with the reason.