v2.0.5

Contrack 2.0.5 moves the Docker image to Node.js 26.13.0, which fixes 10 vulnerabilities that the image scan found in Node.js 26.12.0. It also applies the open dependency updates (#271).

Security

• Docker image on Node.js 26.13.0 (#271). The 2.0.4 image runs Node.js 26.12.0. The Node.js 26.12.1 security release fixes these vulnerabilities in it:
  • Critical: CVE-2026-111497, a buffer overflow in the Brotli decoder. Grype's vulnerability data puts it in the CISA Known Exploited Vulnerabilities list.
  • High: CVE-2026-105482, host names that hold a NUL byte in dns.resolve*(). CVE-2026-106069 and CVE-2026-105483, TLS hostname checks of IPv4 addresses that are written in a non-standard form.
  • Medium: CVE-2026-106072, one more TLS hostname check of such addresses. CVE-2026-105481, HTTP keep-alive connection reuse. CVE-2026-106074, the entropy caches of crypto.randomUUID() and crypto.randomInt() in startup snapshots.
  • Low: CVE-2026-106070 in zlib.ZipFile, and CVE-2026-106071 and CVE-2026-106073 in the Permission Model.
• To upgrade, pull the new image as Upgrade says. If you run Contrack from source, use Node.js 26.12.1 or later.

Changed

• Anthropic (#271): Contrack uses version 1.3.0 of the Anthropic SDK. Its requests use Claude API version 2026-10-21 and send the key in the Authorization header. If ANTHROPIC_BASE_URL sends them through a proxy that reads X-Api-Key, change the proxy to read Authorization.

Dependencies

These are the versions from the Dependabot pull requests #267, #268, #269 and #270, applied together in #271.

• @anthropic-ai/sdk 1.3.0.
• @google/genai 2.31.0, @modelcontextprotocol/sdk 1.32.2, imapflow 2.9.1, mailparser 3.12.4, nodemailer 10.2.1 and openai 7.43.0.
• In the browser bundle and the build: @tanstack/react-virtual 3.14.22, knip 6.43.0, lucide-react 1.61.0, maplibre-gl 6.16.0, motion 14.6.0 and vite 8.3.5.
• In CI: docker/login-action 4.7.0 and github/codeql-action 4.39.1.

Full Changelog: v2.0.4...v2.0.5