v0.2.1

lodge v0.2.1

A patch release: a security fix in a dependency, and dependency updates. No change to lodge's behaviour, its app contract or its configuration.

Security

• github.com/klauspost/compress v1.20.0 → v1.20.3 fixes GO-2026-6865 (CVE-2026-116591, GHSA-fpmh-frq8-7rj8): a panic on two-block frames (4249bb2).

Dependencies

• tailscale.com 1.104.1 → 1.104.5: upstream patch releases (Tailscale SSH hardening, a disco-key check in magicsock, a bounded DERP upgrade response). lodge's tsnet nodes do not serve Tailscale SSH.
• modernc.org/sqlite 1.60.1 → 1.61.1: SQLite 3.54.1, with modernc.org/libc v1.79.0. 1.61.1 fixes 1.61.0's re-prepare of cached statements. lodge's store needs no change.
• go.yaml.in/yaml/v3 3.0.5 → 3.0.6.
• The minimum Go is now 1.27.3 (go line of go.mod), as tailscale.com 1.104.5 requires; its old toolchain line already named Go 1.27.3.

Build and repository

• CI and the release workflow: jdx/mise-action v5.2.6 and actions/setup-node v7.1.0, pinned by SHA.
• Development dependencies of client/ and ui/ (Biome 2.6.4, Vitest 5.1.0, happy-dom 21.0.4, React 19.3.1, lucide-react 1.67.0, @types/node 24.19.2). The ui/v0.6.0 and client/v0.3.2 library tags do not move.
• New repository checks: @types/node keeps the Node major of NODE_VERSION, and every risk path exists (internal/workflowcheck); the repository follows core's baseline (ADR-0071).
• Docs: the packaging README quotes lodge --version correctly.

Full list: git log --no-merges v0.2.0..v0.2.1.