Security
- The Docker image runs on Node.js 24.22.1, which fixes CVE-2026-111497 (#2286). The Brotli
decoder built into Node.js could write past its buffer on a crafted compressed stream, which can
crash the server or, in the worst case, run code. The image was pinned to an earlier Node.js 24
release that does not have the fix. - Web Push delivery now goes through the SSRF guard and has a time limit. A push subscription
is only accepted for a publichttpsaddress, as every push service hands out, and delivery
connects through the same check at socket lookup that the other outbound integrations use, so a
subscription can no longer make the server connect into its own network. Existing subscriptions
with such an address are removed on the next delivery, like an expired one, and logged with their
host only. Each delivery now gives up after 10 seconds, so an unresponsive push target no longer
holds up reminders.