notefeed 0.10.3

Released 2026-10-11 · on GitHub

v0.10.3: the release of 0.10.2 with its client packages

0.10.2 was tagged with a stale uv.lock, so its client packages were never published. The server is the same; the notes of 0.10.2 apply and are repeated here.

Security

• Next.js 16.3.8 closes six advisories in 16.3.7, among them cache poisoning of statically rendered pages and a server-side request forgery in image optimisation (GHSA-cjq9-62q9-8jv4, GHSA-4jqv-mc3x-m676, GHSA-mcj8-r9mp-w47p and three with less reach). Upgrade.
• A security policy: SECURITY.md says how to report a vulnerability privately and that only the newest release gets fixes.

For operators

• The image is distroless: Node and the server, no shell, npm or package manager (ADR 0028), so a scan of it reports what notefeed brings and nothing else. Two things stop working: a healthcheck: of your own in the compose file that calls wget or curl (remove its test: line; the image's own check does the same), and docker exec <container> sh. The data folder, PUID/PGID and user: behave as before.
• An SBOM per release: two CycloneDX files are attached below, one for the server's npm dependencies and one for what is in the image; the image carries an SBOM and a provenance attestation as well. See Security fixes and SBOM.
• A daily check of the dependencies and the published image for known vulnerabilities runs in the repository.

The client packages are unchanged; they take the version of the release.