Kutt v3.2.6-sr94.66 security maintenance

Security maintenance

• Update nodemailer to 10.0.13, pin transitive ip-address to 10.7.1, and refresh vulnerable development dependencies. Both production and full npm audits report zero known advisories for the tested lockfile.
• Serialize first-administrator creation on an empty database. The concurrent regression reproduces the original two-admin race and verifies one winner on SQLite, MySQL, and PostgreSQL.
• Reject unsafe redirect URI schemes and web URLs containing embedded credentials, even when the optional destination host allowlist is unset. Existing unsafe rows are retained but return 410 without a Location header until repaired. Supported web and common external-app destinations remain available; inventory custom-scheme links before upgrading.
• Show any legacy unsafe target or domain homepage as plain text in management tables, not a clickable URL. The original value remains visible so an authorized owner can repair it; safe HTTPS destinations remain clickable.
• Default TRUST_PROXY to false and ENABLE_RATE_LIMIT to true. Deployments behind a trusted reverse proxy must explicitly opt in to proxy trust and sanitize forwarded headers at the edge.
• Run the published source image as UID/GID 1000. Existing root-owned SQLite volumes require a backup-first, one-time ownership change before upgrading; see deployment guidance. Fresh named volumes inherit the writable ownership automatically.

The source and homelab-wrapper candidate scans have no Critical or High package matches. They retain three Medium package matches for one unfixed BusyBox wget advisory, CVE-2025-60876; Kutt does not use that applet. See the dated audit ledger for evidence, scope, and residual risks.

Publishing this tag does not deploy it. The homelab cutover is separately gated on a fresh local and NAS backup, writable restore, WAF/SSO and public-redirect checks, and monitored health.