What's Changed
Warning
This release fixes a critical vulnerability in zlib, several Node.js vulnerabilities found in the 4.0.2 Docker image, and 7 advisories in the server's Hono dependencies. Updating is recommended for all instances. (#279)
- Critical: CVE-2026-4738 (zlib)
- High: CVE-2026-123863, CVE-2026-123864, CVE-2026-123865, CVE-2026-123866, CVE-2026-123872, CVE-2026-123874, CVE-2026-126051 (Node.js)
- Medium: CVE-2026-123828, CVE-2026-123867, CVE-2026-123868, CVE-2026-123871, CVE-2026-123875, CVE-2026-123877 (Node.js)
- Low: CVE-2026-123829, CVE-2026-123862 (Node.js)
Hono advisories fixed by updating hono to 4.13.18 and @hono/node-server to 2.1.7:
- Medium: CVE-2026-126355, CVE-2026-126356, CVE-2026-126357, CVE-2026-126358 (hono), CVE-2026-126210, CVE-2026-126343 (@hono/node-server)
- Low: CVE-2026-126359 (hono)
Important
Razzia now runs on Node.js 26. The Docker image is updated for you. If you run Razzia without Docker, upgrade to Node.js 26 before updating.
Note
The Docker image no longer runs the app as root. On start, the config folder is given to user and group 1000. If you edit your quizzes from the host and get a permission error, set PUID and PGID to your own IDs (id -u and id -g). Set both to 0 to keep the previous behavior. See Configuration.
Security
- The Docker image no longer runs the app as root
New
PUIDandPGIDenvironment variables to choose which user owns theconfigfolder
Improvements
- Faster loading: the app is now served compressed and cached by the browser
Updates
- Upgraded to Node.js 26 (Docker image ships Node.js v26.13.1)
- Docker base image updated to Alpine 3.24.4
- Dependencies updated
Internal
- Security checks (dependency audit and Docker image scan) now run on pull requests to
main - Docker images are now built on native ARM runners
- Formatting now uses oxfmt instead of Prettier
Closes #279