v0.10.3

Superseded by v0.11.0, the same server under the right number: the image change in this release breaks a self-written wget healthcheck and docker exec … sh, which is a minor bump under 0.x, not a patch.

v0.10.3: the release of 0.10.2 with its client packages

0.10.2 was tagged with a stale uv.lock, so its client packages were never published. The server is the same; the notes of 0.10.2 apply and are repeated here.

Security

• Next.js 16.3.8 closes six advisories in 16.3.7, among them cache poisoning of statically rendered pages and a server-side request forgery in image optimisation (GHSA-cjq9-62q9-8jv4, GHSA-4jqv-mc3x-m676, GHSA-mcj8-r9mp-w47p and three with less reach). Upgrade.
• A security policy: SECURITY.md says how to report a vulnerability privately and that only the newest release gets fixes.

For operators

• The image is distroless: Node and the server, no shell, npm or package manager (ADR 0028), so a scan of it reports what notefeed brings and nothing else. Two things stop working: a healthcheck: of your own in the compose file that calls wget or curl (remove its test: line; the image's own check does the same), and docker exec <container> sh. The data folder, PUID/PGID and user: behave as before.
• An SBOM per release: two CycloneDX files are attached below, one for the server's npm dependencies and one for what is in the image; the image carries an SBOM and a provenance attestation as well. See Security fixes and SBOM.
• A daily check of the dependencies and the published image for known vulnerabilities runs in the repository.

The client packages are unchanged; they take the version of the release.

Full Changelog: v0.10.2...v0.10.3

---

Install

# compose.yaml
services:
  notefeed:
    image: ghcr.io/notefeed/notefeed:0.10.3
    restart: unless-stopped
    ports:
      - "3000:3000"
    environment:
      # PUBLIC_URL: https://notes.example.com
      # NOTEFEED_PASSWORD: <openssl rand -hex 32>   # optional: lock posting and the web UI
    volumes:
      - ./data:/data

mkdir data   # notes are written as the owner of this folder
docker compose up -d

Then open http://localhost:3000 and pick a hard-to-guess feed name.

Client packages at this version: pip install notefeed==0.10.3 · npm install notefeed@0.10.3

Documentation: https://docs.notefeed.me/

SBOM (CycloneDX): the two .cdx.json files attached to this release. See Security fixes and SBOM.