DecaTone v1.2.2

🛡️ DecaTone v1.2.2 Security Hardening Release

This patch release completely eliminates all remaining container base and bundled package vulnerabilities:

🔒 Zero-Vulnerability Runtime Container

• Upgraded Base to Node 22 Alpine (Alpine 3.24): Updates Busybox to 1.37.0-r31 (resolves CVE-2025-60876), OpenSSL (libcrypto3 / libssl3) to 3.5.8-r0, and musl to 1.2.6-r2.
• Stripped Bundled NPM CLI in Runner Stage: Removed /usr/local/lib/node_modules/npm and /usr/local/bin/npm from the runtime container image. This eliminates all vulnerabilities originating from internal npm dependencies:
  • tar@6.2.1 (CVE-2026-59873, CVE-2026-23950, CVE-2026-59874, CVE-2026-23745, CVE-2026-24842, CVE-2026-29786, CVE-2026-31802, CVE-2026-73566, CVE-2026-26960, CVE-2026-53655, CVE-2026-59875, CVE-2026-59871)
  • minimatch@9.0.5 (CVE-2026-26996, CVE-2026-27904, CVE-2026-27903)
  • brace-expansion@2.0.1 (CVE-2026-13149, CVE-2026-14257, CVE-2026-69152, CVE-2026-33750, CVE-2025-5889)
  • ip-address@9.0.5 (CVE-2026-69192, CVE-2026-42338)
  • cross-spawn@7.0.3 (CVE-2024-21538)
  • pacote@18.0.6 (CVE-2026-9496)
  • glob@10.4.2 (CVE-2025-64756)
  • sigstore@2.3.1 & @sigstore/core@1.1.0 (CVE-2026-48815, CVE-2026-48758)
  • diff@5.2.0 (CVE-2026-24001)

🐳 Docker Hub Standardized Images

Pushed to Docker Hub:

• tylerhats/decatone:1.2.2
• tylerhats/decatone:latest

DecaTone v1.2.1

🛡️ DecaTone v1.2.1 Security & Hardening Release

This maintenance and security release resolves all known high and critical CVE vulnerabilities in the container runtime environment and Node.js dependencies:

🔒 Container & Runtime Hardening

• Eliminated Container OS CVEs: Stripped unused utilities (curl, git, tar, make, g++, binutils, python3) from the runtime runner image.
• Eliminated Go Stdlib / Sigstore / Pacote CVEs: Removed global npm development package installations in the runtime stage.
• Alpine Base Upgrades: Automated apk upgrade --no-cache in both builder and runner stages to pull the latest security patches for OpenSSL (libcrypto3, libssl3), Busybox, and system libraries.

📦 Dependency Upgrades

• Upgraded tar to ^7.5.22 (resolves CVE-2026-59873, CVE-2026-23950, CVE-2026-59874, CVE-2026-23745, CVE-2026-24842, CVE-2026-29786, CVE-2026-31802, CVE-2026-73566, CVE-2026-26960, CVE-2026-53655, CVE-2026-59875, CVE-2026-59871).
• Upgraded multer to ^2.3.0 (resolves CVE-2025-48997, CVE-2026-3520, CVE-2026-3304, CVE-2026-2359, CVE-2025-7338, CVE-2025-47944, CVE-2026-5079, CVE-2025-47935).
• Upgraded nodemailer to ^9.0.6 (resolves CVE-2025-14874, GHSA-p6gq-j5cr-w38f, GHSA-r7g4-qg5f-qqm2, CVE-2025-13033, GHSA-wqvq-jvpq-h66f, GHSA-268h-hp4c-crq3, GHSA-vvjj-xcjg-gr5g, GHSA-c7w3-x93f-qmm8).
• Upgraded sqlite3 to ^6.0.1 (resolves @tootallnate/once, node-gyp, and cacache issues).
• Upgraded react-router-dom to ^7.18.3 and vite to ^6.2.0 (resolves CVE-2026-53666, CVE-2026-53669).

🐳 Docker Hub Standardized Images

Pushed to Docker Hub:

• tylerhats/decatone:1.2.1
• tylerhats/decatone:latest

DecaTone v1.2.0

☎️ DecaTone v1.2.0 Release Highlights

👥 Multi-Phone Accounts & Party-Line Auto-Join

• Multi-Device Pairing: Pair multiple physical rotary telephones to a single user account (e.g., Living Room, Study, Workshop).
• Independent Ringing: Configure which physical telephones ring on incoming calls.
• Party-Line Auto-Join: Picking up any phone on the same account while another phone is on an active call instantly joins the end-to-end encrypted conference.

📻 Direct Handset Voicemail & Vintage Service Lines

• Handset Voicemail (): Dial 0 from idle to hear spoken message count and listen to stored voicemails directly through the antique earpiece.
• Vintage Service Directory:
  • 111: Ringback bell test (hang up, wait 3s, bells ring)
  • 119 / 099: Acoustic loopback echo test
  • 411: Speaking Clock with authentic time pips
  • 567 / 300: Bell 103 / V.34 modem handshake sound simulator
  • 711: Automated national weather forecast hotline
  • 069: Automatic last-number redial
  • 078 / 079: Voice DND status readout and on/off toggle

⚡ Over-The-Air (OTA) Firmware Engine & Custom Overrides

• Scheduled Background OTA: ESP32-S3 boards can automatically update during off-peak hours (e.g. 03:00 AM) when on-hook (idle).
• User-Facing Manual OTA: Prominent update available notification and 1-click update button in user hardware settings.
• Admin Custom Firmware Overrides: Upload custom compiled binaries to override official distributions with 1-click revert capability.

💾 100% Full-Program Backups & Retention Daemon

• Zero-Loss Archiving: Compressed .tar.gz archives bundle decatone.db, custom brand icons/favicons, and all voicemail recordings.
• Automated Scheduling & Pruning: Configurable hourly, daily, or weekly schedules with automatic retention pruning.

🐳 Docker Container Immutability & Deployment

• Automatic container detection disables dangerous in-container git operations and refocuses update channels on ESP32-S3 firmware.
• Standardized container image tags: ghcr.io/tylerhats/decatone:1.2.0 and ghcr.io/tylerhats/decatone:latest.

🎨 Custom Branding & Dynamic Favicon

• Whitelabel application name, brand logo, browser favicon, and top-right navigation icon.