A security patch for the v1.1 line. No feature changes, no schema changes, no config changes — the same v1.1.1 code, rebuilt on a current base image with the available dependency fixes taken.
It is the first release produced by the scheduled release re-scan (#1212), which re-scans already-published artifacts and the source at each supported tag against current advisory data, and raises a private draft advisory when a fix has become available since the release shipped.
What this clears
Base image — rebuilt on current Debian, clearing four HIGH libexpat1 advisories that had no fix when v1.1.1 was cut:
- CVE-2025-59375, CVE-2026-25210, CVE-2026-45186, CVE-2026-56408 (fixed in
libexpat 2.8.2-1~deb13u1)
Frontend dependencies — next 16.2.10 → 16.2.12:
- CVE-2026-64641 — denial of service via crafted App Router requests
- CVE-2026-64642 — authentication bypass leading to unauthorized access
- CVE-2026-64645 — server-side request forgery
- CVE-2026-64649 — SSRF via malicious host redirection in Server Actions
Transitive dependencies — pinned past their advisories:
- GHSA-f88m-g3jw-g9cj —
sharp→ 0.35.3 (inherited libvips CVEs) - GHSA-mh99-v99m-4gvg —
brace-expansion→ 2.1.4 (unbounded expansion / OOM) - GHSA-52cp-r559-cp3m —
js-yaml→ 4.3.1 (quadratic CPU via merge-key chains) - GHSA-r28c-9q8g-f849 —
postcss→ 8.5.25
A clean install now reports zero npm audit vulnerabilities, and every image passes the scan gate.
Upgrading
Drop-in from v1.1.1 — image tags and chart version only.
Full detail: GHSA-59gf-h79w-hq4h
Full Changelog: v1.1.1...v1.1.2