v1.44.1

A short one, and mostly a precaution. Next.js published fixes for two critical and one high-severity hole, and while HealthLog never used the parts they sit in, every instance runs the same framework, so here it is. The update also tidied two small things that bothered anyone who steps through days with the keyboard or closes a document with Back.

Security

• Next.js 16.4.2. The framework fixed two critical advisories that
  allow unauthenticated remote code execution, one in use cache functions
  that return typed arrays (GHSA-673q-mjm6-r5xr) and one in the image
  optimizer when it handles SVG (GHSA-2464-fhr4-w9xw), and a high-severity
  denial of service through Server Actions (GHSA-p3m5-59mp-jv5r). HealthLog
  uses neither use cache nor the image component, and it defines no Server
  Actions and refuses requests that call one. Every instance runs the same
  framework, though, so it updates anyway.
• The image optimizer is off. Nothing in HealthLog renders through it,
  so /_next/image now answers 404 instead of processing whatever image a
  request names. Icons and logos load as before.
• nodemailer 10.1.7 fixes several advisories in how email addresses are
  parsed (GHSA-8c8m-p3m8-cjg8 among them).

Fixed

• [ and ] move the open day on every press. Pressed quickly in a
  row, one press could be lost and the day ended one short. A step now
  starts from the day in the address bar and waits until the previous one
  is shown.
• Back closes a document opened from the vault. Pressed right after
  opening a document, Back could leave its sheet open. The sheet now follows
  the address bar directly.

Upgrade notes

• None. Pull the new image and restart.