This release rebuilds the Docker image on Node.js 22.23.4, which fixes the October 2026 Node.js security vulnerabilities. There are no changes to AirTrail itself.
The most serious of these, CVE-2026-111497, is in Node's Brotli decompression. AirTrail never decompresses user-supplied data and only makes requests to fixed upstream services, so exploiting it would require compromising one of those services. Updating is still recommended.
The other fixes cover DNS lookups, TLS certificate checks for IP addresses, crypto snapshots, the permission model and the HTTP client agent. AirTrail doesn't use the affected parts of Node, so these don't apply.
Full Changelog: v3.13.0...v3.13.1