1.2.5 — 2026-07-10
A maintenance release: all dependencies and the build toolchain are refreshed, CI and the dev container move to Node 26 (the production image already ran Node 26), and an automated Docker security rebuild keeps the published :latest image patched with OS/base-image security updates between releases. No schema changes, no configuration changes.
Improvements
- Automatic Docker security rebuilds: a scheduled workflow (
.github/workflows/security-rebuild.yml) now rebuilds the latest stable release image every 2 days with a fresh base image and OS packages (pull+no-cache), so:latestpicks up Debian/Node security patches without waiting for a new release. It publishes:latestand a:<version>-<sha>variant; the immutable:<version>tag from the release build is left untouched.
Security & maintenance
- Dependency refresh: all dependencies bumped to their latest patch/minor — pnpm
11.3.0→11.11.0, Fastify5.8.5→5.10.0, Next.js16.2.9→16.2.10, recharts3.8.1→3.9.2, lucide-react1.21.0→1.24.0, undici8.5.0→8.7.0, the Radix UI set, plus dev tooling (ESLint10.6.0, Vitest4.1.10, Vite8.1.4, Prettier3.9.4, tsx4.23.0, typescript-eslint8.63.0, Playwright1.61.1). TypeScript stays on the 6.x line (7.0 breaks the current type-check).pnpm audit --prodreports no known vulnerabilities in the shipped runtime dependencies. - Node 26 across the board: CI and the dev container now run on Node 26, matching the production image; the server bundle now targets Node 24. GitHub Actions bumped (
actions/checkoutv7,actions/cachev6). - Dependency PRs target
dev: Dependabot now opens against thedevbranch instead ofmain, so updates land on the active branch and auto-merge after CI (patch/minor; majors stay manual) — removing themain→devback-merge.
Upgrade notes
No action needed — this release has no schema changes and no configuration changes.