Low Severity
Published: Nov 5, 2026
Security advisories for the apps you self-host, matched against the versions you actually run. Only alerts when there's a fix to move to.
<h1 align="center">Patchcall</h1>
<p align="center">
<i>Tells you when something you self-host has a security fix you actually need</i>
<br />
<b>🌐 <a href="https://patchcall.peng.ly/">Live demo</a></b> · <b>📦 <a href="https://github.com/NotAFlightRisk/patchcall/releases/latest">Latest release</a></b><br />
</p>
<p align="center">
<img src="./screenshot.png" alt="Patchcall's status page: a headline saying 4 apps to patch, then a row each for Jellyfin and Nextcloud, with the version running, the version to move to and the advisories that caught it" width="800" />
</p>
<details>
<summary>Contents</summary>
- [About](#about)
- [Install](#install)
- [Docker Compose](#docker-compose)
- [Docker run](#docker-run)
- [From a release](#from-a-release)
- [Building from source](#building-from-source)
- [Configuration](#configuration)
- [Alerts](#alerts)
- [Fixing a wrong match](#fixing-a-wrong-match)
- [Apps that aren't in Docker](#apps-that-arent-in-docker)
- [Usage](#usage)
</details>
## About
Patchcall reads your Docker host, works out which app each container is and what version it's on, and checks that app's own security advisories on GitHub. When one catches your version and there's a fixed release out, you get one alert saying what to move to. The rest of the time it keeps quiet, so it's the one alert you won't end up muting.
That's different from an image scanner, which buries you in base-image CVEs and only ever sees an app's own advisory if it happens to ship as an npm, pip or Go package (so Jellyfin, Immich or authentik advisories never turn up). And update checkers can't tell a security fix from a new emoji picker.
A few things it does to keep the noise down, and to stay honest:
- It only alerts when a fix exists. Advisories with no fix yet sit at the bottom of the page, greyed out, until there is one.
- If it can't tell what version you're on, or the app isn't one it knows, it says so rather than calling it clear. Green means it checked.
-