Skip to content

CompDesk v0.9.0-beta.4.2 — Public Beta

Choose a tag to compare

View all tags
@TahaHydra TahaHydra released this 23 Oct 13:30
v0.9.0-beta.4.2
9762e8f
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

CompDesk v0.9.0-beta.4.2 — Public Beta

A security update for beta.4.1: Next.js and DOMPurify are updated for advisories published on 22 October 2026. There are no feature, behaviour, configuration or database changes.

Security updates

  • Next.js 15.5.27 → 15.5.28. Addresses GHSA-2464-fhr4-w9xw (critical: remote code execution in the Image Optimization API when SVG files are used) and GHSA-p3m5-59mp-jv5r (high: denial of service in the App Router through Server Actions). CompDesk stays on Next.js 15. CompDesk does not enable SVG image optimization, defines no Server Actions, and its image runs on Alpine Linux (musl) with sharp 0.35.5. No exploitable path has been identified, but the image optimization endpoint is reachable on every deployment, so updating is recommended.
  • DOMPurify 3.4.16 → 3.4.17. Addresses GHSA-cg2g-xh64-v4q7 (critical), GHSA-mrv2-3pqr-j5jr (high) and GHSA-c6gr-qvv4-5v3f (low). CompDesk's own code does not call DOMPurify. The package is part of the production dependency tree, so it is updated and the image no longer ships a known-vulnerable version.
  • Development tooling. handlebars, used only by the test toolchain and not included in the image, is updated to 4.7.10.

The production dependency audit has zero findings.

Upgrade and rollback

There are no database migrations in this release. Back up PostgreSQL, private attachments, uploaded branding, and the private configuration volume together. Download this release's version-pinned docker-compose.yml, review it against your deployment configuration, then run from the deployment directory:

docker compose pull
docker compose up -d
docker compose logs --tail=100 compdesk

If you deploy with your own Compose file, change only the image tag to ghcr.io/tahahydra/compdesk:0.9.0-beta.4.2 and confirm the three persistent paths /config, /app/public/uploads and /app/storage/attachments are mounted.

Rolling back to beta.4.1 needs only the beta.4.1 image; the database and configuration are unchanged. A rollback restores the vulnerable Next.js and DOMPurify versions. See upgrade guidance and backup/restore.

Verification

  • Lint, type checking, the full Jest suite (626 tests) and the production build pass on Next.js 15.5.28.
  • Fresh migration, the previous-release migration upgrade rehearsal, the Entra account-link integration test and the first-run setup browser test pass against PostgreSQL 16.
  • An image built from scratch contains Next.js 15.5.28, DOMPurify 3.4.17 and sharp 0.35.5, runs as UID 1001, and excludes build-only packages. A Trivy scan reports no fixable high or critical findings. Volume ownership checks for /config, uploads and attachments pass.

This is a public beta; the beta.4 limitations still apply.

Publication checks

Verified release source: 9762e8f06030d5c5df18558c5c9d551d63195c45.

  • Main CI and main Security passed, as did all checks on the pull request.
  • Tagged-image scan and publication passed. The released image digest is sha256:9775acdae6fa56a9942d57f59a012242c2cdce12f61630b19dedf102ca09d93e.
  • The published image runs as UID 1001, reports version 0.9.0-beta.4.2 and contains Next.js 15.5.28 and DOMPurify 3.4.17. The production dependency audit has zero findings.
  • The image was pulled anonymously, without GitHub credentials. The attached docker-compose.yml matches the version-pinned Compose file generated from the tagged source.
Previous releases and rollback downloads
Assets 3
Loading