v1.2.1

A security patch for the v1.2 line. No feature changes, no schema changes, no config changes — the same v1.2.0 code, rebuilt on a current base image with the available dependency fixes taken.

It is one of the first two releases produced by the scheduled release re-scan (#1212), which re-scans already-published artifacts and the source at each supported tag against current advisory data, and raises a private draft advisory when a fix has become available since the release shipped.

What this clears

Base image — rebuilt on current Debian, clearing four HIGH libexpat1 advisories that had no fix when v1.2.0 was cut:

• CVE-2025-59375, CVE-2026-25210, CVE-2026-45186, CVE-2026-56408 (fixed in libexpat 2.8.2-1~deb13u1)

Frontend dependencies — advisories published against v1.2.0's lockfile since it shipped:

• GHSA-r28c-9q8g-f849 — postcss → 8.5.25
• GHSA-mh99-v99m-4gvg — brace-expansion → 2.1.4 (unbounded expansion / OOM; the fix lands inside the 2.x line at 2.1.3, so no major bump is needed)
• GHSA-52cp-r559-cp3m — js-yaml → 4.3.1 (quadratic CPU via merge-key chains)
• next pinned to 16.2.12 and sharp to 0.35.3, so the versions that clear CVE-2026-64641/64642/64645/64649 and GHSA-f88m-g3jw-g9cj are stated rather than left to range resolution at build time

A clean install now reports zero npm audit vulnerabilities, and every image passes the scan gate.

Upgrading

Drop-in from v1.2.0 — image tags and chart version only.

Full detail: GHSA-9f5v-x5qf-q2m8

Full Changelog: v1.2.0...v1.2.1