Hotfix release for two purposes
- a recently added SBOM exporting job made it so any tag older than 15 days is not working anymore, although still displayed. That's the case for v1.4.0.
- Also addressing dependency vulnerabilities flagged by
npm audit.
Vulnerabilities Addressed
- brace-expansion 5.0.7 → 5.0.8 — fixes CVE-2026-14257 (GHSA-mh99-v99m-4gvg, HIGH) — DoS via unbounded expansion length causing an out-of-memory process crash.
- js-yaml 5.2.1 → 5.2.2 — fixes GHSA-pm4m-ph32-ghv5 (no CVE assigned, HIGH) — exponential parsing time in flow collections leading to denial of service.
- body-parser 1.20.5 → 1.20.6 — fixes CVE-2026-12590 (GHSA-v422-hmwv-36x6, LOW) — an invalid
limitvalue silently disabled size enforcement, allowing arbitrarily large request payloads. - minimatch override pinned to
^10.2.5— closes a second resolution path for CVE-2026-14257 (GHSA-mh99-v99m-4gvg, HIGH):eslint-plugin-react's bundledminimatch@3.1.5still pulled the vulnerablebrace-expansion@1.1.16. devDependency-only (not shipped in the production image), but flagged bynpm auditwithout--omit=dev, so pinned for a fully clean audit.
Download: set your Docker image tag to v1.4.1
Full Changelog: v1.4.0...v1.4.1