v1.4.2 - Vulnerability hotfix & ARM64 build

Hotfix release addressing dependency vulnerabilities flagged by npm audit and lack of ARM65 image.

Built directly on v1.4.1 — no other code or dependency changes.

Security

• Dependency Vulnerabilities: Fixed 2 known high-severity vulnerabilities in ip-address and socket.io-parser.

Vulnerabilities Addressed

• ip-address (transitive, via express-rate-limit) 10.2.0 → 10.5.0 — fixes GHSA-mwp4-54f8-5fhr (HIGH) — Address4 decoded leading-zero octets as decimal while resolvers decode them as octal, allowing SSRF and trust-boundary bypass; vulnerable range <=10.3.0. Also crosses the fixed boundary for two moderate SSRF-adjacent advisories, GHSA-4xrf-jv44-h6hh and GHSA-22jq-vg5j-6vgg. No overrides pin needed — express-rate-limit's ^8.5.2 range already permits 10.5.0, so a lockfile-only bump (npm update ip-address) was sufficient.
• socket.io-parser (npm overrides pin) 4.2.6 → 4.2.7 — fixes GHSA-2m8v-j782-fhvr (HIGH, CVSS 7.5) — zero-attachment memory exhaustion, vulnerable range 4.0.0 - <4.2.7. Reaches production via socket.io/socket.io-client (real-time download-progress and notification updates).

Download: keep latest or set your Docker image tag to v1.4.2

• GitHub Container Registry

Full Changelog: v1.4.1...v1.4.2