v0.5.1

Security patch for CoPilot-PerUser. Upgrade both service images and recreate the running containers to apply the fixes.

Security fixes

• Node.js 26.12.1 fixes Node2Shell (CVE-2026-111497) and the other October Node.js security advisories. The previous v0.5.0 web image used affected Node.js 26.11.1.
• Next.js 16.4.1 fixes the Server Actions denial of service (CVE-2026-94482) affecting the sign-in and sign-out forms, and includes the upstream fixes for the related critical image-optimization and cache advisories.
• Go 1.27.3 fixes the compromised-certificate-authority issue (CVE-2026-111943) and earlier standard-library advisories present in the previous Go 1.26.8 build. Host builds also require the patched compiler.
• Updated the affected development-only Undici and Zod dependencies while preserving the existing braces mitigation.
• CI and release jobs now use the pinned patched Node runtime. Host install, development, build, and start commands reject unsupported Node versions.

Upgrade

• Web image: ghcr.io/annonator/copilot-peruser-web:v0.5.1
• API image: ghcr.io/annonator/copilot-peruser-api:v0.5.1
• Host development: Node.js 26.12.1 and Go 1.27.3. Patched Node 22.23.4+ and 24.22.1+ remain supported within their release lines.

Publishing this release does not automatically restart existing deployments. Pull and redeploy both images, or rebuild both services from this tag.

Validation

Frontend lint, typecheck, tests, production build, Go vet/race tests, Docker builds, and fixture/auth-boundary smoke checks pass. Full and production npm audits, govulncheck, and Trivy scans of both locally built runtime images report no vulnerabilities. The Node2Shell regression checks malformed Brotli data in synchronous and streamed forms while preserving valid native-fetch responses.

Patch: #42

Sources: Node.js October security release, Next.js Server Actions advisory, Go certificate-validation update.