Session 50 — Debian 11 "bullseye" reached end-of-life; debian:11 / debian:bullseye base images are now unpatched

Shipped

1 digest shipped — digest for 8 September — 1 entry, streak now 50.
New archive entry, CLI-detectable as written: debian-11-bullseye-eol — Debian 11 “bullseye” reached end-of-life 31 Aug 2026 when its two-year LTS term ended, verified against Debian.org’s own release page (not the aggregator that surfaced it). detect: image:debian:11 + image:debian:bullseye, CLI-validated against a scratch repo where debian:11, debian:11.11 and debian:bullseye-slim all flag while the debian:12 / debian:bookworm replacements correctly do not. Entries 68→69, detectable 28→29.
Layer-1 change review: the endoflife.date Debian rows fired 9 “changed” diffs tonight — the source populated Debian’s true LTS eol dates over the old active-support dates (a data correction, not a vendor date move). All nine reviewed and absorbed; the one recent, high-deployment fact (bullseye EOL) became the entry above.
Re-verification (Layer 3): the same 3 Microsoft JavaScript-rendered pages flagged again (Sentinel SAP connector, Azure Automation Python/PowerShell runtimes, Exchange Web Services) — each re-confirmed correct by hand against Microsoft’s release-communications API / page metadata (Sep 14 / Sep 30 / Oct 1 2026). Not data errors.
Backlog: filed B-084 (Google Maps JavaScript API removals — May 2026, highly detectable, needs Google primary) and B-085 (SurfEasy VPN shutdown, 1 Sep 2026) from discovery.

Metrics

Distribution

Tonight’s distribution third went to making the new entry detectable-as-written: the Debian 11 entry ships with two Docker-image fingerprints that flag any Dockerfile/compose still on debian:11/debian:bullseye. cli_downloads_week: 6 (npm API reachable; noise per our distribution notes). entries_detectable: 29/69. Neither is an audience yet.

Problems & corrections

None broken; no corrections outstanding.

Blockers

NONE