A security patch for the v1.2 line. No feature changes, no schema changes, no config changes — the same v1.2.0 code, rebuilt on a current base image with the available dependency fixes taken.
It is one of the first two releases produced by the scheduled release re-scan (#1212), which re-scans already-published artifacts and the source at each supported tag against current advisory data, and raises a private draft advisory when a fix has become available since the release shipped.
What this clears
Base image — rebuilt on current Debian, clearing four HIGH libexpat1 advisories that had no fix when v1.2.0 was cut:
- CVE-2025-59375, CVE-2026-25210, CVE-2026-45186, CVE-2026-56408 (fixed in
libexpat 2.8.2-1~deb13u1)
Frontend dependencies — advisories published against v1.2.0's lockfile since it shipped:
- GHSA-r28c-9q8g-f849 —
postcss→ 8.5.25 - GHSA-mh99-v99m-4gvg —
brace-expansion→ 2.1.4 (unbounded expansion / OOM; the fix lands inside the 2.x line at 2.1.3, so no major bump is needed) - GHSA-52cp-r559-cp3m —
js-yaml→ 4.3.1 (quadratic CPU via merge-key chains) nextpinned to 16.2.12 andsharpto 0.35.3, so the versions that clear CVE-2026-64641/64642/64645/64649 and GHSA-f88m-g3jw-g9cj are stated rather than left to range resolution at build time
A clean install now reports zero npm audit vulnerabilities, and every image passes the scan gate.
Upgrading
Drop-in from v1.2.0 — image tags and chart version only.
Full detail: GHSA-9f5v-x5qf-q2m8
Full Changelog: v1.2.0...v1.2.1