notefeed 0.11.0

Released 2026-10-12 · on GitHub

v0.11.0: a distroless image (read before upgrading), a security fix in Next, a security policy and an SBOM per release

This is the server of 0.10.2 and 0.10.3 under the number it should have had: the image changes in ways an operator can notice, so it is a minor release. 0.10.2 and 0.10.3 stay published and are the same server.

Read before upgrading

• The image is distroless: Node and the server, no shell, npm or package manager (ADR 0028), so a scan of it reports what notefeed brings and nothing else. Two things stop working: a healthcheck: of your own in the compose file that calls wget or curl (remove its test: line; the image's own check does the same), and docker exec <container> sh. The data folder, PUID/PGID and user: behave as before.

Security

• Next.js 16.3.8 closes six advisories in 16.3.7, among them cache poisoning of statically rendered pages and a server-side request forgery in image optimisation (GHSA-cjq9-62q9-8jv4, GHSA-4jqv-mc3x-m676, GHSA-mcj8-r9mp-w47p and three with less reach). Upgrade.
• A security policy: SECURITY.md says how to report a vulnerability privately and that only the newest release gets fixes.

For operators

• An SBOM per release: two CycloneDX files are attached below, one for the server's npm dependencies and one for what is in the image; the image carries an SBOM and a provenance attestation as well. See Security fixes and SBOM.
• A daily check of the dependencies and the published image for known vulnerabilities runs in the repository.

The client packages are unchanged; they take the version of the release.