Oct 12
notefeed 0.11.0
Released 2026-10-12 · on GitHub
v0.11.0: a distroless image (read before upgrading), a security fix in Next, a security policy and an SBOM per release
This is the server of 0.10.2 and 0.10.3 under the number it should have had: the image changes in ways an operator can notice, so it is a minor release. 0.10.2 and 0.10.3 stay published and are the same server.
Read before upgrading
- The image is distroless: Node and the server, no shell, npm or package manager (ADR 0028), so a scan of it reports what notefeed brings and nothing else. Two things stop working: a
healthcheck:of your own in the compose file that callswgetorcurl(remove itstest:line; the image's own check does the same), anddocker exec <container> sh. The data folder,PUID/PGIDanduser:behave as before.
Security
- Next.js 16.3.8 closes six advisories in 16.3.7, among them cache poisoning of statically rendered pages and a server-side request forgery in image optimisation (GHSA-cjq9-62q9-8jv4, GHSA-4jqv-mc3x-m676, GHSA-mcj8-r9mp-w47p and three with less reach). Upgrade.
- A security policy:
SECURITY.mdsays how to report a vulnerability privately and that only the newest release gets fixes.
For operators
- An SBOM per release: two CycloneDX files are attached below, one for the server's npm dependencies and one for what is in the image; the image carries an SBOM and a provenance attestation as well. See Security fixes and SBOM.
- A daily check of the dependencies and the published image for known vulnerabilities runs in the repository.
The client packages are unchanged; they take the version of the release.
- The image is distroless: Node and the server, no shell, npm or package manager (ADR 0028), so a scan of it reports what notefeed brings and nothing else. Two things stop working: a