v1.4.1

[Doezer]

Hotfix release for two purposes

• a recently added SBOM exporting job made it so any tag older than 15 days is not working anymore, although still displayed. That's the case for v1.4.0.
• Also addressing dependency vulnerabilities flagged by npm audit.

Vulnerabilities Addressed

• brace-expansion 5.0.7 → 5.0.8 — fixes CVE-2026-14257 (GHSA-mh99-v99m-4gvg, HIGH) — DoS via unbounded expansion length causing an out-of-memory process crash.
• js-yaml 5.2.1 → 5.2.2 — fixes GHSA-pm4m-ph32-ghv5 (no CVE assigned, HIGH) — exponential parsing time in flow collections leading to denial of service.
• body-parser 1.20.5 → 1.20.6 — fixes CVE-2026-12590 (GHSA-v422-hmwv-36x6, LOW) — an invalid limit value silently disabled size enforcement, allowing arbitrarily large request payloads.
• minimatch override pinned to ^10.2.5 — closes a second resolution path for CVE-2026-14257 (GHSA-mh99-v99m-4gvg, HIGH): eslint-plugin-react's bundled minimatch@3.1.5 still pulled the vulnerable brace-expansion@1.1.16. devDependency-only (not shipped in the production image), but flagged by npm audit without --omit=dev, so pinned for a fully clean audit.

Download: set your Docker image tag to v1.4.1

• GitHub Container Registry

Full Changelog: v1.4.0...v1.4.1

---

This discussion was created from the release v1.4.1.