Three more from reading other projects' bug trackers. All the same shape: the tool was quietly not doing what you thought.
An emoji in BOT_LABEL dropped every ntfy notification
Python encodes HTTP header values as latin-1, so one emoji in the title raises UnicodeEncodeError inside urlopen — swallowed by the notifier's broad handler, one log line, push gone.
The README recommends BOT_LABEL=🖥 pve1. So following our own documentation and using ntfy was enough to receive nothing at all and be told nothing about why.
Titles are RFC 2047 encoded when they need it, verified against a real ntfy server rather than assumed.
Worth recording: my first attempt encoded only what latin-1 rejects, and would have shipped a subtler bug than the one it fixed. An umlaut passes that test — Python encodes ü to 0xFC quite happily — but ntfy reads the header as UTF-8, where a lone 0xFC is invalid. Measured live, Grün Größe arrived as Gr<?>n Gr<?>e. Quietly mangled rather than dropped, which is the harder of the two to notice. The condition is isascii().
Only the first page of the tag list was read
Registries hand out the oldest tags first, so reading one page truncates at exactly the end that matters.
ghcr.io/home-assistant/home-assistant
before: 100 tags, all from 2021, highest parseable 2021.7.1
actual: the project is on 2026.7.4
Every major-bump decision for that container was made against a four-year-old view, so the confirmation prompt you opted into never fired. Docker Hub answers with everything in one response, which is why "the first hundred are enough in practice" held there and was silently false everywhere else.
The full crawl reaches the current version: 44 pages, 4379 tags, about 15 seconds. It runs only for a container that actually has an update, not on every check, and it is cached per run — a compose stack with five containers from one image walks it once rather than five times.
Every registry failure said the same thing
"Check FAILED (registry unreachable / unauthorized)" covered a rate limit, a deleted tag, a server error, a TLS failure and a DNS miss alike. That sends people looking for an auth problem they do not have. The detail existed; it went to the debug log, which nobody has switched on the first time they hit this.
→ Check FAILED: rate limited by the registry (HTTP 429)
→ Check FAILED: tag or repository not found (HTTP 404)
→ Check FAILED: TLS error (certificate verify failed)
Reset per container, so a later failure with no detail of its own cannot inherit the previous one's explanation.
Upgrading is the usual docker pull ghcr.io/amayer1983/docksentry:latest, or nothing at all with auto-selfupdate on.